When Amazon founder Jeff Bezos said at Italian Tech Week that gigawatt-scale data centers could orbit Earth within 10–20 years, he presented a vision of limitless solar power, zero weather disruption, and uninterrupted uptime.
“These giant training clusters will be better built in space because we have solar power there 24/7… There are no clouds and no rain, no weather,” Bezos said. “We will be able to beat the cost of terrestrial data centers in space in the next couple of decades.”
But Bezos’s vision for the future of cloud computing exposes a legal black hole: who governs data that leaves the planet?
Techopedia spoke with Ron Zayas, Incogni’s CEO, about the data sovereignty and governance challenges raised by the idea of locating data centers in space, whether global privacy laws can keep up when the cloud leaves Earth’s atmosphere, and the lessons that should inform cross-border regulation back on this planet.
- Jeff Bezos’ vision for large-scale data centers in space could transform cloud computing, but it exposes a major gap in global privacy law and data sovereignty.
- The Outer Space Treaty governs physical objects like spacecraft, not data, leaving uncertainty about which laws apply when data is processed or stored outside Earth.
- Governments already struggle to manage data transmitted across borders, suggesting that handling data in space could exacerbate current privacy and accountability risks.
- Regulators need to see data as analogous to money, recognizing that when it is mishandled or stolen, this has a direct cost to economies.
- To keep pace with innovation, international privacy laws and enforcement mechanisms must evolve before the cloud leaves Earth.
Ron Zayas is an online privacy expert and CEO of Ironwall by Incogni. A sought-after speaker and author, Ron has helped courts, law enforcement, and other public service organizations across the country protect the online privacy of their personnel, which in turn fuels their personal protection.
He spearheaded the development and implementation of Ironwall’s proactive strategies that incorporate client education, data broker outreach, and enforce laws requiring online removal of personally identifiable information. Ron has led the company since its inception in 2011, facilitating the protection of thousands of at-risk professionals in the public and private sectors.
Space Computing Could Push Global Privacy Regulations to a Breaking Point
Under the 1967 Outer Space Treaty, the state where an object is registered retains jurisdiction and control. But there is no comprehensive legal framework governing how personal or AI-generated data is processed or stored in orbit.
Research from privacy firm Incogni indicates that governments are already struggling to enforce data protection across national borders, as foreign-owned apps collect extensive personal data on Americans with limited clarity about where it ultimately ends up.
If regulators can’t trace where data from the apps we use every day travels to, what happens when that data – or an AI model trained on it – is stored or processed outside traditional territorial boundaries?
When Data Leaves Earth, Who’s in Charge?
Q: Bezos’s prediction has captured attention, but what are the most immediate legal and ethical questions raised by the idea of data centers in orbit?
A: Let me start off by saying this is still so far out there, because the problem they’re trying to solve – of not having enough room or enough energy on the planet here — is introducing 100 other problems: radiation, temperature, how you transmit that much data back and forth. It’s still so speculative.
There are two ways to look at this. One is from a moral and ethical point of view, and a legal framework to say it’s like being out in international waters. You can have gambling and other things that you couldn’t do on land. But that analogy falls apart, because gambling in international waters happens while you’re there.
With a data center in space, nothing happens until you transmit to it, or until it comes back. And when that happens, it’s going to happen within a country’s framework. If you’re transmitting data, for example, from the US back and forth, it’s going to be a free-for-all; if it’s happening in the EU, there will be protections.
It’s better to look at it from a money perspective. You can make money in a lot of different places. But it’s when you try to transfer your money that all the rules come in. So I don’t think it’s even an international body that has to do this. It’s where the data is actually going to be consumed. Unless people are living in space, it’s going to be consumed in a country, in a jurisdiction, and those rules are going to apply.
Q: If data sovereignty is already straining under cross-border cloud storage, what does it mean when data moves beyond Earth’s borders?
