How big tech, data brokers, and state power are building a machinery of control across the United States and Europe.
I. The Machinery
In 2023, Adena Health System, a nonprofit hospital network in Ohio, agreed to pay $18 million to settle a class-action lawsuit after it was discovered that its MyChart patient portal was transmitting patient data—including names, appointment details, and even the text of messages—to Meta’s Facebook via the Pixel tracker. The hospital’s privacy policy did not clearly disclose this practice.
Two thousand miles away, in a small German town, in 2022, a student at the University of Erfurt in Germany was required to install Wiseflow proctoring software for an online examination. The software captured video and audio, performed facial recognition, transmitted biometric data to Amazon Web Services, and tracked the student’s computer activity. Following a lawsuit by the Gesellschaft für Freiheitsrechte, the Thuringian Higher Regional Court ruled in November 2025 that the processing of biometric data was unlawful under the GDPR—because students had no realistic alternative to the monitored exam format, their “consent” was not freely given.
Meanwhile, a growing industry of wellness monitoring tools—such as Securly Aware, which analyzes online activities for signs of depression, self-harm, and violence—has been deployed in thousands of school districts, scanning students’ emails, social media, and documents. An AI-powered platform in a European university was also documented analyzing keystroke dynamics, facial expressions, and head movements to build student behavior profiles. Securly Aware claims to analyze over 75 million activities daily across 13.8 million students in 3,050 districts. It monitors for signs of anxiety, depression, cyberbullying, self-harm, and potential violence. The edBB platform uses remote Photoplethysmography (rPPG) from webcam video to estimate heart rate as a “biomarker of emotional state” and uses facial gestures (like blink rate) to estimate attention levels and “cognitive load.” Research and development in this area are active, with frameworks that use facial recognition and expression analysis to detect emotions like sadness, anger, or fear, aiming to provide “preventive well-being support”. Developers are building systems that can track faces, emotions, and engagement in real-time to help teachers detect stress or burnout. This technology is not just theoretical; it is being marketed for both educational and workplace environments, with claims of being adaptable and adopted across a host of applications.
Europe has developed a set of large-scale IT systems for this purpose, including Eurodac (a biometric database of asylum seekers’ fingerprints), the Entry/Exit System (EES), which will log non-EU travelers’ movements with biometric data, and the Schengen Information System (SIS). These systems are governed by specific EU regulations. For example, the EU’s Interoperability Regulation was enacted to interlink these various databases, creating a shared biometric matching service.
The technology itself is a major business, with firms like Thales Group involved in providing these systems. At border crossings, officials use fingerprint databases and other systems to verify identities and check them against EU-wide databases like EURODAC. The use of such tools during the Ukrainian refugee crisis was noted as a key component of managing the influx.
Meanwhile, at a border checkpoint in Poland, Ukrainian refugees queued for hours as biometric systems—facial recognition scanners, fingerprint readers, and automated document verification systems—processed their identities against European databases. The technology, built by Airbus and Thales, represented a convergence of public funding, private innovation, and state security priorities that would have seemed unimaginable just a decade ago.
These three scenarios—a hospital website leaking patient data to advertisers, a classroom deploying algorithmic surveillance, and a border transformed into a biometric processing center—are not isolated incidents. They are symptoms of a larger transformation. The surveillance state is not merely something governments impose from above; it is what emerges when state power, platform capitalism, and private security vendors converge into a single, self-reinforcing system. The machinery of control is being built not through a single coup-like act, but through procurement contracts, corporate acquisitions, legal frameworks, and the gradual normalization of watching as a business model and governance strategy.
Surveillance has moved beyond dystopian warnings into an operating system of modern governance and commerce. Google, Meta, Amazon, Apple, Microsoft, and a wider ecosystem of data brokers, security contractors, and surveillance vendors are collecting, inferring, storing, and monetizing behavioral data at unprecedented scale. The architecture is not uniform—the United States has built its surveillance infrastructure largely through the private sector, while Europe has constructed a parallel system through public funding, security research, and border control—but the result is the same: a global surveillance apparatus that operates with minimal accountability, maximal opacity, and accelerating expansion.
II. Defining the System: Three Layers of Surveillance
To understand the surveillance state, we must first understand its structure. It operates across three interconnected layers that blur the boundaries between commerce, state power, and hybrid systems where one feeds the other.
