What Counts as “American” in a Global Internet?

After deciding to move away from US-based services, a problem becomes apparent: the internet doesn’t divide neatly along national lines.

Ownership, hosting, infrastructure, and governance rarely live in the same place. A service can look European, be American in ownership, and global in infrastructure, while still being subject to US law.

So before replacing anything, I needed a simple way to decide what actually matters to me.

What counts isn’t branding or geography. It’s control.

Who owns the company? Which laws apply? Where the data is hosted. How hard it is to leave?

That’s where risk comes from.

One distinction I think is too often ignored is the difference between hosted services and local software.

Hosted services store data on their own servers and operate under their own legal jurisdiction. Email providers, cloud platforms, SaaS tools, and social networks create direct jurisdictional exposure because your data lives inside someone else’s legal system.

Local software runs on your own devices and stores data locally, or only on services you explicitly choose. In those cases, the software provider doesn’t control the data; you do. Jurisdiction is defined by where you host, not who wrote the code.

That difference keeps the focus on where risk actually lives.

Risk Assessment Map

I’m not trying to achieve some sort of privacy nirvana. The goal here is risk reduction.

The point of laying down some rules around this is to be deliberate about how I identify what should be migrated. Convenience creeps back in, and decisions drift back to habit instead of intent.

A simple framework creates consistency. It turns unease into structure.

The goal isn’t isolation or ideological separation. It’s diversification, resilience, and control — avoiding single points of legal, political, and infrastructural failure.

In the next post, I’ll start the audit and try to map out my current digital services and identify which of these risks apply to them and see what I can do about it.

The why

This project didn’t start as a technical experiment. It started as a gradual loss of trust.

For too long, I tolerated the current realities of modern digital life, such as the idea that big platforms were unavoidable. I hoped that regulation would improve over time, and that privacy violations would eventually be constrained by oversight and law, and if not, that consumers would get fed up and move to alternative solutions. The problems were obvious, such as surveillance capitalism, data extraction, and platform monopolies, but they felt distant and abstract, more theoretical than personal.

That changed.

Not because of one scandal or one breach, but because of a pattern: repeated violations, symbolic fines, and no meaningful structural change. The same companies collect the data, control the infrastructure, shape the standards, and influence the regulations meant to constrain them. At some point, convenience stopped feeling neutral and started feeling like dependency.

It also became impossible to ignore the political layer.

American tech companies operate inside American law, American surveillance frameworks, and American political power structures. Oversight is weak. Enforcement is inconsistent. Lobbying power is massive. Privacy protections exist, but they are fragile and easily subordinated to national security and political priorities.

Recently, this stopped being abstract for me.

When the US president publicly dismisses democratic principles, mocks European countries, portrays them as adversaries, and frames allies as enemies, as he recently did during the World Economic Forum in Davos, that rhetoric becomes a risk factor when your data, identity, communication, and work are hosted inside that jurisdiction.

This is a structural problem; because data lives in legal systems, infrastructure, and jurisdiction.

Where your data lives determines which laws apply, who can access it, who can compel disclosure, what rights you actually have, and what recourse exists.

For Europeans, this has already been tested.

The Safe Harbour agreement failed.
The Privacy Shield agreement failed.

Both were political compromises that promised protection while leaving US surveillance law untouched.

The CLOUD Act made the reality explicit: US companies can be compelled to provide access to data regardless of where it is physically stored.

And the Schrems I and Schrems II rulings confirmed what many suspected — that high-level agreements between the EU and the US are not sufficient to protect European citizens’ data when the underlying legal systems are incompatible.

In other words, diplomatic agreements don’t override legal architecture.

It also isn’t abstract.

Over time, I’ve realised how much of my life is effectively hosted by a foreign jurisdiction.

My communication.
My identity.
My files.
My work.
My memories.

All dependent on companies I can’t vote for, governments I can’t influence, and legal systems where I have limited standing.

That’s not paranoia. It’s infrastructure.

Most large platforms are not neutral services. They are extraction systems. Data is the product. Behaviour is the product. Prediction is the product. Privacy violations aren’t accidents; they are business logic.

This series isn’t about purity or total disconnection. It’s not about digital isolation or ideological statements.

It’s about reducing structural risk, limiting jurisdictional exposure, breaking dependency, diversifying infrastructure, and regaining control.

Over the following posts, I’ll try to document the process of auditing my digital life, identifying jurisdictional risks, migrating services, replacing platforms, and accepting the trade-offs that come with that.

I’m not really writing this series as a guide for others, but mostly as a log for myself, and hopefully someone else can find it useful. If not, at least I have somewhere to point to when someone asks, “Why the heck are you putting yourself through all this hassle!?”

