VPNs with servers in Germany

A bill introduced on 19 June 2026 (Bundestag Drucksache 21/6581) would add a § 177 TKG: internet access providers would store the public IP address assigned to each subscriber, with port numbers and timestamps, for three months. It names only access providers, about 700 companies. After a first reading on 24 June 2026 it went to the Legal Affairs Committee, which heard experts on 7 October 2026; they divided.

Separately, § 170 TKG requires anyone operating a telecommunications installation used for publicly available services to keep facilities for lawful interception. Whether a VPN operator falls under either provision or the bill is not established.

The main blocking mechanism is the CUII, a clearing house set up by rights holders and internet access providers. Where its review committee accepts a copyright claim, access providers set up a DNS block without a court order, once the Federal Network Agency has assessed the recommendation against net-neutrality rules. A court can still review any block.

Yes. The Criminal Code punishes incitement to hatred (§ 130, three months to five years) and insult (§ 185: up to one year, or up to two years if done publicly or by spreading content).

Where an act is aimed at people in political life and is likely to hinder their public work, § 188 raises insult to up to three years, defamation to three months–five years and slander to six months–five years.

To identify an account holder, § 100j of the Code of Criminal Procedure lets investigators demand subscriber data from telecommunications and digital-service providers, including by an IP address assigned at a given time; such a request is recorded in the file and the person concerned is in general notified, and a court order on the prosecutor’s application is needed only where the data sought protect access to devices or storage.

The Federal Constitutional Court held on 19 May 2020 (1 BvR 2835/17) that the foreign intelligence service (BND) is bound by the Basic Law when monitoring foreigners abroad, and that its surveillance powers are proportionate only with independent oversight: a court-like body with binding powers and an administrative body able to audit on its own initiative.

§ 41 BNDG now sets up an Independent Control Council as a supreme federal authority, bound only by law and not subject to instructions. Under § 15 of the G 10 Act, a restriction on telecommunications secrecy takes effect only after the independent G 10 Commission has approved it. The order of the rows is the security score, and a server’s location is not a recommendation.