The Canadian Bitcoin exchange Bull Bitcoin, which positions itself as the world's oldest non-custodial platform, has filed a lawsuit with the French Council of State — the country's highest administrative court. The goal is to repeal Decree No. 2025-1276, which transposes the European DAC8 directive (Eighth Directive on Administrative Cooperation in the field of Taxation) into French law. This is the first legal challenge of its kind against the mass collection of data on crypto asset holders.
What are the complaints against DAC8?
Starting January 1, 2026, DAC8 will require all European Virtual Asset Service Providers (CASPs) to systematically collect and transmit data on the identity and transactions of millions of users to tax authorities. This information will then automatically circulate among the fiscal services of EU member states.
Bull Bitcoin sees this as the creation of a "mass database" linking legal identity, home address, and complete transaction history, including operations unrelated to taxation. According to the company, such a database represents a "time bomb" for the security of crypto asset owners. Given daily data leaks and the rising number of kidnappings of cryptocurrency holders, creating a centralized repository of personal information makes millions of people, including government officials, vulnerable to targeted attacks.
The company highlights a paradox: the information will be accessible to tax administrations in many countries, far beyond France. Considering precedents of government data leaks, internal corruption, and illegal resale of information, Bull Bitcoin poses a rhetorical question: do users really want their personal data to be available to numerous third parties from other states?
Company plans and management's stance
Bull Bitcoin CEO Francis Pouliot characterized DAC8 as transforming the "know your customer" (KYC) concept into "kill your client" (KYC). This harsh wording reflects the depth of concerns regarding the physical safety of asset owners.
The timeline of actions is as follows: On February 24, 2026, the company filed a preliminary motion with the Council of State, followed by a detailed complaint outlining all grounds. Bull Bitcoin calls this lawsuit the "first front" and intends to use all legal means to suspend, delay, repeal, or amend DAC8 and its global counterpart, the CARF standard.
Pouliot stated that the very foundations of civilization cannot be allowed to be destroyed by an attack on the right to privacy. According to him, someone must draw a line and take a stand, and since no one else is willing or able to do so, the burden of leading this fight has fallen on Bull Bitcoin.
My analysis: This lawsuit is a landmark precedent. Bull Bitcoin, as a non-custodial platform operating exclusively with Bitcoin, demonstrates that even within the strict MiCA regulatory framework, legal levers can be found to protect privacy. If the court rules in favor of the plaintiff, it could slow down the implementation of DAC8 in other EU countries and create a powerful legal precedent for challenging CARF on a global level. The market is closely watching this case, as its outcome will impact the future of cryptocurrency regulation in Europe.