Can AI Coexist With Privacy? Proton’s Andy Yen Says It Will Have To

So inadvertently, the business model of the internet had brought us into an age where we had the highest amount of surveillance at any time in human history, and that seemed [like it was] really not the way the internet should have gone. And that’s what really motivated us to think, what are ways we can address this problem?

Proton is really a response to that. Today, the default business model of the internet is that everything you do is recorded, shared, monetized, and abused for purposes that are beyond your control. And we should really build an internet where privacy isn’t an add-on that you can maybe get if you go through five menus and click ten different buttons; it should be the default.

And that was what led to the creation of Proton Mail back in 2014.

And if you can bring us up to the present, where is Proton today, for people who may not be familiar with it?

In 2014, if I went out on the street and I asked somebody, “How does Google or Facebook make money?”—probably one in 10 people would give me the correct answer. Today, if I go out into the world, it’s not 10 out of 10, but probably six or seven would actually know the answer. What that really means is the concern that people have for their data online has massively increased in the past decade.

So Proton went from having a couple hundred thousand users to now over a hundred million. And email is the core of Google’s business model. You know, the reason Google can track you is that you’re logged in, and the reason you’re logged in is that you have a Gmail. And so if you are able to attack that piece, that’s actually the most effective piece to first dislodge somebody out of the Google ecosystem.

So we started with email, did a calendar, file storage, documents, essentially recreating the entire Google Workspace, but in a more privacy-first way, and I would say without the creepy business model that Google employs.

So how many people have you actually dislodged from Google? How many minds have you freed?

We’ve dislodged a hundred million people so far, and we hope to dislodge a lot more in the decades to come.

That’s an impressive number. How many of them are paying customers?

Well, it’s a freemium business model, so most of them use it for free, but the typical conversion rates that you see for freemium business models are usually between 1 and 3 percent, and Proton sits in that bucket as well.

You mentioned a couple of these landmarks in the history of surveillance capitalism, starting with Snowden. Today, anecdotally, the reason that more people are asking me about Proton than any other is AI. People keep asking me—my own family, my friends—if they should switch to Proton, and they’re asking because they’re sick of having AI pushed on them in Gmail in particular.

Are you capitalizing on this AI backlash, this resistance to AI that is making people think about their privacy?

We are capitalizing on it, and we’re making it easier than ever now to switch. So for example, now there’s an easy switch tool on Proton where you can basically bring all your emails from Google automatically and get everything put into Proton in just a couple clicks.

But my take on this trend is actually a little bit more nuanced. AI is surveillance. The internet is surveillance. And that’s something that we have to come to terms with. The genie’s out of the bottle; we’re not gonna put it back in, and we are not gonna be returning to a pre-AI world. If we accept that as a fact, the key question becomes: Who do we want to have as the future stewards and controllers of this new future that we’re all stepping into today?

And the options are: Number one, it can be the gigantic tech companies of the world who have done everything possible in the last two decades to prove that they cannot be trusted with your data; or maybe it can be some other independent tech companies with different business models. So Proton is also building AI features and AI tools, because I think if the privacy companies do not find a way to step in to build privacy-first AI, we are essentially ceding the future to tech companies that don’t have the best interests of users at heart.

This is what happened in the late ’90s, early 2000s when we let Google, Meta, Yahoo, and these other companies take over the entire [digital economy]. So our push into AI is really to try to avoid a repeat of that mistake that was made several decades back. We think it’s important to actually be present there.

Are you in fact excited about AI?

Yeah. If I were to describe Proton’s stance, I would say we were reluctantly pulled in, but we saw the writing on the wall. Once we came to the conclusion that AI was here to stay, it was unavoidable—if we were to fulfill our mission—that we also [had to] enter the space to provide an alternative.

I would probably prefer a world where AI didn’t exist, but it’s here.

Interesting. Do your users agree?

