- Not recommended1
Coverage168countries
Paying monthly$11.99monthly
Paying yearly$47.84yearly total
Free tierYeslimited free plan
Devices5at once
7 out of 100Security
77 out of 100Usability
Servers in country
Providers with exit locations in Gibraltar: a server here gives you an address in the country. The register’s table records no mandate for VPN operators here; the briefing below sets out what the law asks of providers.
Only a few providers publish an exit here. Which companies are registered in Gibraltar is a different question, with a page of its own.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
Gibraltar’s Communications (Personal Data and Privacy) Regulations 2006, as amended in 2012, oblige a communications provider to retain traffic and location data for 12 months.
Gibraltar is a British Overseas Territory with its own Parliament; the United Kingdom remains responsible for defence, foreign policy and, through the Governor, internal security.
The Communications (Personal Data and Privacy) Regulations 2006, amended in 2012 to transpose Directive 2006/24/EC, oblige a communications provider to retain traffic and location data needed to identify the subscriber or registered user for 12 months from the communication (regs. 15A–15B). They include the subscriber to whom an IP address was allocated; content is excluded, and the data are destroyed when the period ends (reg. 15C).
The Investigatory Powers Act 2026 (no. 2026-29) defines a telecommunications operator as one who serves persons in Gibraltar or controls a system in or from Gibraltar (s. 3(10)). It takes effect on a day the Government appoints by Gazette notice (s. 1(2)); as of 3 November 2026 it is listed as not in force. Part 7 creates an Investigatory Powers Commissioner. Whether a VPN operator falls within either instrument is not established.
The Communications Act 2006 makes it an offence to send over a public electronic communications network a message that is grossly offensive or of an indecent, obscene or menacing character, or a message known to be false sent to cause annoyance, inconvenience or needless anxiety (s. 45). The penalty on summary conviction is up to six months’ imprisonment or a fine at level 5.
The Crimes Act 2011 makes it an offence to use threatening, abusive or insulting words or behaviour, or to display such written material, with intent to stir up racial hatred, religious hatred or hatred on grounds of sexual orientation, or where such hatred is likely to be stirred up (s. 99). It also contains harassment and stalking offences.
An account is tied to a person through the retained subscriber and IP-allocation data above.
The Constitution Order 2006 protects respect for private and family life, home and correspondence, subject to laws made for the prevention of disorder or crime and other listed aims, unless shown not reasonably justifiable in a democratic society (s. 7).
The Governor, acting in his discretion, is responsible for external affairs, defence and internal security, including the police (s. 47). Appeals run from the Court of Appeal to the Crown in Council (s. 66). The order of the rows is the security score, and a server’s location is not a recommendation.
Gibraltar
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries
