Surveillance
What state and corporate surveillance does in 2026. The biometric infrastructure, the algorithmic monitoring, and the ways platform data reaches the state.
(IHS Markit projection made in 2019, when 54% of the world's 770 million cameras were in China)
(W3Techs; reduces low-effort interception; raises the value of endpoint and metadata surveillance)
(Citizen Lab, 2018. Documented targeting of journalists and activists spans dozens of countries across all spyware vendors; the true extent is unknown, since detection depends on someone thinking to look)
A note on framing. "Surveillance" gets used to mean several quite different things: targeted intelligence collection, mass metadata gathering, biometric identity systems, commercial data brokerage, social-media monitoring, and the algorithmic profiling that powers most of the modern internet. This page tries to walk through what each actually is, who is doing it, and where the picture is stable enough to describe with confidence. The goal is not alarm or reassurance; it is to make a force most readers cannot see directly more legible.
What surveillance means now
The image of "surveillance" is often a wiretap or a tail. The reality is mostly automated, mostly metadata-driven, and mostly operated through layers of routine data flows that ordinary citizens authorize without realizing.
Targeted state intelligence. The traditional category. Specific persons or organizations are watched by an intelligence service through human informants, communications interception, and physical observation. Digital tools have expanded this work, not replaced it. The Snowden (2013) and Pegasus (2021-22) disclosures, and later spyware exposures, document how broadly this has been used, including against journalists, activists, and opposition figures inside democracies.
Mass metadata collection. Phone records, internet connection logs, location pings, payment metadata, and communication patterns gathered at scale rather than targeted at specific individuals. The US programs exposed in 2013 (the NSA's bulk collection of Americans' phone records, since ended, and XKeyscore), their British counterparts, and the more direct Russian SORM (System for Operative Investigative Activities) and Chinese systems belong to this layer. Metadata is often legally treated as less sensitive than content, but in practice it can reveal who you talk to, where you go, what you buy, and what you read in detail that content interception rarely matches.
Biometric identity infrastructure. National ID systems, immigration checkpoints, airport face-matching, and increasingly day-to-day commercial use: India's Aadhaar (more than 1.4 billion enrollments), China's resident identification system tied to every digital service, and similar systems elsewhere. They were built for legitimate purposes and produce real benefits; they also produce a permanent identity-linked record of physical movement that did not previously exist at this scale. The newest layer is age checks. Australia has barred under-16s from major social media since December 2025, and Indonesia and Malaysia (which checks ID cards or passports) since 2026; Brazil, Britain and the EU have adopted or proposed age rules of their own. Supporters cite child safety; critics warn of data leaks and of ID checks becoming a condition of going online.
Commercial surveillance. The advertising-driven internet, where every visit, click, app interaction, and purchase is recorded, profiled, and traded between data brokers, advertisers, and analytics firms. Most people sign up for this when they accept terms of service that they do not read. The data is then bought by other parties including, frequently, governments, whose purchases of commercial data need no warrant even where collecting the same data directly would.
Algorithmic decision-making. Welfare eligibility, criminal sentencing risk scores, immigration pre-screening, employment screening, credit decisions, and increasingly health-care prioritization are made by automated systems trained on historical data. These systems are surveillance in a specific sense: they depend on accumulated personal data about populations, and they make consequential decisions based on that data, often with limited transparency or appeal.
Workplace surveillance. Email monitoring, keystroke logging, screenshot capture, productivity software, and the rise of remote-work monitoring. The COVID-era acceleration in remote-work tools normalized surveillance practices that had previously been confined to specific high-risk roles.
The Chinese model
China has built the most extensive integrated surveillance system any modern state has constructed. The system has been substantially documented by Western researchers and journalists; the broad picture is now stable enough to describe.
The components include comprehensive CCTV with face-matching coverage in major cities, real-name registration for nearly every online service, the Great Firewall filtering and logging international internet traffic, and payment systems (Alipay, WeChat Pay) that record nearly all transactions. Since July 2025 an officially voluntary "cyberspace ID" has tied ID numbers and face scans to one online credential. The social-credit framework is more fragmented than Western coverage often suggests but does involve real consequences for specific kinds of conduct. The deepest monitoring falls on specific populations, notably Uyghurs in Xinjiang, where the UN human rights office found "far-reaching, arbitrary and discriminatory restrictions" in 2022; Beijing calls its measures lawful counter-terrorism.