Layer One: Commercial Surveillance. The European Parliament’s briefing on “commercial surveillance” reveals the mechanics of what has become the dominant business model of the internet. Every time a user visits a website, opens a mobile app, or navigates through a platform, dozens—sometimes hundreds—of data brokers and tracking firms record their behavior. Google, Meta, and Amazon track users across devices, apps, and websites, building comprehensive behavioral profiles that are then used to optimize advertising, refine products, and predict future behavior. The sheer scale is staggering: Google’s advertising network reaches over 90% of internet users; Facebook’s Pixel is embedded in roughly 30% of the world’s websites; Amazon’s cloud services host vast portions of the internet’s infrastructure.
Layer Two: State Surveillance. The second layer involves government agencies using legal authorities, technical capabilities, and partnerships with the private sector to monitor populations. In the United States, this includes intelligence agencies leveraging FISA Section 702 to collect communications, law enforcement using stingray devices to track cell phones, and immigration authorities deploying facial recognition at ports of entry. In Europe, state surveillance manifests through border security systems, predictive policing tools, and intelligence-sharing frameworks like the Prüm Convention.
Layer Three: Hybrid Systems. The most powerful and least understood layer is where commercial and state surveillance converge. This takes multiple forms: technology companies voluntarily or under compulsion sharing data with governments; state agencies purchasing commercial data to augment their own collection; and public funding flowing to private companies that then build surveillance capabilities that benefit both sectors. The European Parliament’s research explicitly notes that “the line between commercial and state surveillance has become increasingly blurred,” with U.S. technology companies’ “cooperation with state surveillance” creating a public-private architecture that transcends traditional boundaries.
III. Why Billionaires Matter: Concentrated Ownership and Infrastructure Control
The surveillance state cannot be understood without examining the concentration of power in a handful of billionaire-controlled corporations. This is not a matter of personality or ideology, but of structural leverage. When a small number of individuals or families control the companies that mediate digital life for billions of people, they accumulate power that rivals—and in some cases exceeds—that of many national governments.
Google, founded by Larry Page and Sergey Brin, now operates under Alphabet, a company valued at over $1.5 trillion. Its search engine processes over 8.5 billion queries daily; its Android operating system runs on approximately 70% of the world’s smartphones; its Chrome browser commands a 65% market share; and its advertising ecosystem generates over $200 billion in annual revenue. Meta, led by Mark Zuckerberg, connects over 3 billion monthly active users across its platforms, making it the largest social graph in human history. Amazon, founded by Jeff Bezos and now controlled by Andy Jassy, operates the world’s largest cloud infrastructure, dominates e-commerce, and has embedded surveillance devices (Ring, Alexa) in millions of American homes. Microsoft, led by Satya Nadella, provides the operating systems for most of the world’s computers and increasingly controls the cloud infrastructure on which governments and corporations depend.
The issue is not simply that these billionaires “own” companies. It is that their firms mediate the digital lives of billions while remaining private, opaque, and lightly accountable to democratic processes. Product design decisions, acquisitions, lobbying priorities, standards-setting, cloud contracts, and public narratives about privacy and security are shaped in boardrooms, not through public deliberation. And when governments want data, they increasingly ask or compel these companies, rather than building independent collection capabilities.
IV. The American Surveillance Architecture
The United States has constructed the most comprehensive surveillance architecture in history, but it differs from European models in one critical respect: in the U.S., surveillance is not only a state function but a business model. Firms extract data to optimize ads, services, and prediction; the state can then access or compel access through legal processes or national security powers.
Google’s Pervasive Tracking. The European Parliament briefing identifies Google as “the most pervasive tracker,” with systems embedded across the web, mobile applications, and physical spaces. Google Analytics, used by over 50 million websites, provides detailed behavioral data. Google’s advertising ecosystem connects search behavior, YouTube viewing, Gmail content, and Android telemetry into unified profiles. In an era of “cookie-less” tracking, Google’s Federated Learning of Cohorts (FLoC) and Topics API represent attempts to preserve its tracking dominance while appearing to enhance privacy—a strategy that maintains the underlying surveillance infrastructure while adjusting the facade.