This has shifted quite a bit in just the last two to three years. When we first came out with the AI features in Proton, there was quite a bit of backlash. People were sort of like, “Why are you doing this? It’s a waste of resources. It’s not what Proton stands for. You’re just becoming like another tech company,” you know. But then, after we put out Lumo last year, what we really saw in the weeks and months after was: The exact same person who was flaming us for putting out this feature in July was now flaming us for not making Lumo better.

They’re like, “Oh, this is not good enough. You gotta make this a better product.”

So I don’t think they’re allergic to AI as a concept. I think they’re allergic to what AI represents in the Big Tech definition of AI. But when Proton does it in a way that actually ensures privacy, security, and ownership of their data and their conversations, then actually they’re OK with it.

Well, it’s an interesting framing: Would you rather that Google have access to your chats with an AI, or would you rather trust Proton? But I was kind of surprised, when I dug into how Lumo works, that it is not end-to-end encrypted chatting with an AI.

The privacy promise of Lumo is exactly that—a promise from Proton that “we’re not gonna look at these logs. In fact, we’re not gonna log this at all.” It’s not the kind of technical promise of encryption, which is “mathematics has prevented us from reading your email.”

Yeah, with Proton Mail, the guarantee is actually mathematical. As a physicist, I like mathematical guarantees, right? The issue with LLMs is that the technology for doing that in a fully end-to-end encrypted way is not there yet. I think it will get there in a couple years.

So the choice was either to sit on the sidelines and wait a few years for the tech to get there, or wade in and begin to understand the space and begin to offer a product. Now, a promise is not as good as a mathematical guarantee, but a promise made by the right people is still actually quite substantial.

Of course, I hope in the years to come to be able to upgrade to a promise that is mathematically guaranteed. And there’s some interesting research work being done by Nvidia that in probably two years’ time will get us to a point where you can actually do LLMs in a fully, let’s say, end-to-end protected way.

I’m trying not to get too nerdy here, but are you talking about homomorphic encryption?

No, it’s basically—do you know about TPMs, trusted platform modules, and how that works a little bit?

Yeah. If I could try to summarize it, it’s kind of like: You can’t encrypt the whole chat, but you can use cryptography to create a technical guarantee that part of the computer won’t look at another part of the computer.

There’s a kind of secret enclave where these chats can happen, and it cannot be inspected by the rest of the server, essentially. So that creates a kind of technical guarantee of privacy. It’s certainly not end-to-end encryption, but it seems like something, in fact, that you could be doing today. I mean, other people are doing it. So can you explain why Proton is not?

This is why I didn’t say end-to-end encryption, I said end-to-end protected. Because it’s not technically end-to-end encryption, it’s as you say: You can run the processing on the GPUs, but in a way that the rest of the pipeline that delivers the tokens to and from the GPU is not able to view it.

And through using this secure execution environment, you can have a cryptographic guarantee that nobody else along the pipeline could look at what was sent to the GPU.

That’s maybe the best simplified way to explain it. And yeah, it’s possible to do some of this already today, but there are certain, let’s say, performance issues. It’s still a little bit clunky. It doesn’t have proper support across the entire stack. So I wouldn’t say it’s impossible, but it’s gonna get easier to do in the years to come.

Got it. Well, it is interesting, though, that people are already doing this today. Other products do use these trusted execution environments; they don’t just promise not to look at your conversations. But you don’t feel like it’s up to snuff yet? It doesn’t have certain features? What’s lacking? Why is Proton not using this now?

Well, first, you have to re-architect essentially your entire platform in a way to do that. So it’s quite a bit of work. Also, when we put out Lumo last year, a year ago, the technology for AI was a lot more immature, right? Then there’s also the interfaces with the GPUs themselves.

So, you know, Proton is not running on a cloud. We run our own infrastructure. And so then you’re pipelining it, and the libraries that Nvidia provides to do that have to be good, have to be stable, they have to be completely working, they have to be fleshed out, they have to be, you know, making sure there’s no security issues.

So the technology for me, like I said, it’s, it’s almost mature, but we’re probably in a better position to fully deploy it in, let’s say, the next year or two.

OK.

So it’s pretty close. Some people are already doing it, but we have a bigger deployment environment.

