Are VPNs Legal? Your Rights to Using VPNs Explained

In the United States, and most Western democracies, it is perfectly legal to use a VPN. However, they can be associated with illegal online activity and VPNs are not legal in every country. VPN use is banned or heavily monitored in less democratic nations, including China, Russia, and Cuba, and has been recently restricted in India.

In this article, we explain what's legal and illegal about using Virtual Private Networks, and we've created a handy table detailing the legal status of VPNs in a number of countries where the technology is contentious. We've also independently tested the best VPNs, and only recommend VPNs that are safe and legal.

NordVPN is the best VPN by far and, thanks to obfuscated servers, it also hides the fact you're using a VPN, so we'd recommend it if you're in a country where VPN use is restricted. Sister company Surfshark, on the other hand, is equally as safe, and great value for money. Plus, they're currently offering up to 86% off + up to 5 months free.

Disclaimer: This article is not legal advice. It is a resource that has been created using information from publicly available sources.

Page Contents (click to jump):

• Is It Illegal to Use a VPN?
• VPN Legality by Country
• Can You Legally Use a VPN in the US?
• Which VPNs are Legal to Use?
• Where Is It Illegal to Use a VPN?
• What Makes a VPN Safe?
• Why are there Legal Issues Around VPNs?
• Is It Legal for my Business to Use a VPN?
• Can My Employees Use a VPN When Abroad?
• Can You Be Prosecuted for Using a VPN?
• Do I Need a VPN With Obfuscated Servers?
• Your Rights Around Using VPNs
• Verdict: Are VPNs Legal?
• FAQs

Is It Illegal To Use a VPN?

Using a VPN is perfectly legal in most countries, including the US. That doesn't mean that you are free to conduct illegal activities with a VPN enabled. A VPN protects your privacy but does not excuse you from being reprimanded by the law for theft, unlawful purchases, or any other crime as dictated by the laws of the country you are in. VPN use is illegal or heavily restricted in some countries outside of the US.

VPN Legality By Country

*Are VPNs legal in India?

*Although India has not made VPNs illegal, the government recently passed a law requiring tech companies (including VPNs) that process user data (including IP addresses) to store it. This effectively defeats the privacy value of a VPN.

The new law came into force in September 2022. VPN companies including Surfshark, Proton VPN, NordVPN, as well as ExpressVPN and Atlas VPN shut down their servers in the country in response. Some of these providers have since set up virtual servers, which give you IP addresses from a specific country (like India) and will let you unblock geo-restricted content from India, but are based in other countries.

If a VPN company has physical servers on the ground in India today, and claims to keep no logs of user activity, they are either breaking the law or lying. 

In 2023, companies like ExpressVPN and Surfshark instead offer “virtual servers” Indian IP addresses that let you unblock content from India, but aren't physically located there. ExpressVPN's are located in Singapore and the UK, for instance.

**Are VPNs legal in Russia?

VPNs have been closely watched by the Russian government since their usage became widespread. Although they aren't technically illegal, using a VPN in Russia comes with major risks – almost all mainstream providers are effectively blocked or banned.

However, for journalists, activists, and citizens looking up banned information, using a reputable, trusted VPN is still safer than not using one.

Unfortunately, there aren't many reputable VPNs left, for use in Russia. Russia's government takes an authoritarian approach to information and heavily censors citizens' internet usage, and the government has a long history of ordering VPNs to block content from specific websites, as well as blocking VPNs.

In 2019, demands by the government's telecoms watchdog, Roskomador, ordered VPNs to connect to a database of blocked websites or face being blocked themselves. Many did not comply and some, such as ExpressVPN, shut down their servers in Russia. The last few years have seen multiple VPNs banned and blocked in Russia, such as ExpressVPN and NordVPN, as the state becomes increasingly authoritarian.

When Russia invaded Ukraine in February 2022, three things happened. One: VPN usage skyrocketed. AtlasVPN's Russian-originating installation had risen by 11,253% by 14 March 2022, while Top10VPN chartered a more conservative 2,692%. Two: Russia took an even more hardline approach to VPN usage, characterized by many a major crackdown. Three: more VPNs, such as Surfshark, shut down their servers in Russia.

According to Novaya Gazeta, at least 42 VPN providers have bee “blocked,threatened or disrupted” by the Russian government.

