--- title: "What the ICC Sanctions Mean for Digital Sovereignty in European Business" description: "The US sanctions on the International Criminal Court show that EU data storage is only half the story. The real question is who can switch your tools off." canonical_url: "https://otusanalytics.com/blog/what-the-icc-sanctions-mean-for-digital-sovereignty-in-european-business" --- > Index of every page on this site: [llms.txt](https://otusanalytics.com/llms.txt) In October the United States [sanctioned the International Criminal Court](https://www.itv.com/news/2026-10-09/us-hits-international-criminal-court-with-sweeping-new-sanctions) in The Hague. This time the target was the court as an institution, not just a handful of its judges, and American companies were told to stop doing business with it. Most businesses will read that as a foreign policy story, and for most of them it is. We think it is also a useful warning about how European organisations choose and depend on technology. ## What the ICC sanctions mean Sanctions rarely only have the effects they have on paper. Banks and suppliers would rather be safe than sorry, so they tend to keep well away from anything sanctioned, and the effects end up in places nobody actually decided on, like someone’s email account, a payment that won’t go through, or the software an organisation uses every day. The ICC had already experienced a version of this when its chief prosecutor was [reportedly cut off from his email](https://heise.de/-10429628). Microsoft [disputes that it stopped serving the court](https://www.politico.eu/article/microsoft-did-not-cut-services-international-criminal-court-president-american-sanctions-trump-tech-icc-amazon-google/), which only shows how unclear the boundaries become once politics enters the picture. You don’t need to be anywhere near a sanctions list to take something from this. If the tools your business relies on belong to a company that answers to another government, then that government’s priorities are part of your risk. We don’t think it is healthy when access to ordinary business software becomes a lever of foreign policy, regardless of who is pulling it, but pretending it can’t happen is no longer a reasonable position. ## “where is my data stored?” to “who can switch it off?” For years the European privacy debate revolved around access. The CLOUD Act and the Schrems II ruling taught us to ask whether foreign authorities could read our data. Most companies answered by choosing EU data centres and signing the right contracts, and considered the matter settled. The sanctions show that this answers only half of the question. Storing data in Frankfurt does not change which country’s law the provider ultimately answers to, and a data processing agreement says nothing about whether the service will still be there next year. The question Europe now has to add is a simpler and more uncomfortable one: who can decide to switch this off, and what happens to us if they do? If you want to know what that looks like when it is built in from the start rather than patched on afterwards, we’ve [set out exactly where your data goes and who handles it](https://otusanalytics.com/compliance) in Otus. ## Digital sovereignty is a business decision you need to think about now Governments across Europe have already started acting on this. They are moving workplaces, email and cloud storage to European and open-source alternatives, from [Denmark](https://heise.de/-10438942) and [Schleswig-Holstein](https://www.thelocal.de/20250613/were-done-with-teams-german-state-hits-uninstall-on-microsoft) to the [Dutch government](https://www.nldigitalgovernment.nl/netherlands-digitalisation-strategy-nds/dossierpostcontext/dutch-government-secures-deal-with-european-cloud-platform-stackit/) and its [tax authority](https://tweakers.net/nieuws/253004/belastingdienst-stopt-microsoft-cloudmigratie-en-kiest-eigen-servers.html). The EU is [preparing legislation](https://digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada) in the same direction. That can easily be read as something only ministries need to worry about. We believe it is more useful to treat it the way you would treat any other concentration risk, such as relying on a single supplier or a single sales channel. This doesn’t mean cutting every American tool out of your stack overnight. You will probably keep advertising on Google and Meta, and there is no reason not to. It means making sure the parts you can’t afford to lose, your customer data and your own record of what happens on your website, [sit somewhere you control](https://otusanalytics.com/why-otusanalytics). If an ad platform ever became unavailable, the conversions you send to it would stop arriving there, but your business would keep running and your data would still be yours. And if the large platforms ever stepped back from Europe at scale, we would expect European alternatives to fill that gap faster than most people now assume, as they are already doing in the public sector. The mindset shift is mostly about defaults. For a long time choosing a large American provider was the safe option that nobody had to justify, and the European alternative was the one that needed a business case. We think that is slowly reversing, and the businesses that start asking the uncomfortable question now will have far easier choices to make later. If analytics is one of the places you want to start, [Otus](https://otusanalytics.com/) gives you everything you would expect from a modern analytics tool, along with a few things that make it easier to use, such as cookieless tracking that usually doesn’t need a consent banner and an AI analyst that sends you a plain-language summary of your week. It is built and hosted entirely in the EU, with European suppliers throughout, so no part of it depends on a government outside Europe. ## Sitemap See the full [sitemap](https://otusanalytics.com/sitemap.md) for all pages.