We have tens of millions of people using Lumo. We cannot move fast and break things as Mark Zuckerberg would say. We have to do things in a more careful and considered way because we have all the security requirements that we also have to keep in mind as well.

Yeah. I mean, to be fair, I think people do trust Proton, and that’s why people switch to Proton.

But the people who use Proton also have trust issues. They don’t want to trust anybody! I mean, for anybody who uses cryptography—you don’t want to believe a promise, you want to believe the math. So I don’t know if you’re committing to it here that you will switch …

Yeah, we are committing to it. And actually, if you look at Lumo’s security model, which is published, you’ll see that we’ve already built the infrastructure to kinda do this. We’re just missing the last piece, at the interface to the GPUs. Look, I don’t wanna give too much away, but some might infer from this that perhaps some work has already been done on this in Lumo already.

OK, very interesting.

Now, setting AI aside, the other most common reason I get asked about Proton these days is, of course, this fear of creeping fascism in the US and around the world. This is an extremely fraught political moment, and people are afraid of surveillance—in some ways more than ever before—from governments.

Is that also pushing people towards Proton? Are you seeing a Trump bump?

We definitely saw a Trump bump, but we also saw a Biden bump. I think privacy is one of those few issues that is not really partisan. It’s something that is appreciated by both the left and right. So when Biden came into power, the people who supported Trump said, “Well, I’m not comfortable with these crazy leftists having control of my data and spying on me.”

And then when Trump got into power, people on the left said, “Well, I’m not comfortable with these crazy fascists having access to my data.” So it’s a concern for both sides.

You probably know, in privacy, the famous “nothing to hide” argument, right? You know, “I don’t need privacy, because I have nothing to hide, and I’m not doing anything illegal.” Even if that is true, the problem is that what is considered illegal changes over time.

So you have nothing to hide as long as you agree with the current definition of what is, quote-unquote, “illegal.” It doesn’t really matter your political leaning, whether you’re on the left, on the right, or in the center. Privacy is something you should care about because it’s the only guarantee you have that, no matter how the next election goes, your data is secure.

Yeah, I mean, I would love to get on board with this bipartisan push for privacy. But I feel like we have to acknowledge that this current administration has vowed to use the Department of Justice to prosecute its political adversaries; that it has vowed to deport millions of people living in America; that it’s given billions of dollars to ICE to carry out that mission. I mean, I don’t mean to be the first one to take a political side here, but it does feel like we’re in a certain moment.

Yes. And the moment is especially relevant because I can give you maybe the European context to this. You could pretty accurately say that politics in the US really lurched to the right in the past 10 years or so, and the same thing’s happening in Europe as well.

In the UK, if the election were to be held now, it’s quite possible that the far-right Reform party could win. If you look at France and you look at the polling for the next presidential election, Le Pen, even with her ankle bracelets, has a decent chance of winning. In France or in Spain or even in the US, if you were to put in place more surveillance, more regulations, more controls over the free internet because you think that might prevent the far right from coming into power—well, if they come into power, they’re going to take the new regulations, the new surveillance ordinances, the new surveillance powers that you have put into the legislation, and they’re gonna use that against you.

So the powers that Trump is using today to suppress dissent and go after people that don’t agree with him: Actually, he didn’t pass any new legislation on this at all over the course of his most recent term. In fact, he was using powers that were already in place when Obama was around, when Biden was around, and maybe even from further before, right?

Absolutely.

So probably these powers should not have been there in the first place. They were probably tolerated for a long time because people thought, “Oh, well, I trust the current people in power.” But this can change very quickly in a democracy. And this is the cautionary tale. Age verification, [requiring] ID to use the internet, data retention laws, all the stuff that is being pushed out: When the far right gets into power, you’ve just given them, like, all the tools they need to really mess up democracy.

So we need to have a more balanced approach. This is why I look at a lot of these legislative efforts that are being pushed across Europe these days, and I think people are not thinking through what can actually happen if they succeed today in passing these new regulations.

Going back to Snowden, this is exactly what he called turnkey tyranny.

