VPNs with servers in Belgium

Operators may also keep traffic data for four or twelve months, depending on the category, against fraud, malicious use and threats to network security (article 122). Whether a VPN operator is such a provider is not established.

The Constitutional Court has asked the Court of Justice about these rules (case C-661/24). As of 4 November 2026, the Advocate General’s proposal of 3 September 2026 is that EU law precludes several of them, among them rules that leave providers to choose which data to keep and to extend the period.

The Gaming Commission keeps a blacklist of unlicensed online gambling sites and asks access providers to block them; a visitor to a listed site is shown a page saying it is illegal. On 13 April 2026 the president of the Dutch-speaking Business Court of Brussels ordered two gambling sites blocked, with the order reaching the infrastructure that serves them: access providers, content-delivery networks, search engines and DNS resolvers.

The Criminal Code of 1867 was replaced on 1 September 2026 by a new Criminal Code, which, according to the Federal Public Service Justice, takes up offences that special laws such as the anti-discrimination laws had created. Its scale has eight penalty levels; level 1, where defamation offences such as laster and smaad sit, carries no prison sentence.

To identify an account holder, article 46bis of the Code of Criminal Procedure, as amended by article 26 of the 2022 Act, lets the investigating authority require operators to identify a subscriber or user. An investigating judge may demand traffic or location data going back twelve months for the offences the article names first, nine months for other listed serious offences, and six months otherwise (article 88bis).

In judgment no. 57/2021 of 22 April 2021 the Constitutional Court annulled the Act of 29 May 2016 on the collection and retention of electronic communications data, following the Court of Justice’s judgment in La Quadrature du Net of 6 October 2020.

The 2022 Act was the legislature’s answer, and access to retained data runs through a prosecutor’s reasoned written decision or an investigating judge’s order (articles 39quinquies and 88bis).

The order of the rows is the security score, and a server’s location is not a recommendation.