VPN law by country: where it's legal, where it's policed, where it's banned

Is a VPN legal where you're going? The short answer

In most of the world, using a VPN is completely legal. As of September 2026, only a small group of countries ban or criminalise them — notably North Korea, Turkmenistan, Belarus, Oman, Myanmar and Iran — while a larger group, including China, Russia, Turkey and Pakistan, restricts them heavily by blocking services or fingerprinting VPN traffic. A third group lets you use the tool freely but punishes what you access with it.

The practical rule for a traveller is simple: the VPN app is rarely the problem; using it to break a local law is. The table below sorts notable destinations into four plain-language tiers, and each section underneath explains what the tier means and cites where the rule comes from. For the country you care about most, read the dedicated field guide — the China guide is the deepest, because China is where the questions cluster.

How to read the four tiers

We group countries into four tiers so the risk is legible at a glance. The tiers describe legal exposure and practical friction, not how good any provider is.

• Legal — using a VPN carries no meaningful restriction. This covers most of the world, including the US, Canada, the UK, the EU, Japan and Australia.
• Legal, policed — the tool itself is lawful, but misusing it (reaching banned content, committing an offence) triggers penalties, or some services are blocked. The UAE, Saudi Arabia, India and Egypt sit here.
• Heavily restricted — the state actively blocks VPN services, fingerprints their traffic, or has fresh criminal exposure on the books. China, Russia, Turkey and Pakistan are the headline cases.
• Banned — unauthorised VPN use is illegal or effectively impossible. Iran, North Korea, Turkmenistan, Belarus, Oman and Myanmar fall here.

Tiers are a starting point, not a verdict on your exact situation. A business traveller with a corporate VPN, a journalist, and a tourist streaming a home service face very different risks under the same law.

Countries where VPNs are banned or criminalised

A short list of countries treat unauthorised VPN use as illegal. In Iran, unauthorised VPNs were criminalised in February 2024, punishable by up to a year in prison — even as state blocking pushes much of the population to use them. North Korea has no open internet to reach and treats foreign connectivity as a serious offence. Turkmenistan bans uncertified encryption tools, with reports of multi-year sentences; Belarus has prohibited VPNs and Tor since 2015; Oman permits VPNs only for licensed organisations; and Myanmar's 2025 cybersecurity law criminalises unauthorised use.

If you are travelling to a country in this tier, assume the download and sign-up pages for reputable VPNs are already blocked locally. Install and test before you arrive, and read the country's own guidance — the risk here is real, not theoretical.

Countries that heavily restrict VPNs

Heavy restriction is about friction and instability rather than a tourist being arrested. China's Great Firewall permits only government-approved VPNs; unauthorised ones are technically illegal, but enforcement targets providers and sellers, and no foreign visitor is known to have been penalised for personal use. A draft cybercrime-prevention law published in January 2026 could, if enacted, move personal use toward a criminal framework — a development worth watching (see the China field guide).

Russia had blocked 469 VPN services by February 2026 and began blocking three major VPN protocols in December 2025; since September 2025 individuals can be fined for deliberately searching 'extremist' content, including via a VPN, and advertising VPNs is penalised (source: Human Rights Watch, March 2026). Turkey has blocked more than 27 VPN brands and uses deep-packet inspection to drop standard OpenVPN and WireGuard traffic, though using a VPN is not itself a crime. Pakistan requires VPNs to be registered with the regulator and has throttled unregistered ones.

Countries where the tool is legal but policed

This is the tier most travellers actually encounter, and the one most often misunderstood. In the UAE, the Telecommunications and Digital Government Regulatory Authority confirms that companies and individuals may use VPN technology; what is illegal is using a VPN to commit a crime or mask an IP address to do so, which carries a fine of AED 500,000 to AED 2,000,000 under Federal Decree-Law No. 34 of 2021. In Saudi Arabia, VPNs are lawful for business, banking and privacy, but reaching content banned under the Anti-Cyber Crime Law can bring heavy fines, prison or deportation.

India keeps VPN use legal for individuals, but a 2022 CERT-In directive requires providers with servers in India to log customer data for at least five years — which is why several no-log providers pulled their Indian servers. If privacy is the point, choose a no-log provider based abroad. Egypt has no explicit ban but blocks many services via DPI. The through-line: in this tier, your conduct is what matters. Read the UAE guide and Saudi Arabia guide before you go.

