VPNs with servers in Estonia

The data are kept for one year from the communication, in the territory of an EU member state. The Government may extend the period for a limited time in the interest of public order and national security, notifying the European Commission. Whether these duties reach a VPN operator is not established.

As of July 2026, according to the news service ERR, the Minister of Justice and Digital Affairs sent the government a draft law that would end general and uniform retention of telephone and mobile traffic and location data and keep general retention only of data identifying a user and IP-address data; the ministry withdrew the draft for further work.

Under § 56 of the Gambling Act the Tax and Customs Board can issue a precept to providers. A provider of public internet access must block the domain name of an unlicensed remote gambling operator in its name servers, and a hosting provider must remove the information or block access to it. Under § 56¹ a payment service provider must stop debiting and crediting an account used to organise unlicensed remote gambling.

Section 151 of the Penal Code punishes publicly calling for hatred, violence or discrimination on grounds such as nationality, race, language, origin, religion, sexual orientation or political opinion, where this endangers life, health or property: a fine of up to 300 fine units or detention. Where death, harm to health or other grave consequences follow, or the offender has a previous conviction, the penalty is a fine or up to three years’ imprisonment.

A telecommunications undertaking must answer an authority’s inquiry about the retained data within ten working days, and urgent inquiries within ten hours where possible (§ 112), which is how an account behind a post is traced to a subscriber.

In case C-746/18 (2 March 2021), referred by the Estonian Supreme Court, the Court of Justice held that access to traffic and location data in criminal proceedings must be confined to serious crime, and that national law may not give the public prosecutor’s office, which directs the pre-trial procedure, the power to authorise that access.

On 18 June 2021 the Supreme Court (case 1-16-6179) held § 111¹(2) of the Electronic Communications Act and § 90¹(2) of the Code of Criminal Procedure in conflict with EU law, disapplied them without constitutional review, and ruled the telecommunications evidence in that case inadmissible, stating that general and indiscriminate retention of telecommunications data is not allowed.

The order of the rows is the security score, and a server’s location is not a recommendation.