African countries are recognizing that no matter how well-designed their data-protection regulations are, their sovereignty over US-based Big Tech firms ends at the boundary between subsidiary and parent. Overcoming this barrier will require a level of coordination that the continent has yet to achieve.
MUNICH/TORONTO—In June 2025, while testifying under oath before a French Senate inquiry, Microsoft France’s director of public and legal affairs admitted that the company “cannot guarantee” the data sovereignty of French customers in the event of a legally justified injunction issued by a US court. That is because, under the 2018 CLOUD Act, US authorities can order any firm headquartered in the United States to hand over the data it controls, no matter where it is located or which subsidiary holds it.