Artificial intelligence requires an expansion of the physical infrastructure needed to process and store data. Traditional data centers on land require large amounts of electricity, substantial cooling systems, land occupation, and significant quantities of water. As demand for data centers and push backs from communities continue to increase, alternatives are emerging as placing servers and data centers in space or underwater.
In two recently published articles, I analyzed the application of the EU General Data Protection Regulation (GDPR) and U.S. privacy laws to data processing conducted off Earth. I concluded that moving data-processing infrastructure into space does not necessarily place the processing outside the reach of terrestrial privacy laws. See Francesca Giannoni-Crystal, Will In-Space Data Centers Take Privacy Laws Beyond Earth?, Wash. Law., Sept./Oct. 2026, at 14; Francesca Giannoni-Crystal, Data Processing in Space and the Application of the GDPR, 38 S.C. Law. 38 (Spring 2026).
In this post, I explore the same question with reference to data-processing infrastructure beneath the sea. The analysis presents both similarities and differences. Unlike outer space, the oceans are divided into maritime zones in which States exercise different degrees of sovereignty, sovereign rights, and jurisdiction. The location of an underwater data center may therefore add another layer to an already complex privacy-law analysis.
Underwater data centers are computing facilities in which servers and related equipment are installed inside sealed, pressure-resistant modules and placed on or near the seabed which present several advantages over terrestrial data centers.
- The advantages of Underwater Data Centers Over Terrestrial Data Centers and their Challenges
Energy and fresh-water saving. One of the principal potential advantages of underwater data centers is more efficient cooling: unlike on land, where extensive cooling infrastructure that consumes electricity is required to dissipate the heat produced by servers, underwater data centers can use the marine environment to control temperature. Using seawater as a heat sink reduces dependence on energy-intensive cooling systems.[1] Not only: on land, depending on the cooling technology used, data centers also consume substantial quantities of freshwater, raising social concerns over water availability. Because seawater provides the ultimate heat sink, underwater data centers can substantially reduce or eliminate the freshwater consumption associated with evaporative cooling.
Reduced use of land. Conventional data centers occupy large areas and require additional infrastructure for power, cooling, and connectivity. Moving some computing infrastructure offshore could be particularly valuable in case of densely populated coastal areas where suitable land is scarce or expensive.
Easy access to offshore renewable-energy. Another potential advantage is the ability to locate computing infrastructure near offshore renewable-energy (e.g., offshore wind or other marine energy sources), which avoids the need to transport energy.
Integration of energy and digital infrastructure. Underwater data centers also offer the possibility of integrating offshore energy generation and computing infrastructure. Offshore wind generation, subsea electrical connections, and underwater computing can operate as components of a single infrastructure system (wind generation, subsea electrical connections, and underwater computing), potentially increasing efficiency.
Development of the underwater economy. Underwater data centers could contribute to the development of a broader underwater economy, as their construction and operation require subsea cables, marine engineering, specialized vessels, corrosion-resistant structures, sensors, monitoring technology, installation services, and maintenance capabilities.
1.2 The Challenges
There are substantial technical and economic challenges for underwater data center, as they require sophisticated skills of marine engineering and technology connected to subsea cables, specialized vessels, corrosion-resistant structures, sensors, monitoring technology, installation services, and maintenance capabilities.
Maintenance. Unlike in a terrestrial data center, where technicians can enter the facility and repair or replace individual component, accessing servers located on the seabed is far more complicated. Therefore, underwater data centers require extremely reliable equipment and failures must can be managed remotely or addressed through retrieval or replacement of modules.
Corrosion and structural integrity. Saltwater is highly corrosive, and underwater enclosures must remain watertight while withstanding pressure, currents, and other marine conditions over extended periods.
Dependance on subsea power and communications cables. Damage or failure affecting these connections could interrupt operations, while repairs may require specialized vessels, equipment, and personnel.[2]
Cybersecurity and physical-security risks. Although the underwater location of data centers may protect them from some forms of physical interference, they depend on subsea power and communications connections that may themselves be vulnerable to disruption or attack. Their location may also make the facility more difficult to access quickly in the event of a malfunction, security incident, or physical attack.
Environmental questions. The heat generated by computing equipment even under water ultimately enters the surrounding environment and the effects of large-scale heat discharge on local marine ecosystems need still be studied. Also, installation of modules, cables, and related infrastructure can also disturb the seabed and marine environment.[3]
Cost feasibility. Underwater facilities may produce savings in cooling, land, and potentially energy transmission, but those savings must be weighed against the expense of designing, constructing, installing, monitoring, retrieving, repairing, and ultimately decommissioning subsea infrastructure.
