London’s Metropolitan Police asked tech companies to hand over private communications data more than 700,000 times in 2025. Not content. Metadata — who you contacted, when, from where, and for how long. The numbers come from Freedom of Information requests obtained by The Register, and they paint a picture of routine, industrial-scale surveillance of ordinary digital life.
The Met didn’t limit itself to traditional telecoms. Uber, Bolt, JustEat, Deliveroo, and Domino’s Pizza received a combined 768 data requests. Counter Terrorism Policing separately sought software to process Uber rides, delivery orders, automatic number plate recognition data, and drone footage for “intelligence analysis.” Your Friday night takeaway order is now a data point in a police intelligence pipeline.
The LycaMobile Spike
The most striking figure is the 500% surge in requests to LycaMobile — from 15,702 in 2024 to 93,527 in 2025. LycaMobile is a low-cost mobile network popular with migrant communities and international callers. A sixfold increase in surveillance of a carrier used disproportionately by migrants raises serious questions about who is actually being watched, and why.
Encrypted Services Aren’t Immune
The Met has made 139 requests to Proton since 2024. Proton — a Swiss-based provider offering encrypted email and VPN — confirmed it does not transmit data directly to foreign law enforcement. But communications data in Proton’s case can include account payment details and, in some instances, IP addresses. Swiss law requires Proton to comply with valid Swiss legal orders, so requests must be routed through mutual legal assistance channels. That’s a safeguard, but it’s not invisibility.
Signal fared better. The encrypted messaging service received one request from the Met since 2024 — and denied it. Signal simply doesn’t have the metadata to hand over.
The difference matters. Encryption protects message content, but metadata — the who, when, and where of your communications — can reveal just as much about your life. Where you store your data and which service you use determines how much of that metadata even exists to be requested.
Journalists and Lawyers in the Crosshairs
In 2024, 157 Met Police authorisations targeted journalists. Another 219 targeted lawyers. The force issued 106 warrant applications specifically to identify journalists’ sources. These aren’t abstract concerns about press freedom — they’re documented instances of a police force using communications data powers to pierce source protection.
The UK has a legal framework for this. The Office for Communications Data Authorizations (OCDA), part of the Investigatory Powers Commissioner’s Office, is supposed to provide oversight. But the system allows senior police officers to approve many requests operationally, without judicial sign-off. Dr. Bernard Keenan, a surveillance law researcher, described it plainly: police can do this “more-or-less autonomously.”
There’s precedent for abuse. The Met’s unlawful surveillance of journalists Barry McCaffrey and Trevor Birney — who exposed police collusion in Northern Ireland — remains one of the most egregious examples of communications data powers being turned against the press.
Why This Matters
Seven hundred thousand requests from a single police force in a single year. Delivery apps feeding data into counter-terrorism software. A sixfold spike in surveillance of a carrier serving migrant communities. Journalists targeted over a hundred times to identify their sources.
This is what “nothing to hide, nothing to fear” looks like in practice. Metadata surveillance doesn’t require reading your messages — it maps your relationships, movements, habits, and contacts. And it happens at a scale that makes individual judicial oversight practically impossible.
The takeaway is straightforward: the services you choose determine how much data exists to be collected. End-to-end encrypted platforms that collect minimal metadata give law enforcement less to request. Services that log everything — your location, your contacts, your order history — give them a buffet.
Your choice of communication platform isn’t just a preference. It’s a privacy decision with real consequences.