Two things are worth holding simultaneously. First, the Chinese system is qualitatively different from Western surveillance in scope and integration; treating them as the same understates what is being built. Second, much of what makes the Chinese system possible is technology developed in or copied from Western companies: chip designs, computer-vision algorithms, biometric matching systems, network infrastructure. The line between "Chinese surveillance" and "Western technology applied with different political constraints" is thinner than the geopolitical narrative suggests.
China also exports surveillance technology to dozens of countries: Huawei "safe city" installations across Africa, Asia, and Latin America, ZTE camera systems, and Dahua and Hikvision equipment. Whether this represents ideological export, commercial export, or both is contested, but the result is a global market in surveillance infrastructure that did not exist twenty years ago.
The Western model: commercial data, state access
Western liberal democracies have built a surveillance system that differs from the Chinese model in design but produces overlapping capability.
The Western system is built on commercial data accumulation supplemented by government access through purchase, legal process, and direct collection. Major platforms (Google, Meta, Amazon, Apple, Microsoft) collect detailed behavioral data as part of their normal business. Agencies reach this data through several channels. Court orders and warrants cover specific cases. Section 702 of the Foreign Intelligence Surveillance Act compels US providers to hand over, without individual warrants, the communications of targeted foreigners abroad (about 350,000 in 2025) and of any Americans in contact with them. Data brokers sell to agencies without a warrant, and informal cooperation between platforms and security services has been documented in various contexts and disputed in others.
What this produces in practice is a state surveillance capability without a centralized state surveillance apparatus. The data exists; the legal-and-political constraints determine when and how government agencies access it. Constraints have been weaker than the public conversation usually conveys; they have been stronger than the most alarmed reading suggests. Reforms after the 2013 Snowden disclosures of bulk collection (the USA Freedom Act and others) addressed some specific abuses while leaving the broader architecture in place. Section 702 itself lapsed on June 12, 2026, amid disputes over warrants for FBI searches of Americans' data and over Bill Pulte's appointment as acting director of national intelligence; collection continues under court certifications valid until March 2027.
The use of commercial spyware (NSO Group's Pegasus, Candiru, FinFisher, Paragon's Graphite) by Western and Western-allied governments, including against journalists and dissidents, has been documented by Citizen Lab, Amnesty International, and the consortium of journalists who broke the Pegasus Project disclosures. Its use inside the EU (Spain against Catalan independence figures, Hungary, Poland, Greece, Italy) has produced real political and legal consequences but has not stopped the trade. In April 2026 US Immigration and Customs Enforcement told Congress it uses Graphite against fentanyl traffickers and other criminal networks; critics fear use against protesters. Audit logs suggest local police have searched license-plate-camera data for immigration agents. At least 30 US localities dropped such cameras in 2025 and early 2026, though police say the cameras help solve crimes.
Where the technology is going
Several technical trajectories are reshaping what surveillance can do, faster than policy has adapted.
Face recognition at scale. Real-time face matching against large databases is now commercially available and has been deployed in airports, retail, sports venues, and city CCTV networks. Accuracy has improved substantially, though disparities by demographic group persist in many systems. The EU AI Act has banned live police face recognition in public spaces since February 2025, with narrow exceptions, but July 2026 amendments deferred its other high-risk biometric rules to December 2027. Several US cities ban police use; enforcement is uneven.
Pattern-of-life analysis. The combination of location data, communication metadata, and consumer transaction records allows reconstruction of an individual's daily patterns with high fidelity. Where you sleep, work, shop, exercise, worship, and socialize can be reconstructed from data that no single party "owns" but that aggregates across data brokers, advertisers, and platforms.
AI-assisted analysis at scale. Older surveillance was constrained by the ratio of analysts to data. AI largely lifts that constraint, enabling analysis of voice, video, and text at volumes that human analysts could not handle. The combination of cheap data collection and cheap AI analysis is the main shift of the past five years.
