GAFAM. Five companies that know more about you than your loved ones do
Google, Apple, Facebook, Amazon and Microsoft. You use their services every day - often without even knowing it. For free, but not without a price.
On 6 June 2013, The Washington Post and The Guardian published slides from a secret presentation by the US National Security Agency. One of them looked like an advertisement for Silicon Valley: a row of colourful logos and dates. Microsoft - 2007. Yahoo - 2008. Google and Facebook - 2009. YouTube - 2010. Skype - 2011. Apple - 2012. This was how the PRISM programme was described - the programme under which the NSA was said to obtain user data from the world's largest internet companies.
The companies denied giving the government "direct access" to their servers. But the list stuck in people's minds. The documents revealed at the time by Edward Snowden showed something many had only suspected: the place where the most data about people is gathered sooner or later becomes a target for intelligence agencies.
Where the word GAFAM came from
The acronym was born in France. According to the editors of Le Monde, the term GAFA - for Google, Apple, Facebook and Amazon - first appeared in the newspaper in December 2012. Other media quickly picked it up, and in time the letter M was added for Microsoft. Tellingly, in France it is used most often in critical articles: about taxes, about monopolies, about personal data.
Five companies, five different business models. What unites them is scale. Search engine, phone operating system, email, maps, shop, cloud, messenger, computer operating system - for most people in the world, at least one of these services belongs to GAFAM. Usually several at once.
Put the pieces together. Google knows your questions - including the ones you would ask no one else - and the routes you travel. Apple stores your photos, your phone backups and your health data. Meta sees who your friends are, whom you follow and what moves you. Amazon knows your purchases, and its speaker waits in your kitchen for your commands. Microsoft has your documents, your email and the system you work on. None of these companies needs everything. A piece is enough for each of them to know more about you than many a friend.
You are the product
Google and Meta, the owner of Facebook, Instagram and WhatsApp, make their money mainly from advertising. The more precisely they know who you are, what you search for and where you go, the more they can charge for your attention. That is why the services are free. You pay with your data.
European data protection authorities have repeatedly ruled that these practices cross legal lines. In July 2021, Luxembourg's regulator fined Amazon 746 million euros for using personal data to target ads without valid consent. In January 2023, the Irish authority fined Meta 390 million euros because the company had no proper legal basis for processing user data for advertising. A few months later the same Meta received a record penalty: 1.2 billion euros for transferring Europeans' data to the United States. The background leads straight back to PRISM - the European Court of Justice had earlier ruled that US law does not protect this data from access by intelligence agencies.
Across the Atlantic, the biggest scandal was Cambridge Analytica. The consulting firm obtained data on up to 87 million Facebook users without their explicit consent and used it in political campaigns. In 2019, Facebook agreed to pay the US Federal Trade Commission a record 5 billion dollars.
The setting that switched nothing off
In 2018, the Associated Press reported that many Google services on Android and iPhones stored users' locations even after they had turned off "Location History" - the very setting meant to prevent that. Researchers at Princeton University confirmed the journalists' findings. The problem affected around two billion Android devices and hundreds of millions of iPhones running Google Maps or Search.
In November 2022, Google settled with 40 US states and paid 391.5 million dollars. The attorneys general concluded that the company had misled users since at least 2014. The lesson is simple: a switch in the settings shows what the company wants you to see. It does not have to mean what you think.
The camera at the door
Amazon is not just a shop. It is also Alexa, the AWS cloud and Ring - home cameras and video doorbells. In July 2022, answering questions from Senator Edward Markey, Amazon admitted that in that year alone it had already handed Ring camera recordings to US police 11 times without the owners' consent and without a court order. The company explained that in each case it had concluded there was an imminent danger of death or serious injury.
Perhaps there was. But the decision was made by the company, not by the owner of the camera. A device you buy to protect your home can also be watching you - and others may know about it.
A screenshot of your life
In May 2024, Microsoft announced a feature called Recall for new Windows computers. The idea: the system regularly takes screenshots, stores them locally and lets you search everything you have done on the computer. Security researchers quickly showed that on a compromised computer these screenshots could be extracted and searched, and Microsoft itself admitted that Recall does not filter content - screenshots may contain passwords or banking details.
After a wave of criticism, the company postponed the launch, made the feature optional and protected it with an additional login. It is good that it reacted. But the idea itself says a lot: in a system you do not fully control, a feature that tracks your every step can arrive with the next update.
When the state knocks on the door
For years Apple has built an image of a company for which privacy is a value. In 2022 it introduced Advanced Data Protection - full encryption of most iCloud data, to which Apple itself holds no key. In February 2025, the British government, under the Investigatory Powers Act, reportedly demanded that the company provide access to this data. Apple refused to implement a backdoor. Instead, it withdrew the feature in the United Kingdom, saying it was "gravely disappointed".
This is the story of a company that acted decently. And at the same time proof that even the best protections of a tech giant depend on its business decisions and on the law of the country in which it operates. Your data is only as safe as the weaker of those two allows.
You cannot escape. You can choose
In September 2026, Google accounted for nearly 89% of searches in Europe. Most smartphones in the world run a system from Google or Apple, and most computers one from Microsoft. Giving up GAFAM entirely is unrealistic for many people. Nor does it have to be the goal.
The goal is an informed choice. Where sensitive information is at stake - your sources, contacts, documents, whereabouts - you can use tools that do not live off your data: Tor Browser, GrapheneOS on your phone, Qubes OS or Tails on your computer, the KeePassXC password manager. We have collected them on our Downloads page. And if you want to understand why even the mere fact that you talk to someone can say more than the conversation itself, read our article on metadata.
GAFAM is not evil in itself. These are five companies that built a convenient world - and send the bill for it in a currency that does not show up on your bank statement.