Where VPNs are simply legal

In the United States, Canada, the United Kingdom, the European Union, Japan, Australia and most of the world, using a VPN is legal for personal and business use, full stop. The UK is a useful 2026 example of legal-but-newsworthy: the Online Safety Act's age-verification rules (from July 2025) drove a surge in VPN sign-ups, and Ofcom now bars platforms from actively promoting VPNs as a way around age checks — but nobody is breaking the law by running one. Legality does not mean a free-for-all: local laws on piracy, harassment or fraud still apply whether or not a VPN is involved.

Choosing a VPN where it's legal: country picks

Legal doesn't mean every VPN fits every country. Server cities, local privacy law and the currency you're billed in all change from place to place, so we've ranked providers country by country, with every fact dated.

• Best VPN for the UK: UK server cities, the Investigatory Powers Act and prices in pounds.
• Best VPN for Canada: Canadian servers coast to coast, and why the Five Eyes matter.
• Best VPN for Australia: servers in every mainland capital and the metadata retention law.
• Best VPN for travel: five picks for trips and long stays abroad.

Why VPN rules are tightening in 2026

Two opposite forces are pulling VPN demand and VPN law in 2026, and understanding them helps you read the map. On the demand side, new online-safety and age-verification rules are pushing ordinary users toward VPNs: the UK's Online Safety Act age checks (July 2025) triggered a documented surge in sign-ups, and several US states passed age-verification laws through 2026, with Proton reporting spikes of over 1,000% around some of them. None of that makes VPNs illegal — but it puts them in the political conversation.

On the restriction side, censorship-heavy states are escalating. Russia moved from blocking VPN services to blocking whole protocols and penalising 'extremist' searches; China floated a draft law that could criminalise personal use; Iran criminalised unauthorised VPNs outright in 2024. The pattern is that free and liberal jurisdictions are debating how platforms handle VPNs, while authoritarian ones are closing the technical and legal gaps. For a traveller, the takeaway is that a country's tier can move — usually within the restrictive group — faster than a guidebook can keep up, which is why every entry here is dated.

It also explains a recurring myth worth killing: 'a VPN is illegal now'. In the overwhelming majority of countries it is not, and the 2026 headlines about VPNs are mostly about surging legitimate demand, not new bans. Reserve your caution for the specific restrictive countries, and don't let a scary headline stop you using ordinary privacy software where it's perfectly lawful.

What to look for in a VPN for a restricted country

If you're heading somewhere in the heavily-restricted tier, the single most important feature is obfuscation (sometimes called 'stealth' or 'camouflage' mode), which disguises VPN traffic as ordinary HTTPS so deep-packet inspection can't fingerprint and drop it. Also weigh: a provider that visibly keeps updating to beat new blocks, servers geographically near the country, and a working kill switch so nothing leaks if the tunnel drops.

Among paid providers commonly reported to work behind strong censorship are ExpressVPN and NordVPN (both offer obfuscated servers), with Surfshark and Proton VPN also carrying stealth options — those are affiliate links, and we may earn a commission if you subscribe, which never changes a tier or a fact on this page. Astrill and Mullvad are frequently recommended for China specifically and we earn nothing from either; we name them precisely because independence matters more than a payout here. Results shift week to week as blocks evolve, so treat any 'works in X' claim as dated, not permanent.

Staying on the right side of the law

A short traveller's checklist, wherever you land:

1. Check the destination's current rules from an official source before you travel — this page is a map, not a lawyer.
2. Install and test your VPN before you arrive; provider sites are often blocked once you're inside a censored network.
3. Use a VPN for legitimate privacy and home-service access, never to reach content that's illegal where you physically are.
4. Prefer a provider with an independently audited no-logs policy and obfuscation if you're going somewhere restrictive.
5. Remember a VPN shifts your trust to the provider — it does not make you anonymous or place you above local law.

For the practical side of connecting to home banking, government portals and streaming while abroad, see our VPN for travel guide. For the big picture of who blocks what and why, read internet censorship and digital rights, explained.