He was warning not just that the Obama administration would use these surveillance powers, but that they were building a machine that any tyrant could turn the key on and create a panopticon.

I guess the question is, do you feel like that is happening now in the US in particular?

Well, it’s already happened in the US.

Like I said, Trump didn’t pass any legislation. He just took the powers that were already present there, that any president could have deployed, and he deployed them in the way that he saw fit, which was in ways that people didn’t anticipate. But this is why you have to have foresight when you pass legislation.

You need to be careful in legislation because you cannot always assume that your preferred party is still gonna be in power in the future, and you need to consider, “Would I be happy to have this law on the books if it was somebody else in power?“ And if the answer is no, then you probably should not pass that law.

I have to press you on this just a little bit, though, because there was some controversy over your statements about partisan politics in the US a couple of years ago. Around the time that Trump was elected, you tweeted, “Ten years ago, Republicans were the party of big business and Dems stood for the little guys, but today the tables have completely turned.”

I think people got mad about that, and then Proton put out a statement that actually kind of backed it up, that included this line, “Until corporate Dems are thrown out, the reality is that Republicans remain more likely to tackle big tech abuses.“ Do you stand by that a couple of years into this Trump administration? Where did that come from? Was it a kind of subtle endorsement of the left, actually, in opposition to centrist Democrats, or can you explain this?

Well, actually, the context around this was talking about the antitrust pick that Trump put in place. And, you know, to be completely fair, when Biden made his antitrust pick, I liked that pick as well, so I also praised that one, right?

And I actually thought Trump picked the right person for antitrust. I thought that was a good candidate. The pick that I liked was eventually fired by Trump, and probably the prospects of antitrust at the DOJ level are not gonna be the same now as they were when Gail Slater was still in place.

What I think is interesting, though, is if you look at what’s happening on Capitol Hill, senators Grassley and Klobuchar have reintroduced the American Innovation and Choice Online Act, right? So that’s back. I don’t know if it’s going to pass this time around. It didn’t make it under Biden, but the fact that the bill got reintroduced and is being discussed does show that antitrust is not dead in the US.

And this is, in my opinion, very important because the European Commission is not gonna be able to effectively regulate American tech companies. It just does not have the power and the capability to do that. The only government that can really regulate US tech is actually the US. So the cutting edge of antitrust enforcement, the place that will make the biggest impact, is still the US.

And I think we need to do our best to support antitrust efforts, because this is the one thing that is going to make a difference. Capitalism is not gonna solve this problem for us. In fact, we know very well that capitalism is the creation and the cause of this problem. My suggestion for Democrats—as they prepare for the midterm elections and maybe taking back the White House—[is that] I think Bernie was correct in his assessment of why they lost the last election: You need to be able to offer something different if you want to actually be competitive. And today, if I look at tech policy, views on antitrust, and willingness to challenge the big corporations that in my view have way too much power, there is not much of a difference between the two parties in the US.

And that is something that we’ve seen over and over again, where every single administration is unable to get antitrust passed.

So essentially, it sounds like you are just an anti-corporatist above all. Like, you were kind of voicing your support, maybe your optimism, that the Trump administration would take an antitrust approach to Big Tech. It doesn’t seem like that happened. In fact, I would say that Big Tech has completely lined up behind Trump. I worried reading your statement that maybe Proton was lining up behind Trump as well. It doesn’t sound like that’s the case. If anything, it sounds like you are ready to join the Democratic Socialists of America. Is that correct?

Well, look, I don’t really discuss politics, but I did give away most of Proton to a nonprofit foundation. And Bernie would probably approve, let’s put it that way.

I’d like to come back to Proton’s interesting organizational structure later.

Yeah.

But the EU has also shown signs of wanting to undermine encryption, and now we see the advent of “Chat Control,” which I think will voluntarily ask big tech companies not to put backdoors into end-to-end encryption—as privacy advocates have always feared—but rather to scan content on the endpoints, which is arguably a different way of undermining people’s privacy.

What do you think of this push for surveillance in some form in Europe? What is it like to be a privacy-preserving anti-surveillance company in Europe today?

