Germany's debate over online speech has long centred on the NetzDG, the 2017 takedown law that put platforms under notice-and-removal duties. A different federal bill now matters at least as much for the open internet. It is not about what users may say. It is about who may watch them while they say it. The Interior Ministry's reform of intelligence service law, championed by Minister Alexander Dobrindt, reached its first Bundestag reading on 24 September 2026. On 29 September, netzpolitik.org reported that it reaches well beyond counterterrorism. In its account, domestic intelligence would gain access to private surveillance cameras and to vehicle telemetry held by car dealers and repair shops. Protections for doctor-patient confidentiality and journalists' sources would weaken, and the BND could collect large volumes of data from internet infrastructure.
The strongest case for the reform
The government's argument deserves a fair statement. Germany faces sabotage, espionage and hybrid pressure from Russia, alongside violent extremism. Its intelligence law is a patchwork that critics across the spectrum have called outdated. CDU/CSU and SPD speakers argued in the first reading that the services must be able to counter threats rather than merely observe them. The bill also does something civil libertarians have wanted for years. It consolidates oversight in an Independent Control Council (UKRat) that combines prior authorisation with data protection supervision. A modern law with clear statutory bases is better than agencies working in grey zones.
Where the bill overreaches
The problem is proportion. Under the bill as described by the Bundestag's own summary (Drucksache 21/7868), the BND may store collected data unsorted for six months (content) or twelve months (metadata) before analysis. Collecting first and justifying later is the structure that the Federal Constitutional Court has repeatedly scrutinised in strategic surveillance cases. Expanding it to bulk internet-infrastructure collection and to private-sector data streams invites the same constitutional challenge.
The expert reaction has been unusually uniform. Netzpolitik.org's review of the written statements found near-unanimous rejection. The Federal Data Protection Commissioner called the draft a massive expansion of powers paired with weaker rights for affected people, and objected in a formal statement to moving data protection supervision away from his office. The same statement criticises a two-year period in which the services would be told the inspection programme in advance, which blunts the control the reform advertises.
The concerns are not abstract. According to Correctiv's summary, the German Bar Association warned of attorney-client privilege violations, the Press Council said journalistic source protection is not adequately secured, and the critical-infrastructure working group argued that expanded state hacking weakens resilience rather than strengthening it. The Federal Medical Association objected to paragraph 22 of the BND law and paragraph 32 of the domestic-intelligence law. It says doctors get weaker protection than lawyers and clergy, and sees no objective reason for the difference.
Why this is an internet-policy problem
A free internet depends on predictable limits on state access. If a doctor cannot assure patients that records are shielded, patients withhold information. If journalists cannot promise source protection, sources go quiet. If activists know that minor infractions or the use of encryption could themselves attract attention, as critics in the statements reviewed by netzpolitik.org argue, they self-censor. These chilling effects are as real as a takedown order, and they come with none of the transparency or appeal rights that NetzDG-style rules at least nominally provide.
The process compounds the substance. Correctiv reports that organisations had only 11 days to review a draft of about 700 pages. A bill that reshapes the legal relationship between citizens and secret services deserves more than a procedural formality.
A proportionate alternative
A pro-innovation, pro-speech approach does not mean denying the services tools. It means insisting on four design principles:
- Absolute protection for confidential professions. Doctors, lawyers, clergy and journalists should sit in the same tier, not a ranked hierarchy.
- Targeted, not bulk, collection. Camera feeds, vehicle telemetry and infrastructure taps should require individualised, judicially authorised access with short retention.
- Independent technical oversight. The UKRat needs real technical capacity, and the data protection commissioner should keep an operational role.
- Evidence of necessity. Each new power should come with a published rationale and a sunset or evaluation clause.
Germany's courts have made clear that security and liberty are not a zero-sum trade. The Bundestag now has an opportunity to amend the bill in committee rather than leave it to Karlsruhe to do so years later. Lawmakers who care about a trustworthy digital economy, in which businesses, clinics and newsrooms can handle data without fearing silent state access, should treat the committee stage as the real debate.