A: When we went through all the scenarios, the one that we really started looking at was transferring from space to space. You’d collect all this information that you could share with other people, and you’d be out of a jurisdiction. But then, using money as the analogy, you would have to launder the money. You get the data in space, you transfer it to other satellites; you’re not in anybody’s jurisdiction, and then somehow you launder it before you bring it back, and you come into somebody’s jurisdiction. That would be the gaping hole.
But there are a lot of bigger issues to deal with before we even get to that point. I don’t think this is going to happen. It’s not like AI that’s happening so quickly that we can’t get caught up with it. Jurisdictions will figure out how to deal with this.
Q: In practice, would it be an extension of existing legislation that in theory would apply extraterritorially, or would completely new laws be required?
A: I don’t know that there would be new laws, as long as the analogy still applies. Because in GDPR, for example, when you transmit outside of the EU, the laws still apply; because they originated there, or they’re going to terminate there.
The law may read specifically when you’re transferring from one jurisdiction to another, and somebody may make the argument that space isn’t a jurisdiction, but a court in common law would shut that down and have a rule for that right away. The idea is that you can’t transmit from a place with rules to a place without rules and then claim the rules don’t apply.
I don’t think it’s a whole new set of laws, as long as the countries that have the protection want to continue offering that protection.
Q: What unique privacy or cybersecurity risks might arise from storing or transmitting personal or AI-generated data through orbital systems?
A: One, you’re communicating with a satellite, so the first issue is going to be that it’s slow; the transmission time is going to be a lot longer. The second issue is going to be how well encrypted it is. We’re relatively good at encrypting information, but with a satellite, you could collect the information and then have a lot more time to decrypt it.
The bigger effect is that if information is being stored there, it’s very easy to destroy that information. A piece of dust moving fast enough could destroy it, much less somebody shooting it down maliciously. This is where the laws aren’t there – is that a crime? If you destroy somebody else’s satellite in space, who has jurisdiction over that? Who is going to sue you?
The protection of the data when it’s up there, the protection of the physical interaction, and the protection of how it gets transmitted – that’s where the law is not going to catch up, because nobody has jurisdiction in space.
The Next Frontier for Evasion & Cyber Threats
Q: Taking the money analogy, would space-based infrastructure effectively create a new kind of ‘data haven,’ similar to offshore tax shelters but for information?
A: It does in a sense, but like money, unless you figure out a way to launder it, you still have to spend the money in some jurisdiction. But if you transfer money to a jurisdiction that doesn’t really track where the money is, and somebody steals it, it’s a very hard case to prosecute.
It’s much different than robbing a bank. When somebody attacks your data center in space and steals your information and hacks you – and they will – what are you going to do about it?
Unless there are privacy protocols in place by multiple nations that all nations are participating in, you’re going to find that you have no legal protection over what just happened.
Q: How likely is that, given that certain countries engage in cyber attacks now?
A: It isn’t a question; it is going to happen. They’ll have free rein to do so, and it’ll progress accordingly. The first thing will be to sabotage, launching a rock fast enough to drive a hole through your data center and take it offline.
Then it’s going to escalate, and it’s going to be very hard to monitor when somebody is hacking you. It’s going to be much more difficult than when you’re terrestrial and you can control the physical environment.
And then the third level is somebody gaining control of the satellite. What happens if a space shuttle goes up into space, uses the grappling arm, and brings in your data center? Now they have all your data. Those are the big concerns from a legal perspective, not so much data privacy.
Q: Governments already struggle to regulate data collected by foreign-owned apps. What lessons from those failures should inform how we handle data governance?
A: The big lessons are multi-fold. We’re allowing technology to go so fast that as a society, we can’t get our rules around it. The UK and the US are common law states where judges can make law and help interpret it. But they can’t keep up with what’s happening in the market.
Whether it’s in space or terrestrial, what governments need to understand is that we’ve had lots of time to think about how we handle money. Data is money, privacy is money, and we haven’t applied any of those money laws. That’s the thing that we need to fight for more than anything else.
We need to have some agreements among all countries and set a minimum bar of what the right to data is and what the right to privacy is, and we haven’t done that yet.
