FOR NERDS

Why HTTPS with SSL/TLS Certificates Will Likely Be Necessary in the EU by 2025
As of 2023, the trend toward requiring SSL/TLS certificates for HTTPS websites is becoming increasingly stronger across the European Union (EU). This trend is driven by both technical and regulatory factors aimed at improving web security, protecting users' personal data, and ensuring trust in online services. Here’s why HTTPS will likely be required for most websites in the EU by 2025:

1. General Data Protection Regulation (GDPR)
Legal Requirement for Security: The GDPR (Regulation (EU) 2016/679) is the cornerstone of data protection laws in the EU. It mandates that organizations process personal data securely. While the GDPR does not explicitly require HTTPS, it stresses the need for appropriate technical and organizational measures to protect data. This includes the use of secure communication channels, such as HTTPS, to prevent data breaches during transmission.

Article 32 – Security of Processing: This article specifically requires businesses to implement measures to ensure data security during processing, which would include the use of encrypted connections like HTTPS to protect personal data in transit.

2. EU Cybersecurity Act (Regulation (EU) 2019/881)
The EU Cybersecurity Act strengthens the EU’s cybersecurity framework, establishing the European Union Agency for Cybersecurity (ENISA) and creating a voluntary certification framework for ICT products, services, and processes. Although it doesn't mandate HTTPS, it underlines the EU's commitment to improving digital security, and secure communication through HTTPS is a key aspect of secure online services.

Recommendation for HTTPS: As part of the broader cybersecurity strategy, the use of HTTPS (with SSL/TLS certificates) is encouraged to protect data in transit, and businesses and public bodies are expected to comply with best practices in cybersecurity.

3. E-Commerce Directive (Directive 2000/31/EC)
The E-Commerce Directive establishes the legal framework for online commerce within the EU. It requires that online businesses take steps to ensure the protection of personal data and secure transactions. Although it does not specifically mandate HTTPS, the directive encourages measures to ensure that consumers can trust e-commerce websites, and using HTTPS for secure transactions is now the industry standard.

Consumer Protection: The directive’s focus on consumer protection indirectly drives the need for secure communication channels, making HTTPS a common requirement for e-commerce platforms to protect consumer payment data and personal information.

4. EU Digital Strategy and Digital Services Act (DSA)
The Digital Services Act (DSA) (Regulation (EU) 2022/2065) and the Digital Markets Act (DMA) (Regulation (EU) 2022/1925) aim to ensure safer online spaces for users, including stricter rules for digital platforms. While these laws primarily address the responsibilities of large platforms, they also contribute to a broader shift towards secure and trustworthy online environments.

Security and Trust: As part of the EU’s broader Digital Strategy for 2030, there is a significant emphasis on digital trust and security, with many of the laws calling for improved cybersecurity measures. HTTPS is essential for achieving these goals and ensuring a trusted online experience.

5. Browser and Search Engine Requirements
Google and Other Browsers: Major web browsers, like Google Chrome, Mozilla Firefox, and Microsoft Edge, have long marked non-HTTPS websites as “Not Secure” in the address bar, warning users about potential security risks. Google also uses HTTPS as a ranking factor in search results, meaning websites without HTTPS may be penalized in terms of search engine visibility.

User Trust: Browsers and search engines have made HTTPS a fundamental part of the user experience, signaling to users that their connection is encrypted and secure. Websites without SSL/TLS certificates will likely face reduced trust and engagement from users, as modern users have come to expect HTTPS as the standard.

6. Payment Card Industry Data Security Standard (PCI DSS)
For businesses handling credit card transactions, PCI DSS (Payment Card Industry Data Security Standard) requires the use of secure communication protocols like HTTPS to protect cardholder data. While PCI DSS is not an EU law, it applies to any business within the EU that processes credit card payments, and failure to comply can result in significant penalties.

SSL/TLS for Secure Payments: PCI DSS compliance necessitates that all online payment transactions be encrypted using HTTPS, further reinforcing the importance of SSL/TLS certificates for websites handling payments.

7. European Electronic Communications Code (EECC)
The EECC (Directive (EU) 2018/1972) establishes a regulatory framework for electronic communications in the EU, including provisions for ensuring the security of public electronic communication networks and services. Although it primarily addresses network providers, it indirectly affects website operators, particularly those offering services in sectors like telecommunications or finance, by encouraging robust security measures like HTTPS.

8. Public Sector and Government Websites
Websites operated by public authorities are increasingly required to use HTTPS as part of the EU’s digital modernization initiatives. The EU's Digital Government Action Plan emphasizes secure, user-friendly digital services, and public sector websites are expected to adhere to high security standards, including encryption of user data transmitted over the web.

EU Directive 2014/24/EU on public procurement requires public sector bodies to ensure that their digital interactions with citizens are secure, and HTTPS is the baseline technology for ensuring secure communication.

9. The Shift Toward an Encrypted Web
The EU has been actively promoting the idea of a fully encrypted internet. In 2023, the EU unveiled plans for enhancing online privacy and data protection as part of its digital transformation. This includes pushing for end-to-end encryption in communications, which directly ties into the adoption of secure protocols like HTTPS. The increasing reliance on encrypted communication in the digital economy further strengthens the case for widespread HTTPS adoption.

HTTPS is the Future of Secure Web Communication
Given these regulatory frameworks, industry practices, and technical trends, HTTPS (secured with SSL/TLS certificates) will likely become a universal requirement for most websites in the European Union by 2025. While it’s not always a legal mandate for every type of website, the combination of data protection laws like the GDPR, cybersecurity regulations like the EU Cybersecurity Act, and the increasing emphasis on consumer trust and online security means that businesses, especially those handling sensitive data or engaging in e-commerce, will need to ensure they are using HTTPS.

For businesses in the EU, implementing HTTPS is not just a best practice; it is quickly becoming a necessity to comply with a growing body of laws, avoid penalties, and protect users from data breaches and cyberattacks. Even if HTTPS is not yet legally required for every website, the regulatory and technological environment makes it clear that it will be the de facto standard for online communication in the very near future.