Meta’s Social Graph. Meta’s surveillance capabilities are built on the social graph: the web of connections, preferences, and behaviors that emerges when users share their lives on its platforms. The Facebook Pixel, embedded on approximately 30% of websites, tracks users across the internet and reports back to Meta. WhatsApp and Messenger provide communication data. Instagram reveals visual preferences and social connections. Off-platform data collection, through data brokers and partner agreements, further extends Meta’s reach. The company’s capacity to reidentify individuals across anonymous datasets has been demonstrated repeatedly, undermining claims of privacy protection.
Amazon’s Ambient Surveillance. Amazon’s surveillance footprint extends beyond its retail dominance into homes, workplaces, and public spaces. Alexa and Ring provide ambient listening and visual monitoring in millions of homes. Amazon’s acquisition of iRobot (the Roomba maker) raised concerns about mapping the interiors of homes. Amazon Web Services (AWS) hosts vast quantities of government and corporate data, making it a critical infrastructure provider. The company’s growing advertising business—now a $50 billion annual enterprise—relies on the same tracking and prediction technologies that define its core business model.
Microsoft’s Cloud Concentration. Microsoft’s role in the surveillance architecture is particularly significant for transatlantic implications. As the Wire analysis notes, “data location is not the same as jurisdictional control”—U.S. laws can still reach American firms, even when data is held in Europe. Microsoft’s Azure cloud services, combined with its dominance in enterprise software, create exposure pathways for European data to U.S. surveillance obligations. This tension has been central to the legal battles over Privacy Shield and its successor frameworks, with European data protection authorities repeatedly questioning whether U.S. law can provide adequate protections for European data.
V. Europe’s Surveillance Industrial Complex
While the United States has built surveillance through private-sector extraction and government access, Europe has constructed a parallel system through public funding, procurement, and the development of a domestic security-industrial complex. The EU, often perceived as the champion of privacy rights, has simultaneously become a major funder and customer of surveillance technologies.
The Security-Industrial Complex. The Statewatch report, Market Forces: The Development of the EU Security-Industrial Complex, documents how European public funding has created a closed loop between government budgets and private security vendors. The European Commission’s security research programs, Horizon 2020 and Horizon Europe, have channeled billions of euros into developing surveillance technologies, including automated behavior analysis, biometric systems, border technologies, drones, IMSI catchers, and predictive policing systems. The report shows how major firms—Thales, Airbus, Atos, Indra, and others—have benefited from this funding, creating a self-perpetuating cycle where public money drives private innovation that then sells back to the public sector.
Border Technologies. Europe’s border surveillance infrastructure has expanded dramatically, particularly in response to migration pressures. The European Border and Coast Guard Agency (Frontex) operates surveillance drones, satellites, and biometric databases. The Entry/Exit System and European Travel Information and Authorisation System (ETIAS) will create comprehensive tracking of non-EU travelers. The biometric matching capabilities, shared across member states, represent a massive investment in population monitoring.
The Export Problem. The FIDH report, Surveillance Technologies ‘Made in Europe, documents how European companies have exported surveillance capabilities to authoritarian regimes. European firms have supplied equipment to Bahrain, Egypt, Saudi Arabia, and Turkey, despite EU regulations that are supposed to restrict such exports. The report notes that “surveillance technologies developed in Europe have been used to commit human rights abuses” in third countries, creating a moral and legal accountability gap. Companies like Atos, Thales, and others that benefit from EU security funding are also among those exporting dual-use technologies.
VI. The Transatlantic Legal Conflict: Data Sovereignty’s Illusion
One of the most consequential aspects of the surveillance state is the structural conflict between U.S. surveillance law and European privacy protections. The Wire analysis makes the case that Europe’s dependence on U.S. cloud and platform infrastructure has created a fundamental tension: “data location is not the same as jurisdictional control.”
The CLOUD Act and FISA Section 702. U.S. laws give American authorities powerful tools to access data, even when it is held in Europe. The CLOUD Act, passed in 2018, requires U.S. technology companies to provide data to U.S. law enforcement even if that data is stored on servers in other countries. FISA Section 702 allows for the warrantless surveillance of non-U.S. persons located outside the United States. These laws create a situation where European data, held by American companies, is subject to U.S. legal compulsion that may conflict with EU privacy law.
The Privacy Shield Failure. The legal saga of transatlantic data transfers illustrates the conflict. The EU-U.S. Privacy Shield, which allowed for data transfers, was struck down by the Court of Justice of the European Union in the Schrems II decision (2020). The court found that U.S. surveillance laws did not provide adequate protection for European citizens’ data. The subsequent Trans-Atlantic Data Privacy Framework has been challenged on similar grounds. The fundamental problem persists: as long as European data is processed by American companies, it remains subject to U.S. surveillance laws.