This year, the government's anti-VPN onslaught has continued. In April 2023, a campaign was launched warning citizens against using VPNs, claiming the practice poses a security risk.

A recent study from Top10VPN found that Russia now blocks access to VPN websites 32% of the time, the tenth highest of any country.

***Are VPNs legal in China?

Despite the government's attempts to block specific VPNs, using a VPN is still legal in China. There is no actual law that outright bans the usage of VPNs, and it's unlikely there'll ever be a blanket ban, as international businesses that operate in China rely on their VPNs to function.

Tourists who use VPNs are unlikely to be severely reprimanded for it, although may be requested to delete apps off their phones if stopped by law enforcement.

However, it would be wrong to say that the Chinese government is even tolerant of VPNs. You're only allowed to use networks the government approves of, and by that, we mean networks the government has backdoor access to. Plus, when rare spurts of civil unrest occur – like the Zero-Covid protests that took place in December 2022 – the government moves to enforce VPN crackdowns.

According to a recent study, China blocks VPN websites 73% of the time – a higher percentage than any other country in the world.

So, although they're legal, they're not very safe and you shouldn't trust a government-approved VPN. Fines for using non-government-approved services are enforced sporadically.

 Key takeaways…

• You can legally use VPNs in the US – Running a VPN in the US is legal, but anything that's illegal without a VPN remains illegal when using one (e.g. torrenting copyrighted material).
• VPNs providers are banned by a few countries – Some countries, including China, Russia, Iraq, and North Korea, restrict or ban the use of specific VPNs, or the technology in general.
• VPNs use can breach terms of service – It isn't illegal to access services such as Netflix over a VPN, but it does breach their terms of use, and streaming services are getting better at blocking VPNs.
• Law enforcement can demand information – some VPN providers have and will share user information with the authorities when requested, whereas others have been unable to provide it due to their no logs promise.

Need to choose a secure VPN? See all of our expert reviews of the best VPN services to choose.

Is VPN Use Legal in the US?

Yes, there are no laws prohibiting or restricting the use of VPNs in the US and Canada. It’s also legal to use VPNs in many other countries around the world, including the UK, Australia, and Europe (except Belarus). At a basic level, you cannot be prosecuted for simply using a VPN, and thousands of people living in the USA use VPNs on a daily basis.

VPNs are used widely in countries like the US for security reasons. Citizens use VPNs to protect themselves on unsecured, public Wifi networks and from intrusive government surveillance.

There is a multitude of legitimate reasons why you might find a VPN handy. These use cases can broadly be split up into two categories: security/privacy and entertainment. VPNs are used widely by companies and individuals in countries like the US for security reasons and the US government accepts this – which is why it hasn't outlawed them.

Citizens and businesses (‘B‘ denotes a business-specific use case) concerned about their privacy and safety online use VPNs to:

• Protect themselves on unsecured, public Wifi networks
• Shield themselves from government surveillance
• Prevent websites from tracking their every move
• Protect themselves from malicious websites and programs
• Block advertisements on search engines and websites
• Ensure only employees are accessing company networks (B) 
• Transfer sensitive and confidential information (B)
• Whitelist IP addresses for accessing certain networks (B)

VPNs are also used for entertainment purposes. Due to the fact VPNs mask the IP address of users connecting to their servers, Amazon Prime, Hulu, and any other site you visit won't be able to tell where you're located in the world – so you can bypass dreaded ‘this content is not available in your country' screens. On top of movie buffs, US gamers use VPNs for a number of reasons, including:

• Preventing ISP Throttling – some gamers need to hide what they're playing from their internet service provider. ISPs sometimes slow down your internet speeds if they can see you're performing data-intensive tasks like playing a multiplayer online game, which is known as ISP or bandwidth throttling.

• Reducing Ping Time – Gamers use VPNs to reduce ping time, which (in a gaming context) is the time it takes for data to be transmitted between a gamer's console or PC and the gaming server they're connected to. One way this is done is by connecting to a VPN server geographically closer to the gaming server.

This doesn't, however, stop VPNs from being embroiled in court cases and legal quagmires relating to individuals breaking the law whilst using their service. The US Government, for instance, has subpoenaed a number of VPN companies over the years in an effort to obtain activity logs related to criminals. As you can see from this table from US-based VPN Private Internet Access's (PIA) website (last updated in February 2022), it's not uncommon:

When this happens to a reliable VPN provider like Private Internet Access, the company had no logs to give over because, well, they were telling the truth about not keeping any logs. To clarify, the US government was not accusing PIA of any wrongdoing, just someone using its services.

