Explainer
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
In most of the world, using a VPN is legal. Companies rely on them every day, and in most countries no law singles them out.
A short list of countries is different. They license VPN services, prohibit unlicensed ones or block them. Separately from all of that, a VPN changes nothing about whether what you do through it is legal.
This page describes where the law stands. It is not legal advice, and laws change. It does not explain how to get around a national block, and nor does anything else on this site.
"Is a VPN legal?" can mean three different things, and the answers can differ within one country.
The third question is the one a reader in another country is most likely to overlook. Choosing an exit in a country also means choosing the rules that server operates under.
These are the countries where the register's table records a mandate. The list is not complete, and absence from it says nothing about a country's law. Most other exit countries have a briefing on their own page, under VPN servers.
| Country | Using a VPN | What else applies |
|---|---|---|
| China | Using an unlicensed one to reach the outside internet can bring a police fine | Operating a VPN requires a licence |
| Iran | Using an unlicensed one is prohibited, though the rule names no penalty for the user | Licensed networks must keep user records and stay open to interception |
| Russia | Not itself an offence | The state blocks services that will not serve its blocklist; retention and interception rules apply to exits |
| Belarus | Not itself named as an offence | Anonymisers have been on the blocking list since 2015; operators must identify users and log sessions |
| Kazakhstan | Not itself an offence | The authorities block VPN services; a two-year retention rule applies to exits |
| Turkey | Not itself an offence | Access to some services has been blocked; a retention law applies to exits |
| United Arab Emirates | Legal; using one to commit or conceal a crime is an offence | Services whose purpose is reaching blocked content are blocked |
| Vietnam | Not itself an offence | User data must be kept in the country and handed over on request |
| Iraq | No statute makes it an offence | Licensed operators must keep records for the authorities |
| India | Legal | Since 2022, a provider keeping hardware there has obligations about what it holds on users |
Each row is a summary, and "not itself an offence" is a narrow statement. In several of these countries, what people read or say online can be prosecuted whatever tool carried it. The country pages cover that under their own headings.
Where a provider is registered decides whose orders it must answer. Where its exit stands decides what that server must keep. A record states both, and they are different facts: jurisdiction covers the company, and server countries cover the exits.
If either matters to you, read it on the provider's record, along with what the provider keeps. A legal right to use a VPN does nothing to limit what a provider can be ordered to hand over.
In most countries, no. Where the law does reach users, it varies: some countries prohibit unlicensed services, and penalties differ from none named to a police fine.
Check the law of the country you are physically in, and take local legal advice if the answer matters to you.
No. The law that applies to what you do does not depend on the address a website sees. An act that is an offence without a VPN is an offence with one, and in some countries using one to commit or conceal a crime is an offence of its own.
That is usually a question of the service's terms rather than criminal law, and the terms commonly forbid it. The likely consequence is that the service blocks the address or acts on your account, so read the terms of the service you use.
Next
Every explainer ends by naming the pages that own what it only touched.
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.