KotoVPN

Country briefs

Where is it legal to use a VPN?

VPN use is lawful in most countries, including the whole of the EU, the UK, the US, Canada and Australia. It is restricted or licence-only in a smaller set — China, Russia, Iran, Turkey and the UAE among them — where the constraint is usually on providers rather than individuals. KotoVPN publishes 25 country briefs covering those.

For the summary across all of them — which countries restrict use, which restrict providers, and who each rule actually binds — start at is a VPN legal.

25 countries where the legal position, the filtering, or the retention regime changes what you should pick. Everywhere else, the main ranking is the answer.

There are about 195 countries. We publish 25 pages, not 195. In most of the world a VPN is legal, ordinary and unfiltered, and a page saying so with a place name in the title would be a permutation rather than a resource.

CountryStatusWhat decides it thereQualify
ChinaOnly approved services permittedObfuscation or open-source clients that can be inspected for detectable fingerprints.2/4
IranOnly approved services permittedObfuscation, and ideally a free tier — payment card access to foreign services is itself restricted.1/4
RussiaOnly approved services permittedObfuscation, plus a provider incorporated outside the jurisdiction so it is not subject to local filtering orders.2/4
EgyptLegal, with restrictions on useObfuscation, and the client installed before you arrive.2/4
IndiaLegal, with restrictions on useA provider incorporated outside India with an audited no-logs position, so the retention directive does not reach it.4/4
IndonesiaLegal, with restrictions on useA provider with its own DNS resolver, since local ISP DNS is where the filtering happens.4/4
PakistanLegal, with restrictions on useObfuscation that survives protocol-level disruption.2/4
Saudi ArabiaLegal, with restrictions on useA provider incorporated outside the region with no local licensing obligation.4/4
TurkeyLegal, with restrictions on useObfuscation, and apps already installed before you need them.2/4
United Arab EmiratesLegal, with restrictions on useA provider incorporated outside the Fourteen Eyes, with no local presence subject to regulatory orders.4/4
VietnamLegal, with restrictions on useA provider with no local entity subject to data localisation requirements.4/4
AustraliaLegal and unrestrictedA provider incorporated outside the Fourteen Eyes and outside the reach of assistance notices.4/4
BrazilLegal and unrestrictedA provider outside Brazilian retention obligations.4/4
CanadaLegal and unrestrictedA provider outside the Fourteen Eyes with a kill switch that fails closed.4/4
FranceLegal and unrestrictedA kill switch, and a provider outside the Fourteen Eyes.4/4
GermanyLegal and unrestrictedA verified kill switch and an audited no-logs position — a dropped tunnel is what produces an enforcement letter here.4/4
ItalyLegal and unrestrictedA kill switch, and a provider whose addresses are not themselves caught in blocking orders.4/4
JapanLegal and unrestrictedA network large enough to have local capacity rather than routing you through Singapore.3/4
NetherlandsLegal and unrestrictedA provider incorporated outside the Fourteen Eyes — worth noting that several popular providers are themselves Dutch.4/4
NigeriaLegal and unrestrictedLow cost or a free tier, since foreign card access is a real constraint.2/4
South KoreaLegal and unrestrictedModern protocol support — line speed here is high enough that the protocol becomes the bottleneck.3/4
SpainLegal and unrestrictedA kill switch and a provider outside the blocking jurisdiction.4/4
SwitzerlandLegal and unrestrictedAn audited provider — jurisdiction is already favourable, so the differentiator is evidence.4/4
United KingdomLegal and unrestrictedA provider incorporated outside the Fourteen Eyes, so a UK notice does not reach your VPN records.4/4
United StatesLegal and unrestrictedA provider incorporated outside the United States with an audited no-logs position, if your concern includes domestic legal process.4/4