VPNs with servers in Albania

For internet communications the files hold the user identity, the name and address of the subscriber or registered user to whom an IP address was assigned, and the dates and times of log-in and log-off. Some of this applies only to the extent the provider itself creates, processes and stores the data within its jurisdiction (art. 160(5)).

The files are kept under the personal-data legislation, made available without delay, on request, to the authorities named in the Code of Criminal Procedure, the courts, the prosecution and other public bodies the law empowers, and destroyed when the period ends (art. 160(6)–(8)). Whether a VPN operator is an operator of a public electronic communications service within this article is not established.

Council of Ministers Decision No. 151 of 6 March 2025 ordered the interruption of access to TikTok across Albania for up to twelve months. The government repealed it by Decision No. 62 of 3 February 2026, and access resumed with keyword filters and reporting arrangements agreed with the platform.

The Criminal Code makes intentional insult of a person a criminal misdemeanour punished by a fine (art. 119), as does libel, the spread of statements known to be false that harm a person’s honour (art. 120). Distributing racist or xenophobic material through computer systems (art. 119/a), and publicly insulting a person through one because of ethnicity, nationality, race or religion (art. 119/b), carry a fine or up to two years’ imprisonment.

An investigation can reach the account holder through the files of article 160 of the communications law, which the authorities named in the Code of Criminal Procedure may demand and which record the name and address of the subscriber assigned an IP address.

On 11 March 2026 the Constitutional Court, on an application by the Association of Journalists of Albania and BIRN Albania, found that applying the TikTok restriction violated freedom of expression and of the press. It held that the laws relied on gave the Council of Ministers no clear, specific and foreseeable authorisation to suspend a platform for all users, accepted the aim of protecting children, and found the measure disproportionate.

Article 158(2) of Law No. 54/2024 prohibits all forms of surveillance, interception, recording and storage of communications and traffic data, save what message transmission requires and the cases the law provides. The order of the rows is the security score, and a server’s location is not a recommendation.