Vodafone Group Plc.
Headquartered in the United Kingdom, Vodafone Group operates predominantly in Europe and Africa, where it provides mobile, fixed-line, and other telecom and internet services in 15 countries directly. The company has around 300 million mobile and fixedline subscribers in those markets.
Vodafone dropped from second to fifth place among telcos this year. The shift stemmed from a mix of progress among its competitors and declines in Vodafone’s own governance as well as its transparency on key issues such as government demands.
Vodafone continued its years-long restructuring efforts, which saw Vodafone UK merging with Three UK in 2025 under VodafoneThree to become the country’s largest mobile network, with more than 27 million subscribers. Vodafone Group continued to sell off shares to e&, the multinational telecom operator backed by the government of the UAE. e& first acquired a 9.8% stake in Vodafone Group in 2022 for USD 4.4 billion. That stake had increased to 16.6% as of December 2025. Under the terms of the partnership, e& can increase its stake to just under 25%, with the opportunity to add an executive to the board if its holdings increase to 20%. This has stoked concerns about sovereignty and security, culminating with the UK government ordering the creation of a “national security committee” within the company.
Since 2022, Vodafone has ramped up its participation in initiatives aimed at protecting youth from digital harms. Among other efforts, it backed HMD’s development of a mobile phone with a built-in AI system to protect children from nude imagery and established a pan-European youth panel to advise the company on online safety. Despite securing major AI partnerships with tech giants like Google and Microsoft, Vodafone showed no significant improvement in its algorithmic policies.
In a March 2025 decision, the German data protection authority fined Vodafone’s subsidiary in Germany, Vodafone Gmbh, a total of EUR 45 million for lack of supervision and auditing of its partner agencies and weak security of its online service portal. Our assessment found that the company had indeed improved its security policies but no longer provided a comprehensive policy on handling data breaches.
The 2026 RDR Index: Telco Giants Edition covers policies that were active on August 31, 2025. Policies that came into effect after August 31, 2025 were not evaluated for this ranking.
Scores reflect the average score across the services we evaluated, with each service weighted equally.
We rank companies on their governance, and on their policies and practices affecting freedom of expression and privacy.
Vodafone ranked sixth in the Governance category, with its score dropping by three points since the 2022 Telco Giants Scorecard. The company disclosed a robust commitment to human rights (G1) and had in place strong governance and oversight over freedom of expression and information, as well as privacy issues at all levels of its operations (G2). Its employee training and whistleblowing programs covered these rights (G3). However, it continued to perform poorly on due diligence, failing to share whether its assessments cover policy enforcement (G4b), targeted advertising (G4c), algorithms (G4d), or zero-rating programs (G4e). Its departure from the GNI weakened its accountability to external oversight mechanisms that follow robust human rights standards (G5).
Vodafone disclosed only limited information about policies and practices that affect users’ freedom of expression and information. It did not publish ad content or ad targeting policies (F1b, F1c). While the company provided some insights into the rules governing the use of its services, it lacked transparency about how it enforces its own rules (F3a) and disclosed no data about enforcement actions such as content and account restrictions (F4a, F4b, F4c). Vodafone disclosed some information about government network shutdown orders, but did not publish any data on the shutdown requests it received (F10).
Vodafone ranked fourth on privacy, behind Telefónica, Deutsche Telekom, and América Móvil. This was the only category where the company’s performance improved, if slightly. Like almost all other companies we assessed, Vodafone provided meager disclosures about its handling of personal information, failing to disclose all the types of information it infers (P3b) and shares (P4). It made thin disclosures on its data retention practices (P6). The company did have robust reporting about its process for handling government demands for user information (P10a). However, its public data about these demands was not comprehensive (P11a).