Portugal Asked Google, Meta and Six Other Platforms for User Data 4,012 Times in a Year, and Four in Every Ten Requests Came Back Empty

Portuguese police and prosecutors sent 4,012 requests for user data to eight of the world's largest online platforms in a single year, putting the country tenth of 27 in the European Union. Fewer than six in ten of those requests produced anything. The numbers come from the Europol and Eurojust joint project SIRIUS, whose Electronic Evidence Situation Report 2025 was posted this week, and they describe the last full year before the rules changed underneath everybody.

The Portuguese line in the table

SIRIUS builds its country table from the transparency reports that eight service providers publish themselves: Airbnb, Google, LinkedIn, Meta, Reddit, Snap, TikTok and Yahoo. For calendar 2024, EU authorities as a whole sent 303,289 data disclosure requests to that group, up about 14 percent on 2023 and roughly three and a half times the 87,015 sent in the base year of 2018.

Germany accounts for 140,179 of them and France for 35,171, so between them the two largest member states file more than 58 percent of everything. Portugal's 4,012 sits between Sweden's 6,017 and the Netherlands' 3,783. On the receiving end, Google (146,671) and Meta (103,196) together take 82 percent of the EU total.

Where Portugal stands out is not volume. It is the hit rate. The average EU request succeeded 76 percent of the time in 2024, the best figure since the series began and up from 58 percent in 2018. Portugal came in at 59 percent, third from the bottom of the 27, ahead of only Italy at 57 percent and Slovakia at 42 percent. Cyprus led at 92 percent, followed by Denmark at 89 and Lithuania at 88. The report groups Portugal with France, Greece, Slovenia, Italy and Slovakia as the six jurisdictions below 66 percent, and notes flatly that "at least every third request from these jurisdictions fails to retrieve data".

Five emergencies in a year

The second Portuguese oddity is in the emergency column. Emergency disclosure requests are the ones filed when there is imminent risk of death or serious injury, and some providers stretch the definition to threats against critical infrastructure or crimes involving minors. Across the EU they jumped 32 percent in 2024, to 28,608.

Portuguese authorities filed five. Not five thousand: five, for the whole year, across all eight providers. France filed 19,186 and Germany 4,595, which between them is 83 percent of the European total. Only Luxembourg (four) sits lower than Portugal, and Slovenia's nine is the nearest number above. Meta alone received 21,328 of Europe's emergency requests.

The report does not explain the Portuguese figure, and there is more than one possible reading: authorities here may route urgent cases through other channels, or simply not use the emergency route the way French police do.

The missing single point of contact

SIRIUS does offer one structural clue about the success rate. Through direct engagement with national forces it identified 36 law enforcement agencies acting as Single Points of Contact, the units that centralise and standardise requests to foreign platforms, spread across 22 member states: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Slovenia, Spain and Sweden.

Portugal is not on that list. Neither are Poland, Hungary, Romania or Slovakia.

The report is careful about how much weight that carries. Countries with such a unit averaged 77 percent success against 73 percent for those without, a gap it calls surprisingly small and attributes partly to method: the eight providers in the sample are the ones everybody requests from constantly, so the process has become standardised even without a dedicated unit. Where officers do have a Single Point of Contact, though, 80 percent say they are satisfied or better with it.

Why requests fail

The providers, interviewed for the report, listed the reasons they refuse. The request goes to the wrong legal entity or data controller. It states a defective legal basis. It ignores the provider's published policy for voluntary requests. It omits the unique identifiers the company needs to find an account. It asks for a "full dump" of everything rather than named categories of data. Or it asks for data the provider does not hold in the first place.

Delays have their own list, headed by non-unique identifiers, incorrect details, and requests aimed at users outside the provider's jurisdiction, which get bounced towards a European Investigation Order or a mutual legal assistance request instead.

What investigators actually want, according to the law enforcement survey, is mostly not the contents of anyone's messages. The three most requested data types are connection logs, telephone numbers and the IP address used when an account was registered: the material that ties an account to a device to a person. The five most useful categories of service in 2024 were social media (65 percent of officers), messaging apps (56), cryptocurrency exchanges (54), fintechs (28) and virtual private network providers (21). Artificial intelligence platforms registered for the first time at 8 percent, having drawn zero votes in 2023.

The regime that took over on 18 August

All of this describes a voluntary system. An investigator asks; the company decides. That ended eleven days ago.

Regulation (EU) 2023/1543, the core of the e-Evidence package, has applied since 18 August 2026 in every member state except Denmark, which is outside this area of EU justice cooperation. It replaces the ask with an order. A European Production Order issued by a judicial authority in one member state binds a service provider offering services in another, with a response due in ten days, or eight hours where there is an imminent threat to life or physical integrity. Providers covered by it must designate a legal representative in the Union. A European Preservation Order freezes data while the paperwork catches up. The whole thing is meant to run over a decentralised IT system whose go-live the report describes as planned for August 2026.

The SIRIUS report, written before the switchover, is blunt about readiness. Only 8 percent of the law enforcement officers surveyed said they were very familiar with the package; 40 percent said they were not familiar with it at all. Among judicial authorities the picture is worse, with the report calling for urgent capacity building. Its own recommendation to national police forces was to keep testing their IT systems ahead of the go-live.

What this means for you

• If you use Google, WhatsApp, Instagram or TikTok in Portugal. Portuguese authorities were already asking these companies about accounts roughly eleven times a day in 2024, mostly for registration and connection records rather than message contents. From 18 August those requests carry legal force rather than being a polite ask.
• The ten-day clock. Under the new regulation a platform has ten days to produce the data, or eight hours in a genuine emergency, and cannot simply decline on policy grounds the way it could under voluntary cooperation.
• The 59 percent is about paperwork, not about privacy. The refusal reasons the providers cite are procedural: wrong entity, weak legal basis, missing identifiers, requests that are too broad. A better-drafted request is a successful one.
• Watch for a Portuguese SPoC. Twenty-two member states run a centralised unit for this work and Portugal does not. If the new mandatory system creates pressure anywhere, it will be here.

Portugal's own crime statistics have shown cybercrime climbing for several years running, as the 2025 internal security report set out, and the argument over what the state may read has been running in parallel: the intelligence services have been pressing for constitutional change on access to phone metadata. The SIRIUS numbers are the other half of that picture: not what Portuguese law allows, but what Portuguese investigators actually ask American companies for, and how often they get it.