Sovereign Cloud Claims. Technology companies have attempted to address these concerns with “sovereign cloud” offerings, which promise that data will remain within European jurisdictions. The Wire analysis argues that these claims are structurally fragile, because “U.S. laws can still reach American firms, even when data is held in Europe.” Microsoft’s Azure “sovereign cloud” offering has been particularly scrutinized, with questions about whether it can truly overcome U.S. legal compulsion. The tension between commercial promises and legal reality remains unresolved.
VII. Human Consequences: The Chilling Effect
The surveillance state is not an abstraction. It produces real, measurable harms to individuals and communities. These harms are not limited to overt persecution; they manifest through chilling effects, misidentification, discrimination, and the erosion of privacy as a foundation for human dignity.
Chilling Effects on Speech and Protest. Surveillance deters dissent. When people know they are being watched, they self-censor. Studies have documented that activists, journalists, and ordinary citizens alter their behavior when they are aware of surveillance. The U.S. government’s use of social media monitoring to track protest movements—documented in response to Black Lives Matter protests—creates a system where political participation becomes a source of government data. In Europe, the use of facial recognition at protests has had similar effects, with citizens avoiding demonstrations out of fear of identification.
Biometric Systems and Misidentification. Facial recognition and other biometric systems are notoriously unreliable for certain demographic groups, with higher error rates for people of color, women, and older individuals. Misidentifications can have devastating consequences: wrongful arrests, border detainment, and the denial of benefits. The FIDH report documents cases in Europe and the Global South where biometric systems have led to wrongful accusations and detention. The EFF’s border technology dataset shows how dozens of companies are marketing AI-powered systems that make these claims, often without transparent testing of their error rates.
Workplace and School Monitoring. The expansion of surveillance into workplaces and schools represents a normalization of monitoring that would have seemed intrusive a generation ago. Amazon’s tracking of warehouse workers, which monitors productivity down to the second, has been linked to physical and mental health problems. Microsoft’s productivity tools, which include features that analyze employee activity, create similar pressures in white-collar environments. In schools, monitoring software that tracks students’ computer usage, facial expressions, and keystrokes creates a culture of surveillance that undermines trust and autonomy.
Immigration Enforcement. Border surveillance has expanded dramatically, with technologies that track migrants across regions. The EFF dataset documents how more than 230 companies are selling or marketing technology into DHS-linked surveillance systems, many of them AI-branded. These technologies are used for everything from identifying “persons of interest” at ports of entry to tracking migrants who have been released from detention. The consequences can be deportation, family separation, and indefinite detention.
Health Data Exposure. Health data, once protected by legal and ethical standards, is now routinely exposed through the tracking tools embedded in hospital websites, patient portals, and health-related apps. The European Parliament briefing notes that even sensitive health data is subject to commercial tracking, with ad-tech companies building profiles that include medical conditions, prescriptions, and health behaviors. This creates risks of discrimination by insurers, employers, and others who might access or infer this information.
VIII. The Accountability Gap: Why Safeguards Are Failing
The surveillance state persists because current safeguards are systematically inadequate. Consent mechanisms, procurement practices, oversight frameworks, and legal protections all have structural weaknesses that allow surveillance to expand with minimal accountability.
Consent as a Fiction. The European Parliament briefing explicitly notes that consent forms “do not meaningfully stop collection.” Users are presented with complex, lengthy, and opaque privacy policies. They cannot meaningfully consent when the alternative is not using essential services. Moreover, the data extraction practices of companies like Google, Meta, and Amazon often operate invisibly; users have no idea what is being collected or how it is being used. The GDPR’s consent requirements, while well-intentioned, have largely been circumvented through “cookie walls” and other mechanisms that make consent a condition of service.
Opaque Procurement. Government procurement of surveillance technologies is often hidden from public scrutiny. Contracts with vendors like Thales, Palantir, and others are shielded by claims of national security or commercial confidentiality. The EFF’s border technology dataset represents a partial attempt to map this procurement, but it is incomplete because many contracts are not publicly disclosed. The Statewatch report documents a similar opacity in European procurement, with public funding flowing to security vendors through processes that are not transparent to citizens.
