VPNs with servers in Italy

Separately, the Interior Minister or the heads of the central specialist police offices may order providers and operators of telephone, IT or telematic services to preserve traffic data for up to 90 days, extendable to six months in all. Providers must comply without delay and keep the order confidential; it goes to the public prosecutor within 48 hours for validation.

Article 174-sexies of Law 633/1941, inserted in 2024, names VPN providers: they must report copyright offences, unauthorised access to a computer system and computer fraud to the judicial authority or police, designate a contact point with AGCOM and, outside the EU, a representative in Italy; omission carries up to one year’s imprisonment. Article 132 does not mention VPNs, and whether a VPN operator is a provider under it is not established.

Law 93/2023 empowers the communications regulator AGCOM to order service providers, network access providers included, to disable access to unlawfully distributed protected content; the regulator runs this through a platform.

The text in force since 9 October 2024, after Law 143/2024, also names VPN providers and publicly available DNS providers “wherever resident and wherever located”, and sets a maximum of 30 minutes from notice for the block to take effect.

Defamation is a crime under article 595 of the Penal Code: up to one year’s imprisonment, up to two if a specific fact is attributed, and six months to three years, or a fine of at least €516, when committed through the press or “any other means of publicity”. Stalking (article 612-bis) carries one to six years and six months, more when done through IT or telematic means.

To obtain retained traffic data, a court authorises access under article 132(3) of the Privacy Code, on the public prosecutor’s request or the petition of the defence or another party.

In Procura della Repubblica presso il Tribunale di Bolzano (C-178/22, 30 April 2024) the Grand Chamber of the EU Court of Justice held that EU law does not preclude Italian rules under which a court authorises access to retained traffic or location data for offences punishable by at least three years’ imprisonment, while the court may refuse access where the offence is manifestly not serious.

According to press accounts of its June 2025 report, COPASIR, the parliamentary committee overseeing the intelligence services, concluded that the services’ use of Paragon’s Graphite spyware against two activists was in line with the law. Citizen Lab confirmed the spyware on the phones of a journalist and those two activists. The report says the contract was suspended on 14 February 2025 and later cancelled.

The order of the rows is the security score, and a server’s location is not a recommendation.