Germany has spent a decade as a test case for how a democracy governs the internet. Its Network Enforcement Act (NetzDG) was the template for platform regulation before it was repealed. On 14 May 2024 it was replaced by the Digitale-Dienste-Gesetz (DDG), which implements the EU Digital Services Act. The Bundesnetzagentur became the central Digital Services Coordinator, and NetzDG's fixed 24-hour and seven-day deletion deadlines gave way to a tiered duty-of-care model, according to administrator.de's account of the changeover. The platform-speech fight has largely moved to Brussels.
The live German question about digital rights has moved too. It is now about what the state itself may do online. None of the current German headlines concern NetzDG. But the intelligence-services bill now in the Bundestag will shape the privacy and speech environment in which every German platform, messaging service and user operates.
What the bill does
On 24 September 2026 the Bundestag held a first reading of the government's bill on reforming intelligence-service law (Drucksache 21/7868). The Bundestag's record of the debate shows Interior Minister Alexander Dobrindt arguing that services need operational abilities to prevent attacks rather than merely observe them. The bill and an AfD motion were referred to the Interior Committee.
The Bundestag's summary of the bill describes several changes:
- The BND may proactively disrupt threats, including sabotaging IT systems of chemical-weapons laboratories or drone factories and disrupting the servers of hacker groups.
- Both the BND and the domestic Verfassungsschutz (BfV) gain limited intervention authority in specific threat situations.
- The BND may store collected data for six months (content) or up to twelve months (metadata) without prior review.
- There are new legal bases for biometric image matching and AI deployment.
- A consolidated Independent Control Council would combine judicial pre-control and data-protection oversight.
The strongest case for the government
The case for reform deserves a fair hearing. Germany faces state-backed sabotage, ransomware and hybrid operations, and an intelligence service that can only watch an attack infrastructure while it operates is at a real disadvantage. Cabinet-approved on 12 August 2026, the draft also consolidates oversight, which beck-aktuell's report on the cabinet decision notes is meant to replace a patchwork of bodies. Disrupting a hostile server abroad is arguably less intrusive than the alternative of waiting for the damage. Even the Greens' Konstantin von Notz backs expanding BND capability, according to the Bundestag record.
Where the bill overreaches
The problem is the domestic half. Die Linke's Clara Bünger argued in the debate that the bill removes the Trennungsgebot, the historic separation of intelligence from police, and risks a "secret police force". The Greens oppose what von Notz called excessive domestic surveillance plans. The AfD, on the other side of the spectrum, also objects. When parties from opposite ends of the chamber question the same powers, that is a signal worth heeding.
The objections are not only political. Netzpolitik.org's review of expert statements reports that civil-society groups and the Federal Data Protection Commissioner called the draft disproportionate. They cite a lowered authorisation threshold, real-time access to camera systems, large-scale facial matching against commercial databases, and AI systems that can trigger operational measures. They also say the data-protection commissioner is excluded from operational oversight. The consultation window for civil society was reportedly seven working days for a draft of roughly 700 pages.
For an open internet, these details matter. Hack-back powers and compelled access to IT systems depend on vulnerabilities and on private infrastructure. Broad data-sharing with private entities and expanded retention without prior review chill the anonymous, encrypted communication that a free-speech publication should defend. A regime that regulates platforms through transparency and due process, as the DSA does, is incoherent if the state exempts itself from the same proportionality discipline.
The deadline is real, but it is narrow
The government's strongest argument is timing. In its decision of 8 October 2024 (1 BvR 1743/16 and 1 BvR 2539/16), the Federal Constitutional Court held the BND's strategic domestic-to-foreign cyber-threat surveillance power in § 5 of the Article 10 Act partly incompatible with the Basic Law. The old rule survives only until a new one takes effect, and no later than 31 December 2026. In the meantime, purely domestic traffic must be filtered out and deleted immediately.
The court's complaints were specific: missing rules to exclude domestic communications, thin protection for the core private sphere, too-short deletion periods for legal remedies, and an oversight body, the G 10 Commission, lacking the required professional, court-like standard, as a summary of the ruling lays out. None of these require giving the Verfassungsschutz operational countermeasure powers.
That suggests a practical route. The mandatory repair, covering domestic filtering, core-area protection, retention and independent oversight, can be legislated before year-end. The optional expansion, covering domestic intervention powers, AI-triggered measures and biometric matching, can then get the scrutiny that a change to the Trennungsgebot deserves. Bundling both and citing the deadline as a reason to skip scrutiny would invite a further constitutional challenge, and a second failed statute would leave the services in the same legal limbo.
What proportionate looks like
- Pass the court-mandated fixes on schedule, with the independent control council given real judicial-grade powers.
- Decouple domestic intervention powers and the Trennungsgebot question from the deadline, and subject them to a full hearing with the Data Protection Commissioner included.
- Require sunset and evaluation clauses for hack-back, AI and biometric tools, with public reporting well before the five-year horizon critics describe.
- Keep private-sector data-sharing narrow and judicially authorised.
Germany taught Europe how not to regulate speech with overbroad takedown deadlines, and then moved to a more proportionate EU framework. It should apply the same lesson to its own state powers: capability and constraint are not opposites, and a law built to survive Karlsruhe is better security policy than one built to beat a calendar.