VPNs with servers in Bulgaria

The amendment published in State Gazette No. 95 of 2025 extended section 251b(2) to proceedings for breaches of article 15 of the Competition Protection Act; the Constitutional Court declared that part unconstitutional in decision no. 8 of 23 June 2026. Whether a VPN operator is a provider within these provisions is not established.

According to the trade publication KIK-Info, the executive director of the National Revenue Agency issues decisions identifying websites that offer gambling without a licence under the Gambling Act. If a site is still accessible in Bulgaria after a three-day deadline, the agency refers the matter to court, and the Sofia District Court then orders Bulgarian internet providers to block access to the pages and their subdomains.

The Criminal Code punishes insult (article 146), defamation (article 147) and preaching or inciting discrimination, violence or hatred based on race, colour, origin, nationality, ethnicity or sexual orientation (article 162(1)).

The retained data include those needed to trace and identify the source of a communication and its destination, its date, time and duration, its type and the user’s equipment (section 251b(1)); section 251i defines them for internet access, email and internet telephony.

In Ekimdzhiev and Others v. Bulgaria (no. 70078/12, 11 January 2022) the Court found a violation of Article 8 as to secret surveillance and as to the retention and subsequent accessing of communications data. It listed among the shortcomings internal rules on storing and destroying surveillance material that are not public, and an initial authorisation of two years for national-security surveillance.

It also found that the oversight system lacked sufficient independence, competence and powers, and that notification arrangements were too narrow. In November 2020 the Constitutional Court had declared unconstitutional as a whole an amendment allowing retained cell-ID data to be used to enforce quarantine measures. The order of the rows is the security score, and a server’s location is not a recommendation.