If you're looking for a VPN to use whilst you're in the US, our research has shown that Surfshark is one of the best, thanks to its excellent features and ease of use.

Which VPNs are Legal to Use?

All consumer VPNs are legal to use in countries where VPN usage is legal. Some countries force citizens to register VPNs with the government, such as China, rendering unregistered, consumer VPNs ‘illegal' or at least heavily restricted.

Which VPNs are safe to use is another question entirely. Free VPNs, for instance, usually have a catalog of security issues, shady marketing practices, and sketchy track records that show they don't care about. To take a recent example, free VPN SuperVPN suffered a huge data breach, exposing user records.

For this reason, we recommend sticking to the services we've recommended below.

Free VPNs may look appealing, initially, thanks to their subscription-free service, but you have to ask yourself: how are they making their money? Usually, the answer is concerning. In the past, free VPN companies with millions of unwitting subscribers have been found guilty of:

• Allowing advertisers to harvest customer data (Betternet)
• Stealing bandwidth from users and letting others use it (Hola)
• Logging your activity whilst you use the service (Hola)
• Expose your IP address due to leak (Hoxx VPN)
• Logging activity, getting breached, and exposing it (UFO VPN)

Hola is an interesting case – the free VPN is extremely popular and conducts surveys on internet freedom, but dig a little deeper into its small print and you might be alarmed.

But in their privacy policy, under the section entitled “What types of information do we collect?” the company states that they collect “free users log data” and that it may include “browser type, web pages you visit, time spent on those pages, access times and dates”.

The VPNs we've picked out in the table below, however, have excellent privacy features and won't treat you like a dispensable, sellable data point. All of the VPNs listed below are completely legal to use in countries where consumer VPN usage is not criminalized, restricted or forbidden:

Where are VPNs Illegal?

VPNs are completely illegal in North Korea, Iraq, Turkmenistan, and Belarus. Countries ruled by authoritarian governments that don't consider civil rights and/or their citizen's ability to speak and think freely as important tend to be the ones that ban or restrict VPN use. Citizens of such regimes may try to use VPNs to get around the strict government monitoring of online activities, or the blocking of certain sites. The governments, in turn, block or restrict their use. There are several countries where VPNs are:

• Completely illegal – the four countries listed above all have explicit laws dictating that VPNs are banned and you'll be punished if you're caught using them in these territories. In Belarus, for instance, all online circumvention tools are banned.
• Legal, but must be registered (i.e. self-defeating) – Countries like Oman and Russia technically permit VPN usage, but they have to be government-approved. In somewhere like Russia, companies are regularly forced to give up confidential data and logs at the request of the government, and a lot of consumer VPNs have moved their servers out of Russia for fear of them being seized. The situation has been further worsened by Russia's invasion of Ukraine.
• “Legal”, but redundant – India's new data law, which came into effect on September 25, 2022 (postponed from June 27), requires companies that process citizens' user data to store information like IP addresses. This effectively makes VPNs redundant. So, although India has not enforced a law making VPNs illegal, it has forced requirements that make technology impossible to use in the way it is intended.
• Heavily restricted – In countries like China, even though VPNs are widely used, the government takes steps to prevent citizens from using them, such as removing VPN apps from the China App Store. Similarly, Egypt blocks access to VPN websites to dissuade its citizens from using them, despite the fact they're not technically illegal, as does Turkey.

Unsurprisingly, a number of other countries that scored poorly in our Internet Censorship Rankings attempt to restrict VPN usage. They do this by deploying tactics such as:

• Banning consumer VPNs from app stores
• Tightly policing/banning platforms that host VPN software
• Forcing citizens to register their VPNs with the government
• Blocking as much VPN traffic as possible 
• Attempting to seize servers and obtain encryption keys
• Creating a ringfenced or walled internet (like Russia's Rusnet)
• Arresting individuals that are selling VPN software 

Scroll back to the top of this article and check out the table, where the legality of VPNs from country to country and the reasoning behind their legal status is explained in more detail.

