Privacy Shield Is Gone: What Replaced It and EU Alternatives for Email Marketing

Privacy Shield no longer exists. The Court of Justice of the EU struck it down on 16 July 2020, in the case known as Schrems II. Since 10 July 2023, transfers of personal data to certified US companies can rely on its successor, the EU-US Data Privacy Framework. As of 1 November 2026 that framework is in force, but it is under legal pressure, so it pays to know which email providers are based in, and host data in, the EU.

What was Privacy Shield and why was it struck down?

Privacy Shield was a European Commission decision from 2016 that allowed personal data to flow from the EU to US companies that signed up to it. The GDPR only allows transfers outside the EU when its conditions are met, and Privacy Shield was the Commission's finding that those companies protected data adequately.

In Schrems II, the Court disagreed and found that Privacy Shield did not ensure adequate protection. The safeguards the US added afterwards show what the main problems were: broad intelligence access to personal data, and no effective way for Europeans to seek redress.

The ruling did not stop all EU-US transfers. The Court held that standard contractual clauses remain valid, but data protection authorities must suspend or prohibit a transfer when the clauses cannot be complied with in practice.

What replaced Privacy Shield?

The EU-US Data Privacy Framework. On 7 October 2022 the US issued Executive Order 14086. Together with a regulation from the US Attorney General, it limits access by US intelligence agencies to what is necessary and proportionate, and it sets up a redress mechanism for complaints from Europeans, including a Data Protection Review Court. The European Commission adopted its adequacy decision on 10 July 2023.

Since then, personal data can flow freely from the EU to US companies that take part in the framework. The Commission says the new US safeguards apply to all transfers to US companies under the GDPR, including those made with standard contractual clauses.

Is the Data Privacy Framework still valid?

Yes. As of 1 November 2026, the framework is in force and the European Commission still lists it among its adequacy decisions. Under the GDPR, the Commission can suspend, amend or repeal it, and the Court of Justice alone can declare it invalid. Four developments put it under pressure:

• The Latombe appeal. On 3 September 2025 the EU General Court dismissed a challenge by Philippe Latombe and confirmed that the US ensured adequate protection on the date the framework was adopted. He appealed to the Court of Justice on 31 October 2025 (case C-703/25 P). As of 1 November 2026 the appeal is pending: no Advocate General opinion or judgment has been published.
• The US oversight board. In January 2025 the US President removed the three Democratic members of the Privacy and Civil Liberties Oversight Board, an independent US agency. The Commission calls the board's role in reviewing how intelligence agencies apply the new safeguards important. The board's budget request of February 2026 says it has one member and works without a quorum, and its website still lists one member as of 1 November 2026.
• Trump v. Slaughter. On 29 June 2026 the US Supreme Court ruled that the law protecting Federal Trade Commission members from removal without cause is unconstitutional. The FTC enforces the framework's rules against certified companies, and the adequacy decision refers to the FTC's independence. On 31 July 2026 the European Data Protection Board, which brings together the EU's data protection authorities, asked the Commission to closely assess whether the ruling affects the framework.
• A lawsuit announced by noyb. On 29 June 2026 the privacy group noyb asked the Commission to withdraw the framework in an orderly way and said it would file a lawsuit aimed at having the Court of Justice annul it. As of 1 November 2026, noyb's news page has not announced a filing. noyb says such cases typically take two to three years.

As of 1 November 2026, the Commission's data protection pages show no suspension, change or new review of the framework. After its first review in October 2024, the Commission set the next periodic review for three years later.

Privacy Shield lasted four years. Its predecessor, Safe Harbor, was struck down by the same court on 6 October 2015. If your email platform depends on the framework, plan what you would do if it fell too.

What does this mean for email marketers?

Your email platform stores some of your most sensitive marketing data: contact lists, behaviour, and often purchase or CRM data. Before choosing or renewing a provider, check four things:

1. Where the company is based. The US CLOUD Act of 2018 requires providers under US jurisdiction to disclose data in their possession, custody or control when lawfully ordered to, whether the data is stored inside or outside the United States. An EU data centre alone does not settle the question if the provider is subject to US law.
2. Where the data is hosted. Look for a clear statement on data location in the provider's data processing agreement, not just a "GDPR compliant" badge.
3. Which sub-processors it uses. Many providers rely on US cloud, analytics or support tools. The sub-processor list shows where your data really goes.
4. Which transfer tool applies. If data does leave the EU, the agreement should name the transfer tool, such as Data Privacy Framework certification or standard contractual clauses.

What types of email providers are there?

The old version of this page grouped providers by use case. That is still a useful way to build a shortlist:

• Email marketing platforms create and send newsletters, campaigns and automated flows, with editors, segmentation and reporting.
• Transactional email services send one-to-one messages triggered by your software, such as password resets, order confirmations and welcome emails, usually through an API. See how to create a transactional email.
• SMTP relays specialise in delivering email that other systems generate, with a focus on deliverability. See why email deliverability matters.

EU-based email providers to consider

The providers below were checked on their own websites on 1 November 2026. The list is a starting point, not an endorsement. Always confirm hosting and sub-processors in the provider's data processing agreement.

For more options, browse our email marketing tools and marketing automation tools.

How to switch email providers with less risk

• Export everything first: contacts, consent records, unsubscribes and suppression lists.
• Keep consent proof. The GDPR requires you to be able to show that each contact consented, so export when and how each person opted in. See opt-in.
• Warm up your sending. A new provider means new sending IPs or domains. Ramp up volume gradually and set up SPF, DKIM and DMARC before the first campaign.
• Update your paperwork. Name the new provider in your privacy notice and in your internal records of processing.

This article is general information, not legal advice.