VPNs with servers in Costa Rica

A bill amending the General Telecommunications Law (No. 8642), file 24.170, would let the Public Prosecutor, and by delegation investigating police, require operators to supply national and international traffic, geolocation and public and private IP addresses, including in real time.

As of 4 November 2026 the bill is listed as reported out of committee. In its committee text of May 2025, operators must keep this information for three years, with one year to adapt their infrastructure, and refusing a judicial request would be a very serious infringement. Whether a VPN operator would count as an operator under the bill is not established.

The Penal Code restricts content through the offences of insult (art. 145), defamation (art. 146) and slander (art. 147).

The Penal Code punishes insult with 10 to 50 day-fines, 15 to 75 if public (art. 145), defamation with 20 to 60 (art. 146) and slander with 50 to 150 (art. 147). Impersonating a person, a company or a trademark on any social network, website or electronic medium carries one to three years in prison (art. 230).

Interception to identify a poster needs a judicial order under the 2024 law described below.

Law No. 10500 of 2024, published in La Gaceta No. 137 on 26 July 2024, amends the interception law (No. 7425). A judge orders interception by reasoned resolution on the request of the Attorney General or prosecutors he expressly delegates, and carries out the step personally, save in exceptional cases. Requests are decided within three calendar days, five in organised-crime cases.

An order lasts up to four months, with at most two extensions of equal length and a ceiling of one year. In terrorism and drug-law investigations, technical information about an interception, but not its content, is shared with the judicial investigation police (art. 28 bis). The order of the rows is the security score, and a server’s location is not a recommendation.