“While VPNs themselves aren’t illegal in the US and many other parts of the world, VPNs are sometimes used by people to disguise the fact that they’re carrying out activities that break the law.”

Despite their illegality in certain territories, activists and citizens still use VPNs because they have few other choices. But that doesn't mean everyone using a VPN is acting virtuously or in a benign fashion.

VPNs and Illegal Activities

While using a VPN itself is rarely unlawful, certain online activities remain illegal, whether you’re using a VPN or not. These may include:

• Illegal file-sharing – Also known as torrenting, this is where users simultaneously download and upload copyright-protected content (such as music, movies, and games) between each other over the internet.
• Hacking – Gaining unauthorized access to computers or networks belonging to other companies or individuals, either to disrupt activity, carry out acts of fraud or steal data, is illegal.
• Buying, selling, or downloading on the dark web – The dark web is an under-the-radar area of the internet, where a great deal of illegal activity occurs, such as buying or selling drugs, weapons, and other illicit materials, or accessing illegal pornography.
• Cyberstalking – It’s illegal to stalk someone online and cover your tracks using a VPN.

What makes a VPN safe?

You might be wondering: why are the above VPNs safe? Just because you pay for a service, doesn't necessarily mean it's secure. Well, there are several key indicators that a VPN is indeed safe. The crucial factors you should be considering when deciding whether a VPN service is safe is:

Encryption standards/protocols. Encryption standards effectively determine how a VPN protects your data when you're using their servers. AES 256-bit encryption is the industry standard. There is no known threat or attack that can break it, hence its use by the US military and other governments. The 256 is the encryption key size. You would need more resources than governments have at their disposal – including mammoth supercomputers that don't yet exist – to break this encryption. If a VPN isn't using this standard, think twice.

Company history. This is quite important because it gives you a flavor of a company's approach to their own security, their user's security, and their server infrastructure. For example, it's good to know whether a VPN has suffered a data breach and, if it has, how it responded to it. Some VPNs, like NordVPN, have had scares in the past, but have responded well and improved their security. Others – especially a lot of free VPNs – have not done so well.

A clearly stated no logs commitment. You need a VPN with a commitment to keeping no logs of your activity – no ifs, no buts. In this regard, a VPN's privacy policy can be telling. Often, shady providers will sneak something about actually keeping logs or collecting information in their somewhere – if someone wants to sue, they can point to the privacy policy and say it's clearly stated in the public domain.

We mentioned Hola VPN's privacy policy earlier – this is a prime example of a bad privacy policy. NordVPN, on the other hand, has a great privacy policy, which emphatically states:

“We do not log users’ browsing history, traffic information, or IP addresses used to access the internet via our services. This means that we are not able to link shared IP addresses of VPN services to an individual user or otherwise individual users based on data that we do not process” -NordVPN Privacy Policy.

Transparency reports and audits. It is effectively now the industry standard for VPN companies to release transparency reports, and some companies even ask independent firms to audit their apps and programs. For example, in March, ExpressVPN asked F-secure to perform a penetration test on the provider's windows app. Private Internet Access release transparency reports every year. If you can't find any evidence a VPN has undergone an audit or released a transparency report, beware.

“Additional” security features. by “bonus” we mean additional security features on top of the basic VPN mission statement to encrypt your data and mask your IP address. For example, NordVPN and Surfshark – who merged this year into one company in February – both have tools that alert users to potentially malicious websites. It's not essential, but it's nice to have.

Other important questions

Other important questions you might want to consider before you purchase a VPN include:

• Does the VPN consistently pass leak (DNS and WebRTC) tests?
• Does the VPN make outlandish claims, such as keeping you completely ‘anonymous'? (this is not possible with a VPN)
• Does the VPN have bad ratings and reviews circulating about it online?
• Who owns the VPN provider? What is their company history like?

Why are there Legal Issues Around VPNs?

VPNs use encryption to make your connection to the internet private. By using a VPN, you can make yourself anonymous online and mask your browsing activity. For this reason, VPNs are sometimes used by people to disguise the fact that they’re carrying out activities that break the law.

However, the vast majority of VPN users aren't breaking the law, and are just performing one of the many legitimate tasks a widely-used provider like NordVPN can help you with, from preserving their own privacy to streaming sports.