Predictive systems. Pre-crime risk scoring, predictive policing, automated welfare-fraud detection, and similar systems are deployed unevenly across democracies. Where they have been audited carefully, accuracy has often been poor and disparate-impact problems have been persistent. The deployment has frequently outpaced the audit.
End-to-end encryption. The widespread deployment of end-to-end encrypted messaging (Signal, WhatsApp, iMessage, others) sharply limits content interception. Governments have responded with three pressures: legal demands for "lawful access" (a secret 2025 British order that led Apple to pull its strongest iCloud encryption for UK users; EU child-abuse scanning proposals, dubbed "chat control" by critics; repeated US bills), targeted endpoint compromise via spyware, and metadata-based surveillance that does not require content access. The EU's scanning rules were still unresolved in September 2026; a temporary law allowing voluntary scanning of unencrypted messages was renewed in July, to 2028.
Quantum-resistant cryptography. Post-quantum standards protect traffic encrypted from now on, but traffic already captured stays exposed: the "harvest now, decrypt later" threat is real for sensitive long-term data and is shaping migration timelines.
The paths from here
Continued expansion within current frameworks
The aggregate volume of surveillance grows steadily. Specific abuses produce specific reforms. The overall pattern - state capability built on commercial data accumulation in democracies, integrated systems in authoritarian states - continues to widen its reach. This remains the trajectory in September 2026.
Substantial democratic pushback
A high-profile scandal (mass abuse of a biometric system, large-scale misuse of platform-state data sharing, electoral consequences of AI-driven targeting) produces sustained reform: stronger data-protection law, hard limits on biometric deployment, real oversight of intelligence-agency commercial purchases. The EU AI Act, GDPR, and similar frameworks are extended and tightened. So far the EU has instead delayed the AI Act's high-risk rules (July 2026).
Authoritarian consolidation accelerates
Existing authoritarian systems become more comprehensive. Several democracies that have drifted toward illiberalism adopt elements of the integrated-surveillance model. The line between authoritarian and democratic surveillance narrows. This is partly happening in specific countries already.
Encryption becomes the principal battleground
Government pressure for access to end-to-end encrypted content produces a major fight. It has begun, in Apple's court challenge to Britain's order and the EU's scanning dispute. The outcome shapes whether widely accessible private communication continues to exist for ordinary users. Different jurisdictions land in different places; the result is an uneven global picture in which encrypted communication is normal in some countries and constrained in others.
Major platforms shift business models
Apple's expanded privacy positioning has pulled others. Continued pressure from regulators, advertisers, and users leads to broader shifts toward subscription rather than advertising-funded models, on-device rather than cloud processing, and reduced data retention. The incentive that drives commercial surveillance partially weakens. Google's 2025 decision to keep third-party cookies in Chrome cut against it.
Where serious analysts disagree
Surveillance is the central political question of our time
The accumulated capability of state and corporate surveillance has reached levels that are qualitatively new and politically decisive. The traditional liberal-democratic settlement assumed that ordinary citizens were largely unobservable to the state; that assumption no longer holds in either direction. Without serious structural reform, the long-run political consequences will be substantial.
Held by: Shoshana Zuboff ("The Age of Surveillance Capitalism"), Bruce Schneier, Edward Snowden's policy advocacy, the Electronic Frontier Foundation, Privacy International, and the broader digital-rights community. Critics reply that where courts, a free press and elections work, the feared consequences have been limited.
Surveillance concerns are overstated relative to security benefits
Modern intelligence-and-security capabilities have produced documented benefits: thwarted terrorist plots, criminal investigations, child-protection cases, financial-crime enforcement. Privacy advocates underweight these benefits and overstate the actual harms. The democratic safeguards that exist are more substantial than the alarmed reading conveys.
Held by: parts of the security and law-enforcement community, child-protection groups, Stewart Baker (formerly NSA general counsel), and a strand of intelligence-policy thinking. Supporters cite a 2026 staff report of the US privacy oversight board calling Section 702 one of the country's "most valuable tools," and 21.3 million child-exploitation reports, 99% from platforms, to the US clearinghouse in 2025. Critics note the same board found in 2014 no case where bulk phone-records collection had made a concrete difference to a counterterrorism investigation.