The thing that I found disappointing is that the push for Chat Control actually came from the political left. It was actually the socialist minister from Denmark when Denmark had the presidency of the EU.

Now, in the end, I think the EU did the right thing because it split Chat Control into sort of two versions. There’s the version where you’re allowed to voluntarily do scanning—so this is what we call 1.0—and there’s a version 2.0, which is that you’ll be forced to do scanning. It was not voluntary anymore.

Right. And we should say what this scanning is: The idea is that because information might be encrypted in transit, you scan people’s computers at the endpoints. You scan their phones.

You scan the phone. So before you write a message, it’s gonna check with Big Brother if the message is OK. If it’s not OK, it sends it to the police, and the police come arrest you. This is basically what 2.0 would have done.

And that sounds crazy, right? It is crazy. So I think there was enough opposition in Europe that people woke up to the dangers of that.

These things, like zombies, have a way of coming alive again and reappearing. But my take is that actually 2.0 is dead. And 1.0, the voluntary scanning, probably shouldn’t have passed. But that, for me, is not so objectionable, because it doesn’t break end-to-end encryption. It doesn’t force scanning. It just allows you to do it on a voluntary basis if you decide that you want to do that.

Meaning the company, though, not the user.

Yeah, yeah, yeah, the company decides. So essentially Google and all these companies, now they’re gonna go scan all your shit, and they’re gonna do it happily, now that they have legal cover to do it. Proton is not gonna do it.

With this kind of voluntary scanning model, maybe it creates more pressure for people to move from Google to Proton. But it also seems like it will create an environment where the government can say, essentially, “Look, all these other companies opted in, but Proton, you’re protecting all of these evildoers. What’s your problem?” And that creates pressure on you. Perhaps it’s a foot in the door to create a more mandatory kind of scanning.

Yeah, once you open the door a little bit, it becomes easier to push the door open wider, and this is something that we have to be very careful about.

I would say, though, Europe has this problem. The European economy today is not competitive. There are massive economic problems that are impacting the entire continent. And what I think is important is that there has to be a tech sector that can be successful in Europe, because tech is the driver of most economic growth for the past couple of decades.

And Europe today doesn’t have a tech sector. Effectively, it doesn’t. And if you want to build a tech sector in Europe, what is going to be the competitive advantage for your industry? You are not gonna have more money or a bigger market than the US. Not gonna compete there. You’re also not going to work longer hours than the Chinese. I’m from Taiwan, so I can tell you it’s not gonna happen, right?

I have lived in Europe for 15 years. And it’s also not gonna have the efficiency of China, where democracy is kind of an afterthought. So if you don’t have the money and the talent of the US, and you don’t have the speed and the scale of China and the work ethic of China, what do you have left to actually compete with effectively?

I think the only thing that Europe has left is actually the values. What Europe stands for is democracy, freedom, privacy, and security. And the four things that I mentioned are predicated on the concept of trust. So trust is actually Europe’s only competitive advantage in the digital era. And if you pass legislation like Chat Control, which undermines that trust, what you’re basically doing is destroying the foundation for your future economic success.

This is the message that I’ve been trying to push in Brussels and other capitals across Europe, because once you realize that, you understand how ridiculous and how counterproductive something like Chat Control is.

As we were saying, Chat Control might actually push more people to Proton in the short term. That brings me to this question we were talking about earlier: What is Proton’s incentive? Is Proton a for-profit company? I know you’re part of a Swiss foundation. Can you explain? What is Proton seeking as a corporation?

Well, our structure is quite unique. Maybe the best way to answer your question is to look at Google. Google’s slogan used to be “Don’t be evil,” right?

Of course, yeah. Circa 2006-07.

What happened? How did Google go from “Don’t be evil” to, well, basically evil?

I think two things happened. One, there was a misaligned interest between Google and its users. Because today, if you’re a user of Google, actually you’re not Google’s customer, right? You’re the product that they’re selling to the real customers, which are the advertisers. So there was a fundamental conflict of interest that was inherent in Google’s business model.