To complicate matters further, if you use a VPN to make it look as though you’re located somewhere else in the world while you’re online, you could find that your online activities are bound by the laws of the country where the server is situated – not just by the laws of the country you’re really accessing the internet from.

VPNs violate websites' Terms of Service

In short, VPNs are legal for Netflix – you're not breaking the law if you use a VPN for Netflix. It's important to note, however, that VPN users can and regularly do breach the Terms of Service of various websites, especially streaming services like Netflix.

“In some cases, use of a VPN can breach your terms of service for a platform (such as Netflix), rather than the law itself.”

VPNs can be used to make it appear as if you’re located in another country by routing your connection through a proxy server that’s physically situated abroad. If you’re doing this in order to access a service that’s geo-locked to a specific country – for example, if you wanted to stream US Netflix while you’re not in the US – you'll violate Netflix's terms of service:

As we covered, importantly it's not illegal. But if you use a VPN to access Netflix, such as PureVPN, from within a country where the service doesn’t currently operate, you are effectively in breach of contract.

Netflix reserves the right to “terminate or restrict your use of our service if you violate these Terms of Use or are engaged in illegal or fraudulent use of the service”. However, this is highly unlikely to happen to you as millions of people use VPNs to access Netflix US and other libraries from different territories, and there's little evidence that Netflix has – or can – even do this to an individual.

What Netflix and other streaming services are doing at an increasingly frequent rate, however, is blocking the IP addresses known to belong to VPN servers. That means, unfortunately, that not all VPNs can access Netflix successfully – so if that's a priority for you, check out our round-up of the Best VPNs for Netflix.

Is It Legal for my Business to Use a VPN?

Yes, your business can (and should!) use VPNs legally. There's just one caveat here, which is that any business operating within the list of countries that have banned VPNs will not be able to use VPNs.

In countries like China, for instance, VPNs are widely used despite the government's aversion to them because blanket banning them completely would be economic suicide – many foreign businesses would leave the country.

Business VPNs are useful for connecting to a corporation's internal network as well as to the public internet, making them the perfect tool for employees working remotely who regularly need to access company files and other confidential documents. top-of-the-range Business VPNs like NordVPN's Nordlayer can also serve to build an ironclad internal network across multiple offices. Whether it's business or consumer-focused, however, there are tonnes of benefits of using a VPN:

Can My Employees Use a VPN When Abroad?

In most cases, a business's employees can use a VPN when working in another country. But it depends on the country. If it's legal in the country, we'd highly recommend the practice: It'll keep your employees' private data safe while they're on otherwise unsecured networks.

If your business is expanding to a new country, getting to grips with the specific rules and regulations relating to VPN use is essential.

However, it must be stressed that the legal status of VPNs in each country is unique and will exist against a backdrop of historical government action (or inaction, in nations where VPN use is legal and unrestricted) against providers and individuals using their software, and this will be used to sculpt future policy relating to the technology. For the purpose of simplicity and clarity, we've organized the attitudes of certain countries into broad categories like ‘heavily restricted', but really, every territory will have its own story.

If you're expanding your business to a new country or territory or thinking of setting your employees already working abroad up with a business VPN, getting to grips with the rules and regulations of that territory specifically is essential.

Countries Where VPNs are Restricted But Not Illegal

This includes places like China, which doesn't like the fact its citizens and businesses operating in the country use VPNs, but essentially tolerates their existence in society due to the catastrophic effects a ban could have on international business.

Indeed, China has a repuation for going easier on VPNs when used for international business. Employee VPN usage for business purposes will require employees to know the ins and outs of Chinese laws relating to VPNs, so they know what they can and cannot do. In all cases when visiting a country known for restricting VPN use, it's best to check with someone in the know before firing up a top business VPN provider like PureVPN Teams.

Countries Where VPNs Are Illegal

Countries where VPNs are outright illegal are typically run by governments that foster a generally hostile or difficult environment for foreign (and sometimes all) businesses and their employees to operate in, like Belarus or Iraq.

In these sorts of territories, there will likely be additional, non-VPN-related rules and regulations that break from the common corporate practices of places like the US or ongoing, violent conflicts/civil and political unrest that will need careful consideration upon approach. In fact, if you're either already operating in a territory like this or planning to, whether VPNs are illegal or not may be the least of your worries.

