China
Only state-approved VPN services are lawful for commercial use, and the national filtering system actively detects and blocks standard VPN protocols.
25 country briefs · Updated August 15, 2026
Is using a VPN legal?
Is using a VPN illegal?
In most of the world, yes. Of the 25 countries we brief, 14 place no restriction on VPN use, 8 restrict it, and 3 permit only state-approved services — China, Russia and Iran. In almost every restrictive country the law binds the provider rather than the individual, which is a distinction the question usually hides.
The question is almost always asked about the wrong party. Where VPNs are restricted, the law usually binds the company operating the service, not the person using it — which is why a country can block every major provider without making it an offence to connect.
| Status | Countries | Who the restriction actually binds |
|---|---|---|
| Only approved services permitted | 3 | The provider, through licensing. Users are rarely the target. |
| Legal, with restrictions on use | 8 | The provider, through registration or retention duties. |
| Legal and unrestricted | 14 | Nobody. Listed because another factor changes the choice. |
Only state-approved services are permitted
Commercial VPN provision requires a licence, and unlicensed services are blocked at the network. Enforcement against an individual traveller using a personal VPN has been rare in all three, but the legal position is not the same as lawful use.
Legal to use, but restricted in a way that matters
Using a VPN is not itself an offence in these countries. What varies is registration requirements on providers, retention mandates that reach them, and cybercrime law broad enough that liability follows what you do rather than the tool you used.
United Arab Emirates
A VPN is lawful for legitimate corporate use, but using one to commit an offence — including accessing blocked VoIP or gambling services — carries specific penalties.
Turkey
VPN use is not criminalised, but access to VPN provider websites and to Tor has been blocked at operator level, and blocks arrive with little notice.
India
VPN use is legal, but a 2022 directive requires VPN providers operating in India to retain customer records for five years — several providers removed their Indian servers rather than comply.
Saudi Arabia
A VPN is not itself banned, but anti-cybercrime legislation penalises using one in the course of accessing prohibited material or services.
Egypt
VPN use is not explicitly criminalised for individuals, but circumvention tools are filtered and cybercrime legislation is broadly drawn.
Vietnam
VPN use is common and not individually prosecuted, but cybersecurity legislation requires major platforms to localise data and remove content on request.
Indonesia
VPNs are legal, and Indonesia operates one of the largest positive-list filtering systems in Southeast Asia alongside a registration regime for online platforms.
Pakistan
Business VPNs must be registered and provider licences now exist, but the planned block on unregistered VPNs was withdrawn for want of a legal basis.
No restriction on use
A brief exists for these because something else about the jurisdiction changes the choice — alliance membership, a retention regime, or legislation compelling technical assistance from operators.
United Kingdom
VPNs are entirely legal, but the UK is a Five Eyes member with broad investigatory powers legislation, which makes provider jurisdiction the thing worth thinking about.
United States
VPNs are legal, ISPs may lawfully sell subscriber browsing data, and US-incorporated providers are reachable by domestic legal process including gag orders.
Germany
VPNs are legal and widely used, and Germany is the country where copyright enforcement letters make the choice of provider financially concrete.
Australia
VPNs are legal, but Australia combines Five Eyes membership, a two-year metadata retention regime, and legislation allowing agencies to compel technical assistance.
Canada
VPNs are legal, and the notice-and-notice regime means your ISP forwards rights-holder complaints directly to you.
France
VPNs are legal, and France runs one of the most active administrative anti-piracy and site-blocking regimes in Europe.
Japan
VPNs are legal and unrestricted; the practical constraint is latency, because most providers route Japanese traffic through a small number of Tokyo-area facilities.
Brazil
VPNs are legal, and Brazil has a strong data-protection statute alongside a history of court-ordered blocking of entire messaging services.
Netherlands
VPNs are legal, connectivity is excellent, and the Netherlands is a Nine Eyes member that also hosts a large share of European VPN server capacity.
Switzerland
VPNs are legal, and Switzerland is one of the few countries that is both a good place to use a VPN and a good place for one to be incorporated.
Nigeria
VPNs are legal, and demand spiked after a national suspension of a major social platform demonstrated how quickly access can be withdrawn.
South Korea
VPNs are legal, and South Korea combines world-class connectivity with an unusually broad DNS and SNI-based blocking system.
Italy
VPNs are legal, and Italy operates an automated blocking platform capable of taking down live streams within thirty minutes.
Spain
VPNs are legal, and recent sports-broadcast blocking orders have caused collateral outages for ordinary services on shared addresses.
Why the answer is usually about the provider
A government that wants to control what its population reaches has two options: prosecute millions of individuals, or compel a handful of companies. It chooses the second every time. That is why the restrictions in this list attach to licensing, registration and data retention — obligations a company can be made to meet — rather than to the act of connecting.
The practical consequence for a traveller is that the risk is rarely the VPN. It is what you do while connected, under content and cybercrime law that is often drawn broadly. In several of these countries using a circumvention tool is an aggravating factor attached to another offence rather than an offence in itself, and that is a meaningfully different thing from “VPNs are illegal here”.
Legality and reachability are different questions
A country can permit VPN use and still make connecting difficult, and the reverse is also true. Deep packet inspection blocks the protocol regardless of what the statute says, which is why the briefs record filtering separately from law: one tells you your exposure, the other tells you whether the tunnel establishes at all.
Where filtering is protocol-level rather than address-level, the provider needs an obfuscation mode — of the four we cover, Proton VPN ships Stealth and NordVPN offers obfuscated servers with its NordWhisper protocol. Each brief states the requirement that actually decides it for that country.
Why 25 and not 195
A country brief earns a page when the law, the filtering or the retention regime changes what you should do. Generating one for every country in the world would produce well over a hundred near-identical pages stating that a VPN is legal and nothing else — which is padding an index rather than covering a subject, and it is the pattern that this site was built to avoid.
If a country you need is missing and something about it genuinely changes the answer, tell us what changed and we will write the brief.
Questions
- Is using a VPN illegal?
- In most of the world, yes. Of the 25 countries we brief, 14 place no restriction on VPN use, 8 restrict it, and 3 permit only state-approved services — China, Russia and Iran. In almost every restrictive country the law binds the provider rather than the individual, which is a distinction the question usually hides.
- Which countries ban VPNs?
- No country in our set bans the technology outright. China, Russia and Iran permit only state-approved services, which in practice means commercial VPNs operate without a licence and are blocked rather than criminalised. The obligation falls on the provider; individual users are prosecuted rarely and usually for what they did with it.
- Can I get in trouble for using a VPN abroad?
- The risk is almost never the VPN itself. In restrictive jurisdictions, cybercrime and content law is drawn broadly enough that liability attaches to what you access, and using a tool to reach blocked material can be an aggravating factor. Read the brief for the country you are travelling to rather than generalising from a neighbour.
- Does a VPN being legal mean it will work there?
- No, and the two are separate questions. Several countries where VPN use is lawful still filter aggressively at the protocol level, and several where it is restricted are easy to connect from. Legality tells you your exposure; obfuscation support tells you whether the connection establishes.
- Why does KotoVPN only cover 25 countries?
- Because a brief is only worth publishing where the law, the filtering or the retention regime changes the answer. Generating a page for every country would produce 170 near-identical pages saying a VPN is legal, which is padding rather than coverage.