Frame it as a cost issue. This is a tax on society, the ability for people to steal information. There’s a major breach in the U.S. every single day, on average, because companies are not taking care of data; they share it freely. If the government and regulators start looking at this, they’ll understand that it is much more of a drain on society than it is a plus.
Q: Is it already too late? A recent study showed that the AI assistants in browsers are already collecting data in ways that violate the companies’ own data privacy policies as well as regulations.
A: I don’t think it’s too late for two reasons. First of all, one of the things that countries have done with other laws is to open up a private right of action. When you violate it, it’s not just a state that can go after you; somebody can sue you for damages. Open that up, and right away, you’re going to reel back a lot of what companies are doing. We can’t change what’s already happened, but we can stop it from continuing to move forward.
The second thing is extremely doable, but it is just a lack of will – especially in certain jurisdictions – it needs to be opt-in, not opt-out. And it’s a true opt-in; it’s not like, ‘you can decide not to opt in, but then you don’t get internet access.’ That’s not a choice.
Those two things we can do, and it’s just like money laundering. There was a period where money was going back and forth, and nobody had any control. And finally, governments said money coming in and out is going to have controls, and you have to have transparency. Obviously, it hasn’t stopped money laundering, but it has lowered the amount of money that’s being used for illicit purposes. It’s the same thing with data.
It is not too late, and the people who are saying it is too late are the same people who want you not to do anything about it.
Big Tech’s Responsibility
Q: What role should major cloud providers and AI developers play in ensuring privacy-by-design?
A: Ideally, they should treat data like banks treat money, and they don’t. To them, data is free. They collected it, they mined it from you, basically at very little cost. And what they’re saying is, we now have a product that we can sell for a profit, and our cost of goods on it is extremely low.
If there are real penalties financially for a company being careless with data, all of a sudden they’re going to understand that protecting data is important to them, just like a bank. A bank is federally insured, but if they get robbed, their insurance rates go up. There’s a cost.
Airplanes don’t crash because it’s really expensive to crash because of the insurance, and they have all these protocols to protect you. We need to have a real cost for data centers that allow data to be unprotected, and we need to tax and regulate them. We need to have private rights of action that make it very expensive to make a mistake, with regulatory costs, fines, and penalties. And once you do that, you will start getting the safety that we generally have with aviation and with money.
Data brokers and data centers need to move to that area. For an airline, a plane crashing isn’t the cost of doing business. They constantly strive to be safer, and for the most part, they are.
It can’t be Google, Meta, or Microsoft saying, ‘Okay, we get a $1 billion fine, but we made $25 billion off of it. It just cuts into our cost of goods.’ It has to be like some of the penalties in GDPR, which take 10% of what you make worldwide. We have to enforce it, and we also have to make it so that people can individually take action.
Regulators need to adopt the analogy that data is money, and once they do that, they should also understand that when data is leaving your borders or being carelessly stolen or anything else, you are costing money to your GDP in the form of a tax to your employees and even to businesses. You wouldn’t let money be that carelessly thrown around or used for terrorism. Data is money. We need to treat it like that.
The Bottom Line
Jeff Bezos’s space ambitions may extend far beyond sending up rockets for tourism; they could redefine the boundaries of data governance. Without clear international frameworks, data processed or stored in Earth’s orbit could slip through legal cracks, creating a new level of privacy and accountability risk.
FAQs
Bezos has predicted that data centers could be built in space within the next two decades to reduce the cost of large-scale data storage.
Locating data centers in space could push global privacy laws to their limits by moving processing beyond any single country’s jurisdiction, making it harder to enforce regulations.
No, the 1967 Outer Space Treaty governs spacecraft, satellites, and other physical objects in space, but does not address digital or personal data processed in orbit.
If data is stored or processed outside Earth’s jurisdiction, it may fall into a legal gray area where privacy protections are unclear or unenforceable – potentially creating “data havens” similar to tax shelters.