France's licensed cyber-surveillance exports doubled to about 65 million euros in 2025, its report to parliament shows

France licensed about 65 million euros of cyber-surveillance exports in 2025, more than double the previous year, according to the government's own report to parliament on dual-use goods. The report, the fifth of its kind, was published on 14 August 2026 and gives the figure only indirectly: surveillance goods were "around 11 percent" of everything approved in the two categories that cover computers and telecommunications, up from 8 percent a year earlier. Who bought them is not in the document.

How the 65 million is arrived at

The report never prints a euro figure for surveillance exports. It says that cyber-surveillance goods, which fall "mostly under part 1 of category 5 (telecommunications) and, to a lesser extent, category 4 (computers)", represented "around 11 percent of the amount of licences granted in 2025 across categories 4 and 5". Annex 5 gives those categories: 2.3 million euros for category 4 across 11 licences, and 589.5 million euros for category 5 across 729 licences. Eleven percent of the combined 591.9 million is about 65 million euros. The previous report used the same construction for 2024: 8 percent of 27.1 million plus 347.6 million, or roughly 30 million. The French outlet Next, which first did the arithmetic, put the average for 2021 to 2024 at around 30 million a year.

1. Category 4 (computers), 2025: 2,303,744 euros, 11 licences.
2. Category 5 (telecommunications and information security), 2025: 589,546,506 euros, 729 licences.
3. Report's stated share for cyber-surveillance goods: about 11 percent of the two combined.
4. Result: about 65 million euros, against about 30 million on the same method for 2024.

What the country table does and does not say

Annex 4 breaks the top 25 destinations down by category, and category 5 is where the surveillance goods sit. The largest category-5 amounts in 2025 went to Mexico (233.9 million euros, 45 licences), Saudi Arabia (88 million, 35), Morocco (32.6 million, 17), the United Arab Emirates (26.2 million, 36), China (21.1 million, 56), Iraq (17.4 million, 11), Brazil (16.9 million, 10) and Egypt (13.3 million, 14). The catch is that category 5 also contains cryptography products, firewalls, routers and modems, which the report says account for 92 percent of the category's value. A licence to sell encrypted routers to Mexico and a licence to sell interception gear to Egypt land in the same row. The report does not separate them, and the number of licences is shown only as "fewer than 10" wherever it is small, on confidentiality grounds.

The document's own framing is that surveillance goods are "subject to strict control" because of the "risk of diversion for internal repression or the commission of serious and systematic violations of human rights", and that their use "can also be legitimate in the fight against crime and terrorism". The safeguard it cites is the Pall Mall Process, launched by France and the United Kingdom in 2024 to curb "the proliferation and irresponsible use of commercial cyber intrusion capabilities". That process produced a voluntary code of practice for states in Paris in April 2025, backed at the time by 25 governments. It binds nobody, and the report presents it as the framework under which exports with adequate "guarantees and supervision mechanisms" can proceed.

Why an export line is a privacy story

French companies have a long record in this market. Amesys sold Libya's Gaddafi government the Eagle interception system in the 2000s and its successor Nexa faced charges over sales to Egypt; Qosmos was investigated for years over deep packet inspection technology tied to a Syrian interception project. The EU rewrote its dual-use rules in 2021 partly because of those cases, adding a catch-all clause that lets a state require a licence for unlisted goods when human rights risks appear. The 2026 report notes that the Commission is now evaluating that regulation until at least early 2027 and that it published due-diligence guidance for surveillance exporters in October 2024. What the report shows is a licensing system that works as designed: France approved more, refused 70 times, and disclosed the outcome in percentages.

For people on the receiving end the categories are concrete. Part 1 of category 5 covers lawful interception systems, mobile monitoring and the deep packet inspection equipment that identifies and throttles VPN traffic on national networks. Category 4 covers intrusion software of the kind that ended up on the phone of the European Parliament's own spyware investigator. A 65 million euro line does not say which of these was sold or to whom. It does say that, in a year when France co-chairs the diplomatic effort against spyware proliferation, the state signed off on twice as much of the technology as the year before.