Coverage91countries
Paying monthly$12.99monthly
Paying yearly—no yearly plan
Free tierNopaid plans only
Devices7at once
21 out of 100
Security
69 out of 100
Usability
Servers in country
The law in China puts a VPN provider with servers in the country under obligations to the state — keeping records about its users, registering, or giving the authorities access. On record here: Cybersecurity Law; operating a VPN requires a licence.
Some of the providers listed here say they removed their physical servers and serve the country from hardware elsewhere; each row carries the provider’s own answer.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
An exit here is under a retention mandate. Cybersecurity Law; operating a VPN requires a licence. From the contract's country table — the same field that marks a country on a record's own list.
Operating a VPN in China requires a licence, and using an unlicensed one to reach the outside internet can bring a police fine; an exit standing here stands under the Cybersecurity Law's logging and identity rules.
The Cybersecurity Law, in force since June 2017 and amended from 1 January 2026, requires network operators to keep network logs for at least six months (article 21 of the 2017 text) and to verify a user's real identity before providing access. The Data Security Law and the Personal Information Protection Law of 2021 govern what is collected and whether it may leave the country.
A cross-border VPN is a licensed telecom business: the MIIT notice of January 2017 forbade setting up or renting channels, VPNs included, for cross-border business without the ministry's approval.
Every connection abroad must pass through the state's gateways: article 6 of the State Council's 1996 Interim Provisions on international networking forbids any unit or individual to set up or use another channel. The MIIT's campaign of 2017–2018 turned that against unauthorised VPNs.
Google, Facebook, YouTube and X are unreachable, and every language edition of Wikipedia has been blocked since April 2019.
Yes. Online speech is prosecuted as “picking quarrels and provoking trouble” (Criminal Law article 293) and as defamation; a 2013 judicial interpretation treats a defamatory post viewed 5,000 times or reposted 500 times as serious. Selling VPN access is prosecuted too: in 2017 a Guangxi man was sentenced to five and a half years for running an unlicensed VPN, as illegal business under article 225.
Police have also fined individuals for using one, under the 1996 provisions. Real-name rules tie the account to an identity.
An exit in China is an exit under the Cybersecurity Law: logs kept for six months, a user verified by name, and a cross-border channel the state must have licensed. Five of the 77 records publish an exit here.
The register marks the mandate on a record's own country list, and the order of the rows is the security score — reach is a usability fact, not a recommendation.
China
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries
Each of the five providers with an exit here names this country under a mandate in its own record (C09_mandate_countries).
What moved
Every row is the record’s own history[], filtered to U02_server_countries and P04_mandate_response; the whole log holds every field.
29 Aug 20261 changes
ExpressVPNResponse to a national logging mandateP04_mandate_response
not on the record changed to withdrew_physical
Coverage91countries
Paying monthly$12.99monthly
Paying yearly—no yearly plan
Free tierNopaid plans only
Devices7at once
Security
Usability
Coverage91countries
Paying monthly$11.95monthly
Paying yearly$47.88yearly total
Free tierNopaid plans only
Devicesunlimitedat once
Security
Usability
Coverage106countries
Paying monthly$14.99monthly
Paying yearly$59.85yearly total
Free tierNopaid plans only
Devices10at once
Security
Usability
Coverage80countries
Paying monthly$12.99monthly
Paying yearly—no yearly plan
Free tierYeslimited free plan
Devices10at once
Security
Usability
