VPNs with servers in Honduras

Providers and users holding public IP addresses from which private addresses derive must record who used the service, by date and time, for at least thirty days, and CONATEL keeps a register of those holders (art. 37). Companies must adapt their systems to capture and divert communications (art. 38), and may not tell a subscriber that interception is under way (art. 51).

Decree 84-2026 (22 May 2026) obliges network, communications and banking companies to supply what a court requires, within 24 hours for interception (art. 3), and to keep permanent units answering in real time at the Public Prosecution’s request. It amends Penal Code art. 522 to fine communications companies that wilfully fail to register, verify, keep or update customer data. Whether a VPN operator is a communications provider under these provisions is not established.

The Penal Code restricts speech through the offences of injuria and calumnia.

The Penal Code keeps the offences of injuria and calumnia. Calumny is falsely attributing a crime knowing it is false or with reckless disregard for the truth.

Interception under the 2012 law is a court matter: the Interception Unit (UIC) executes court-ordered interceptions (art. 23), a guarantee judge assigned by the judiciary and a prosecutor take part in every one (art. 34), and an order lasts at most three months, renewable for up to three further periods (art. 32). The UIC sits in the Directorate of Investigation and Intelligence, under the executive’s National Defence and Security Council (art. 33).

The 2012 law’s recitals cite art. 100 of the Constitution, which recognises the inviolability and secrecy of communications, postal, telegraphic and telephonic above all.

Decree 84-2026 followed a Supreme Court opinion of 16 March 2026 that, in the decree’s own recital, backs most of its reforms and lists arts. 373, 374, 375 and 522 among them, but not art. 587 on terrorist association; the Committee for Free Expression says the decree sets no external oversight of its data access. The order of the rows is the security score, and a server’s location is not a recommendation.