Commercial Scalability. Experimental and commercial projects have already demonstrated that servers can operate underwater but whether underwater data centers can become a scalable alternative or substantially complement terrestrial facilities is still to be demonstrated. Energy-efficiency targets established during a demonstration project must eventually be supported by operating data over the facility’s useful life. Underwater systems must show that they can operate reliably for extended periods without frequent physical intervention; that the benefits from natural cooling and offshore energy integration outweigh higher installation and maintenance costs; that facilities can be expanded without losing those efficiencies; and that failed or obsolete equipment can be retrieved, replaced, and ultimately decommissioned economically. Their environmental performance must also be evaluated at scale. A small underwater installation and a network of large data centers may have very different effects on marine ecosystems.
To become a meaningful part of global digital infrastructure, underwater data centers must demonstrate technical reliability, economic competitiveness, environmental sustainability, operational security, and scalability.
- China as a Major Testing Ground
China has emerged as an important player in testing whether underwater data centers can make the transition from experimental projects to commercially scalable infrastructure.
One of China’s earliest significant projects was developed off Lingshui, Hainan Island, with commercial operations beginning in March 2023. In February 2025, an additional underwater module was installed and connected to the existing infrastructure, creating an intelligent-computing cluster. Reportedly, the new module can accommodate more than 400 high-performance servers and provide computing capacity for applications including artificial intelligence, industrial simulation, gaming, and marine research.
A larger Chinese project (Shanghai Lingang Undersea Data Center) is developed ten kilometers off Shanghai’s eastern coast, with the demonstration phase kicking off in May 2026. The demonstration phase has a capacity of 2.3 MW. The complete project is planned to reach 24 MW, with an announced investment of approximately 1.6 billion yuan. The surrounding seawater provides the cooling environment, and underwater computing is directly connected with offshore (offshore wind power connected to the facility through subsea cables). This project has a planned expansion from a 2.3 MW demonstration phase to a 24 MW facility.[4]
If these projects demonstrate long-term reliability and favorable economics, underwater data centers could eventually become an alternative or a complement to traditional terrestrial facilities, particularly in coastal areas with access to offshore renewable energy.
- Privacy Under the Sea
Underwater data centers raise numerous legal issues, including questions of jurisdiction, environmental protection, cybersecurity, infrastructure security, and the regulation of submarine cables. This post focuses privacy and data protection. Moving data-processing infrastructure underwater does not place the data outside terrestrial privacy law.
UNCLOS and maritime zones.
UNCLOS establishes different jurisdictional regimes for maritime areas: internal waters, archipelagic waters, the territorial sea, the contiguous zone, the exclusive economic zone (EEZ), the continental shelf, the high seas, and the international seabed Area (the “Area”), with the caveat that these are not all mutually exclusive geographic zones. Most importantly for present purposes, the continental shelf is a legal regime applicable to the seabed and subsoil, while the EEZ encompasses the waters, seabed, and subsoil, subject to the specific rights and jurisdiction provided by UNCLOS.
An underwater data center located within a State’s territorial sea (extending up to 12 nautical miles from the baseline) is within an area subject to the coastal State’s sovereignty, including over the seabed and subsoil. For present purposes, therefore, locating a data center in the territorial sea is not materially different from locating it within the coastal State’s land territory: moving the servers offshore does not move them beyond the State’s territorial jurisdiction. The privacy analysis is no different than the one that applies on land.
The analysis becomes more complex beyond the territorial sea. In the exclusive economic zone (EEZ), which may extend to 200 nautical miles, the coastal State does not exercise sovereignty but has specified sovereign rights and jurisdiction, which include jurisdiction over the establishment and use of artificial islands, installations, and structures and over protection and preservation of the marine environment. UNCLOS Article 60 further gives the coastal State the exclusive right to authorize and regulate the construction, operation, and use of certain installations and structures in its EEZ. Whether and under what circumstances an underwater data center qualifies as such an “installation or structure” is therefore an important threshold question that needs to be analyzed to understand how the privacy analysis needs to be performed.
The continental shelf adds another layer of complexity. Coastal-State rights over the continental shelf concern the seabed and subsoil rather than the waters above them, and UNCLOS Article 80 applies Article 60 mutatis mutandis to artificial islands, installations, and structures on the continental shelf. Thus, the legal status of an underwater data center may depend not simply on its distance from shore but also on whether it is placed on the seabed and on the nature and purpose of the installation.
The situation of the high seas, and the international seabed Area (the “Area”) is completely different.
US Privacy and GDPR
The maritime location of the servers does not exclude application of privacy laws. As I discussed with respect to in-space data centers, several privacy regimes are not based on the location of the infrastructure or the place where the data are stored or processed, as their application depend on other jurisdictional connections, including the residence or location of the individuals whose data are processed. The same principle applies to underwater data centers.