If VPN usage is essential to your business, but your staff could end up in jail for simply using them in a territory you're operating in, then you have to ask yourself: ‘can I conduct/continue business operations in this territory without a VPN?' If the answer is no, there are only two options: provide employees with sufficient information and resources to perform their jobs safely and in line with local laws, but without a VPN, or cease business operations there.

Can You be Fined or Prosecuted for Using a VPN?

Unless you live in a country where VPNs are banned or restricted, you won’t face a penalty for using a VPN. However, in the US and other countries where VPNs are allowed, you could face prosecution for any unlawful activities you carry out while using a VPN.

Using a VPN may not provide you with any protection in criminal cases, either. Many VPNs – including some that claim not to keep any logs – retain some information about their users and may reserve the right to provide this and any other relevant data to authorities, if requested. Market-leading VPNs that definitely don't log your activity whilst you use their service sometimes retain other types of data to perform things like troubleshooting:

We collect information about whether you have successfully established a VPN connection on a particular day (but not a specific time of the day), to which VPN location (but not your assigned outgoing IP address), and from which country/ISP (but not your source IP address). This minimal information assists us in providing technical support.” – ExpressVPN privacy policy

Court documents show that VPN provider logs have been used in at least two recent cases (United States of America vs Ryan S Lin and United States of America vs Suzette Kugler) to track and prosecute individuals for illegal activities carried out online while using a VPN.

Do I Need a VPN With Obfuscated Servers?

Yes, it's definitely recommended that you use VPNs with obfuscated servers in a country where VPN usage is restricted or illegal like China.

One of the ways that VPN-averse governments enforce restrictions or bans on the technology is to identify traffic coming from or going through VPN servers and block it. Remember, VPNs may decouple your IP address from your internet activity, but your ISP or government would still be able to see you're using a VPN if it wanted to, just not what you're doing whilst you use it

How do they do this? Well, an ISP could perform deep packet inspection (DPI) on your traffic, which is a data process that entails viewing, in great detail, all the packets of data being sent over a computer network. Firewalls deployed by businesses and governments – and anyone else wanting to assert control over a given network – have the ability to perform Deep Packet Inspection too.

Stealth or obfuscated servers essentially scramble the metadata relating to your traffic to the point where it no longer looks like VPN traffic and instead mimics normal traffic

VPN traffic is encrypted, whereas normal traffic isn't, so it's quite easy to differentiate between them with a process like DPI. If you're connected using the OpenVPN protocol, for example, your packets of data will have the OpenVPN signature attached to them, so your ISP could see you're using a VPN.

However, a trend that is now quite widespread in the VPN industry is the provision of obfuscated servers and protocols. These stealthy servers essentially scramble the metadata relating to your traffic to the point where it no longer looks like VPN traffic and instead mimics normal traffic. VPN companies call the technology they use to do this different names, but they all do the same thing.

So, if you're in a country that has restrictive VPN laws and you have to use a VPN, make sure it's a provider like NordVPN or Surfshark that has obfuscated servers or protocols available, so anyone looking at your traffic with just think you're using connecting to the internet normally.

If you're in such a country and you think Surfshark is the provider for you, it's probably worth investing in Surfshark One. Surfshark One is a one-stop-shop cybersecurity solution that includes a VPN, Antivirus, a safe search tool, and data breach alerts – a service Google One VPN now also provides. Starting from only $1.19/month on top of your VPN subscription or $3.49/month as a standalone product, it'll ensure you're connected and protected, wherever you are.

Your Rights Around VPNs

Your rights vary depending on several factors, including the terms of service offered by the VPN you’re using, the country you’re using the VPN in, and the terms and conditions of any services you access while using a VPN.

Before you sign up with a VPN, check its terms of service and its privacy policy to make sure you’re happy with them first.

Most VPNs will make it clear that carrying out illegal activities is not allowed and that users must assume all liability for any criminal behavior. You will also usually find a clause stating how a given provider deals with legal requests relating to a suspected fraudulent, abusive, or illegal and indications about the relationship the VPN company maintains with law enforcement authorities.

Before you travel abroad, always make sure you check to see whether or not VPNs are legal in the country you’re visiting. If you’re traveling to a country where VPNs are illegal or restricted, you’ll need to disable any VPNs on your devices.

Ready to choose a VPN? Check our VPN comparison table to help you pick a fast, secure VPN service

FAQs