The commercial layer is the underweighted variable
Public attention focuses on state surveillance. The commercial layer (advertising data, data brokers, platform analytics) is larger, less regulated, and increasingly indistinguishable from state surveillance because of the data-purchase pipeline. Reform that addresses state surveillance without addressing the commercial substrate misses most of the picture.
Held by: Cory Doctorow, Maciej Ceglowski, Julia Angwin, parts of the privacy-researcher community. Supporters cite Cambridge Analytica and government data purchases; critics reply that companies cannot arrest anyone and that advertising pays for free services.
Authoritarian and democratic surveillance are categorically different
Treating Chinese, Russian, and Iranian surveillance as morally equivalent to Western surveillance flattens distinctions that matter. The deployment of surveillance tools to suppress religious minorities, jail journalists, or maintain single-party control is a different kind of harm than commercial advertising or even Western intelligence-agency abuses. Critique should distinguish accordingly.
Held by: the human-rights and democracy-monitoring community, parts of Western foreign-policy thinking, and dissidents-in-exile from authoritarian states. Critics reply that the line blurs when democracies turn the same tools on journalists, activists and opposition figures, as in Spain, Greece and Italy; defenders answer that courts, parliaments and the press then exposed the abuse.
Surveillance backlash will be technical, not legal
Legal protection has been chronically slow and uneven. Technical protection - end-to-end encryption, on-device processing, federated and decentralized systems, privacy-preserving cryptography - has produced more durable change. The future of meaningful privacy is more about whether the technical tools are widely available and used than about whether legal frameworks improve.
Held by: parts of the cryptography research community, several major end-to-end encryption advocates, and a strand of technical-libertarian thinking. Supporters point to encryption now built into messaging used by billions; critics note that governments answered with spyware and legal demands.
What the available evidence supports: surveillance capability has expanded substantially in two decades, through authoritarian states and Western governments' access to corporate data. Law has lagged the technology; the commercial layer is large and, in the United States especially, lightly regulated. Authoritarian and democratic systems differ in scope and integration, and above all in their checks - independent courts, a free press, elections that can remove those in charge - which democracies have, if unevenly, and autocracies lack. What matters most next: encryption, age verification, government purchases of commercial data, and AI analysis of accumulated data.
What this means for you
Practical privacy hygiene
Most ordinary surveillance exposure is reduced substantially by a small set of practices. Use end-to-end encrypted messaging (Signal, WhatsApp, iMessage where appropriate) and a privacy-respecting browser (Brave, Firefox with privacy settings, DuckDuckGo). Use a password manager with unique passwords, and review app permissions periodically. Use privacy-focused alternatives where possible (DuckDuckGo for search, Proton or similar for sensitive email). These do not protect against targeted state surveillance; they do cut ordinary commercial and ambient exposure.
If you face a heightened threat profile
Journalists, activists, dissidents, abuse survivors, lawyers handling sensitive cases, and others at heightened risk have access to specialized resources. Consumer Reports' Security Planner, Access Now's helpline, the Electronic Frontier Foundation's Surveillance Self-Defense, and threat-modeling consultations from organizations focused on this work make a real difference. Generic privacy advice is inadequate at this level; threat-specific guidance is.
If you make consumer technology choices
Platforms now differ enough on privacy to be worth comparing. Apple's privacy positioning is partly marketing and partly real; Google's and Meta's data collection is extensive; Microsoft is somewhere in the middle. End-to-end encrypted services are more numerous than in 2015 and increasingly mainstream. Practical privacy is now more achievable than it was, for users willing to invest moderate effort.
If you read coverage of surveillance issues
Primary documents (court rulings, oversight reports, official statistics) and specialists such as Lawfare and the Citizen Lab are usually more precise than general coverage, which the technical complexity often trips up. Advocacy groups on each side, from digital-rights organizations to law-enforcement and child-protection bodies, supply useful detail but argue a case.
If you vote on surveillance-related policy
The most consequential current questions are encryption policy (whether end-to-end encryption is preserved or weakened by mandate) and age verification. Others are data-broker rules (whether government purchases of commercial data should need a warrant), AI-system regulation (specifically high-impact use cases), and intelligence oversight, including the terms of any US Section 702 renewal. These are unglamorous and consequential; political engagement that is informed by the technical specifics is more useful than rhetoric in either direction.
