VPNs with servers in Finland

Content and browsing data are excluded; use is limited to offences listed in chapter 10, section 6(2) of the Coercive Measures Act.

Every telecommunications operator must supply authorities free of charge with information needed to investigate and prevent offences, and must take measures that allow interception as provided by law (section 323). A ministry memo of October 2024 sets out options for clarifying section 157 in light of EU case law. Whether a VPN operator or server host is a telecommunications operator under these sections is not established.

A court may order a hosting service to disable access to information whose public availability or transmission is clearly punishable or a basis for civil liability (section 185). The host and the content provider may seek reversal of the order within 14 days of learning of it.

A host is exempt from liability only if it acts to disable access on a court order or on actual knowledge of content apparently contrary to chapter 11, sections 10 or 10a, or chapter 17, sections 18 or 18a, of the Criminal Code (section 184). Copyright holders may ask a host to prevent access after first approaching the content provider (section 189).

Agitation against a population group (Criminal Code chapter 11, section 10) is prosecuted. In KKO:2026:27 (26 March 2026) the Supreme Court convicted two people over a booklet published online that insulted homosexuals as a group, imposing 20 day-fines each and a €5,000 corporate fine on a foundation, and dismissed the charge over a separate social media post.

A suspect’s network address can be traced by traffic data monitoring under chapter 10, section 6 of the Coercive Measures Act, available for offences carrying at least four years, or at least two years where committed using a network address. A court decides on a police officer’s request, and in urgent cases the officer may start and must refer the matter to the court within 24 hours (section 9).

Network traffic intelligence under Act 582/2019 is decided by a court on the written request of the Director of the Finnish Security and Intelligence Service, for up to six months at a time (section 7), and may not become general and indiscriminate monitoring of traffic (section 1). In urgent cases the Director may decide first and must refer the matter to a court within 24 hours (section 9).

The Security and Intelligence Service informs the Intelligence Ombudsman of requests and court decisions (section 26), and the Interior Ministry reports annually on the use of the method to the Parliamentary Ombudsman, the Intelligence Oversight Committee and the Intelligence Ombudsman (section 25).

The order of the rows is the security score, and a server’s location is not a recommendation.