Fragmented Oversight. Oversight of surveillance is divided across multiple agencies and jurisdictions, creating gaps. In the United States, different agencies—the FBI, NSA, DHS, and state and local police—have different authorities and oversight mechanisms. The oversight bodies themselves often lack resources, independence, or authority. In Europe, the fragmentation is even greater, with surveillance activities spread across member states, EU agencies, and private contractors.
Enforcement Lag. Enforcement of privacy protections consistently lags behind the deployment of surveillance. By the time courts or regulators act, the surveillance architecture is already in place and entrenched. This was the case with the NSA’s bulk collection programs, which operated for years before being partially reined in. It was the case with the Privacy Shield, which was invalidated only after years of operation. And it is the case with current AI-powered surveillance systems, which are being deployed faster than regulatory frameworks can address them.
Sovereign Claims Versus Legal Reality. The final accountability gap is the disconnect between “sovereign” claims and jurisdictional reality. Companies promise privacy-safe or sovereign cloud services, but as the Wire analysis shows, “data location is not the same as jurisdictional control.” When European data is processed by American companies, it remains subject to U.S. legal compulsion. This creates a situation where privacy promises cannot be guaranteed, but users and governments are led to believe they can.
IX. Counterarguments and Limits: A Credible Assessment
A credible analysis must acknowledge the limitations of the surveillance-state framework. Not every data collection practice equals totalitarian surveillance, and some companies have taken steps to reduce or constrain their tracking.
Some Companies Have Improved Privacy Features. Apple has built its brand around privacy, with features like App Tracking Transparency that require apps to obtain permission before tracking users. Apple’s privacy model, while imperfect, does reduce the scale of commercial surveillance on its devices. Google and Meta have also introduced privacy features, though critics argue these are designed more to preserve their dominance than to protect users.
Some Surveillance Tools Have Legitimate Uses. Technologies like facial recognition, biometric identification, and behavioral analytics have legitimate applications in law enforcement, border security, and fraud prevention. The issue is not the technology itself but its deployment without adequate safeguards, oversight, and accountability. The public-private partnerships that make up the surveillance architecture are not inherently illegitimate; they become problematic when they operate without democratic oversight.
But the Defenses Are Insufficient. These counterarguments do not erase the scale problem. The level of data collection and surveillance is unprecedented; the reidentification problem persists, with companies routinely deanonymizing supposedly anonymous data; and the structural incentives—commercial profit, government power, and organizational efficiency—all push toward expansion. No privacy feature or legitimate use case changes the fundamental dynamic: surveillance is becoming the default operating system of modern governance and commerce.
X. Conclusion: The Normalization of Watching
The surveillance state is “coming for us” not through one coup-like act but through normalization: procurement, integration, convenience, and the gradual expansion of monitoring into every domain of life. It is not a future threat; it is the present reality.
The real story is not only that power is watching; it is that ordinary life is being reorganized so that watching becomes profitable, lawful, and easy. Every time a user checks their email, visits a doctor’s website, sends a message, or crosses a border, they contribute data to a system they cannot see and cannot control. Hospitals share patient data with advertisers. Schools deploy predictive analytics. Workplaces monitor every keystroke. Governments buy access to commercial databases to track citizens without warrants.
The machinery of control is being built across the United States and Europe, albeit through different mechanisms. In the United States, the architecture is primarily private-sector: technology companies extract data as a business model, and the state accesses or compels it as needed. In Europe, the architecture is more public-sector: governments fund and procure surveillance systems, often from vendors that benefit from EU security research and internal security funding. The result, in both regions, is a system that operates with inadequate safeguards, minimal transparency, and accelerating expansion.
What is to be done? This essay does not offer a policy prescription, but it suggests that reform must address the structural, not merely the technical, dimensions of surveillance. It must address the concentration of data power in a handful of companies and the public-private partnerships that have turned governance into monitoring. It must address the opacity of procurement and the inadequacy of consent. It must address the conflict between U.S. surveillance law and European privacy protections, recognizing that data sovereignty requires legal, not merely technical, solutions.
The surveillance state is real. It has been built through thousands of small decisions, procurement contracts, product designs, legal interpretations, and corporate acquisitions. It cannot be undone through a single reform. But it can be constrained, rolled back, and reimagined if citizens, legislators, and regulators understand its architecture and demand accountability.
The machinery of control is not inevitable. But it is here. And it is watching.