The number two thing was: A corporation is kind of a very imperfect vehicle because it is legally compelled to act in the best interest of shareholders. And the best interest of shareholders is the maximization of profit, even at the expense of users and customers of that business.

And that, if you think about it, is another misalignment of interests that exists in the corporate role. So going back to the question of my politics, you could say that I’m an anti-corporatist, right? I don’t believe in the corporation as the correct structure to meet the needs of society as a whole.

So Proton’s structure is, let’s say, a way to try to resolve that paradox.

Well, could I ask: What is the structure?

The structure today is that the largest shareholder, the controlling shareholder, is a nonprofit foundation. And the sole asset that this foundation holds is actually shares of a for-profit, Proton AG.

The reason I suspect this is going to work is twofold. Proton the corporation is accountable to its shareholders. But the biggest shareholder is a nonprofit foundation whose mission is democracy, privacy, security, and freedom around the world. That means the company will never be pressured to take actions that undermine that, because it is inconsistent with the mission of its primary shareholder.

On the other hand, the company does make a profit. It is self-sustaining. It doesn’t have VC investors. Its employees actually have stock options, so they retain a profit incentive, and will have to compete in a capitalistic market in an efficient and effective way to survive in the dog-eat-dog world of capitalism as a corporation.

This is also a protection for the foundation, because a foundation actually is controlled by its funders. If you’re a foundation and all of your funding comes from one or two entities, guess what? Actually, you’re controlled by those one or two entities.

But Proton Foundation gets all its money from a profitable company which it controls, so it is not subject to pressure from external stakeholders either. And this is why the combination of the corporate with the foundation, in my opinion, is a self-reinforcing structure that actually protects both the company and the foundation.

We’ll see in 10 years if I’m right or wrong.

I don’t know. I’ve never heard of a tech company that works quite like this before.

It’s about checks and balances. The fact that the nonprofit owns a profitable business means that it’s not begging around every single year for donations. That means it’s sustainable, it’s secure for the long term. But the company being controlled by the nonprofit means that the company needs to embody and adhere to certain values.

It has never been done. It is completely an experiment. It very well may fail in the next couple years. We’re gonna see how this goes. But I think it sort of avoids the pitfalls of both of the examples that I gave, and so this is the answer that I arrived at as a pragmatic anti-corporatist.

Well, let’s check in in 2036. Before I let you go, there is one other question I wanted to ask you. This is perhaps just my personal obsession. Proton has successfully end-to-end encrypted so much of its users’ lives, and especially their work lives, but there’s still Slack, this massive repository of sensitive workplace communications.

Yeah, none of it is encrypted. Same goes for Discord, Microsoft Teams, whatever flavor of this you use in your organization. It all feels like this huge vulnerability. This giant repository of searchable, unencrypted communication about everything we’re talking about in our workplaces can be breached or obtained by law enforcement, just subpoenas.

So when is Proton going to release Proton Slack, Proton Discord?

I can’t answer the when, because that assumes I’m doing it. Can’t confirm or deny. I’m gonna keep it like that. But I agree with you. I think that’s a problem, and it’s something that we think a lot about.

You know, we recently released Proton Meet, which is the end-to-end encrypted Microsoft Teams or end-to-end encrypted Zoom. And that starts to put us closer to the chat space as well, because actually you can chat when you’re having a video call on the side. And the chats are actually end-to-end encrypted. We’ve already figured that out. So I think we have the pieces to do it. And stay tuned. I hope to be able to solve this problem for people someday in the future.

All right. Thank you, Andy. I really appreciate you doing this. Great to talk.

Great. Thanks a lot for having me on.

Update: 8/18/2026, 10:56 AM EDT: WIRED has corrected a section where the speaker was wrongly indicated as Andy Yen, when it was actually Andy Greenberg.

How to Listen

You can always listen to this week’s podcast through the audio player on this page, but if you want to subscribe for free to get every episode, here’s how:

If you’re on an iPhone or iPad, open the app called Podcasts, or just tap this link. You can also download an app like Overcast or Pocket Casts and search for “uncanny valley.” We’re on Spotify too.