An honest record of what it actually takes to reclaim some digital autonomy and what it costs in convenience to do it, if you will.

Phew, let’s get on with it.

This blog series will document my attempt to migrate as much as practically possible of my digital life away from services owned by American companies or governed by US jurisdiction. It’s a record about trust, data safety, legal exposure, and long-term digital risk. I’m writing this as a practical, personal record of what it actually takes to reduce dependency on US tech infrastructure as a European citizen.

1. The Why
2. The Rules

After 26 years of being a customer without any major issues other than being overcharged, it’s odd that the end of my customer relationship comes with such a strong sense of relief and freedom.

I registered my first domain (this one) in 1997 and my second one only shortly after. At the time, there weren’t a lot of options around. Actually, the only option for most was the semi-official Internic. Since then, of course, there’s been many and different kinds of revisions to how domain name assignments have been handled. Internic itself was replaced, and the domain registration was contracted to Network Solutions, and later to a myriad of different registrars. Through all these changes, I decided to just stay with Network Solutions simply because I viewed it as trustworthy and reliable, while I heard lots of stories, including of losing their domains from friends. This was despite the fact that I knew I was increasingly paying a higher premium for this basic service.

An unwelcome gift

Fast forward to June 2022, and while I’m off travelling, Network Solutions sends me a mail. They’ve decided to give me a glorious gift. A domain loosely similar to my primary domain, using an obscure and presumably cheap TLD. Hidden far down in the message, they note that if I don’t want this domain that I didn’t request, I would have to let them know within 7 days. It was summer, I was travelling and only skimmed through my mail. This was around the time of renewal for my other domains, which I had already paid for, but they were still spamming me about, so I assumed it was related to these.

Shortly after, this new domain showed up in my account. I got annoyed. No, I got angry. A domain isn’t just any product; this isn’t like giving you a free tube of toothpaste on the way out of the store. A domain is something that comes with possible implications both in association if people look at which domains are registered to you, but more dangerously, a domain can land you in trademark and copyright disputes. So simply automatically attaching a domain to you with a shrouded opt-out possibility is dodgy. Heck, I’d say it’s pretty close to a scam. After all, the obvious motivation for this is to hope you don’t pay attention and automatically renew it once the first year has passed.

The escape

Any remaining trust in Network Solutions was immediately lost. I started looking for a better and cheaper registrar. That wasn’t hard, and I immediately proceeded to move my two domains to the new provider. As a bonus, I got access to a number of innovative and useful features. For free.

Next, I contacted Network Solutions to cancel my account, including the unwanted domain. Then things got really bad. And Network Solutions turned me from a customer who was annoyed and moved away but could possibly come back if the situation changed to someone that was so fed up and genuinely disgusted with them that I will never consider coming back. Or use them in any professional capacity where I have a say.

First of all, dealing with Network Solutions customer care is not easy. They really want you to call them on the phone (I’m not paying for transatlantic calls for support) but reluctantly offer a chat service with significant limitations. I get through on chat and tell them I want the domain deleted and my account closed.

The empire strikes back

They’re sorry, but they can’t delete a domain registered to me; I’ll have to let it expire. WTH… OK, at least remove my credit card info, so I don’t get charged with renewal by “accident”, then. They’re sorry, but they can’t remove the last method of payment from an account with an active product. Well, at least I get them to remove all sorts of renewal and automatic functions. Then I have to wait… for nearly a year…

As soon as the domain expires, I’m back with chat to have the domain deleted from my account. The chat agents don’t have permission for this, so they have to refer it to “admins”, and I need to send a confirmation reply to an e-mail. The mail reply-to is to the wrong address. I only notice by chance.

Finally, the domain is gone; I log in and can delete my credit card info. Then contact them again to have the account deleted. I don’t want unused accounts hanging around; they’re a security risk. No, they can’t do that. I have to call (on the phone, transatlantic) their customer loyalty team for this. I explain how this is unacceptable. Then they suddenly come up with a URL to a support site while stressing that this is ONLY to be used by non-US customers. I file a ticket.

Someone gets back to me and tells me they can’t delete the account. It will be deleted automatically after “a period of inactivity”. They can’t tell me what the period is. They can’t tell me if trying to log in to see if it has been deleted will count as activity and resetting the countdown to the unknown time.

And so I’ve decided to leave it there. But I’m so pissed off. It’s quite amazing how easily a company managed to turn me from an indifferent, overpaying, loyal customer for nearly 30 years to a very annoyed ex-customer with a strong feeling of having been exploited and attempted scammed.

Good riddance!