U.S. privacy law. In the United States, state data-breach notification laws generally follow the residence of the affected individual. Thus, if personal information belonging to residents of a U.S. state is processed in an underwater data center and is compromised, the applicable state breach-notification law may still apply. As discussed in my earlier article, New York’s SHIELD Act, for example, requires notification when a breach involves the private information of a New York resident, while California’s breach-notification statute applies to breaches involving the personal information of California residents. Moving the servers underwater does not alter those connections.
Other obligations may depend on a stronger nexus with the State. For example, the SHIELD Act’s reasonable-security requirement and California’s data-security requirements do not have identical jurisdictional predicates. Accordingly, as with in-space processing, the applicability of U.S. privacy law to an underwater data center must be determined under the particular statute involved.
The GDPR. The GDPR presents a broader regulatory framework. Once its territorial scope under Article 3 is satisfied, it regulates personal-data processing throughout the processing lifecycle, regardless of where the relevant servers are physically located. Thus, an underwater data center may be subject to the GDPR even if it is physically outside EU territory. The relevant inquiry is not where the servers are located, but whether one of Article 3’s jurisdictional bases is satisfied. Article 3(1) applies to processing carried out in the context of the activities of an establishment of a controller or processor in the EU, “regardless of whether the processing takes place in the Union or not.” Article 3(2)(a) may also bring a non-EU controller or processor within the GDPR when its processing relates to offering goods or services to individuals in the EU or monitoring their behavior there. Accordingly, transferring the processing from a terrestrial facility to an underwater data center does not, by itself, change the GDPR analysis. Under Article 3(2)(b), the GDPR applies when the processing relates to monitoring the behavior of data subjects insofar as their behavior takes place within the Union.
A fourth basis is provided by Article 3(3), which applies the GDPR to processing by a controller not established in the EU but in a place where Member State law applies by virtue of public international law. This basis is particularly relevant to underwater data centers because its application may turn on the legal status of the maritime area in which the facility is located. Where an underwater data center is located in the territorial sea of an EU Member State, the application of Article 3(3) would appear relatively straightforward: under UNCLOS, the sovereignty of the coastal State extends beyond its land territory and internal waters to the territorial sea, including its bed and subsoil. Accordingly, the territorial sea would appear to constitute a place where the law of that Member State applies by virtue of public international law.
The analysis becomes considerably more complex where the facility is located beyond the territorial sea. In the EEZ and on the continental shelf, the coastal State does not exercise general territorial sovereignty, but only the sovereign rights and jurisdiction conferred by UNCLOS for specified purposes. Whether Article 3(3) would apply to processing conducted by an underwater data center in those areas may depend on whether the coastal State’s jurisdiction under UNCLOS extends to the particular facility and, if so, whether that jurisdiction is sufficient to make the facility a “place where Member State law applies by virtue of public international law” within the meaning of Article 3(3). This is obviously a novel question that requires analysis. This is a novel question that requires further analysis.
As for underwater data centers located in the Area (that is, the seabed and ocean floor and subsoil beyond the limits of national jurisdiction) the Article 3(3) basis would seem to be inapplicable. As no State may claim or exercise sovereignty or sovereign rights over any part of the Area, the physical location of a data center in the Area would not, without some additional jurisdictional basis, appear to constitute a “place where Member State law applies by virtue of public international law.” This, however, would not preclude application of the GDPR under one of the other bases provided by Article 3.
___________
[1] Improved energy efficiency can be measured by Power Usage Effectiveness, or PUE, which compares the total energy consumed by a data center with the energy actually used by its computing equipment. The closer the PUE is to 1, the less energy is being consumed by cooling and other supporting infrastructure. China’s Shanghai underwater project, for example, has a design target of no more than 1.15 PUE for its demonstration phase.
[2] UNCLOS recognizes the freedom to lay submarine cables in the EEZ and on the continental shelf, subject to specified coastal-State rights and obligations. On the continental shelf, the coastal State generally may not impede the laying or maintenance of cables, but it retains authority over cables constructed or used in connection with installations and structures under its jurisdiction. UNCLOS also requires States to address the intentional or culpably negligent breaking or injury of submarine cables on the high seas.
[3] UNCLOS imposes a general obligation on States to protect and preserve the marine environment and to take measures to prevent, reduce, and control marine pollution. See UNCLOS arts. 192, 194. It also specifically addresses pollution arising from seabed activities and from artificial islands, installations, and structures under coastal-State jurisdiction. Id. art. 208. Notably, UNCLOS defines “pollution of the marine environment” to include the introduction by humans of “substances or energy” into the marine environment where it results or is likely to result in specified deleterious effects. Id. art. 1(1)(4). This definition could potentially encompass heat discharged by underwater data centers, depending on its effects on the marine environment.
[4] The planned 24 MW Shanghai underwater facility would be more than five times the median U.S. data center in that dataset, but still only a fraction of the size of the largest terrestrial data centers in the United States.
