VPNs with servers in Lithuania

Under art. 78(5) these data are kept for six months from the communication, and location-area data for two months. Access rules sit in the laws on intelligence, criminal intelligence and criminal procedure.

According to a 2023 French Senate report, no legislative change followed the Court of Justice’s La Quadrature du Net judgment of 6 October 2020; an expert group was formed to assess its effect and no amendment was planned. Whether a VPN operator is a provider bound by the retention duty is not established.

According to the Gaming Control Authority, article 207(1)(2) of the Gaming Law lets it give mandatory orders to public electronic communications service providers to remove access to information used for illegal gambling. The Baltic Times reports that the authority maintains lists of unlicensed operators’ domains, which providers must block.

Defamation (art. 154 of the Criminal Code), spreading false information that could humiliate another person or undermine trust in them, carries up to one year; up to two years where it falsely alleges a serious or very serious crime or is committed through the media or in print. Proceedings start only on the injured person’s complaint, a statement of a legal representative or a prosecutor’s demand.

Publicly inciting violence against a group or a person on a protected ground, such as race, religion or sexual orientation (art. 170), carries up to three years.

According to the French Senate’s 2023 report, access to retained traffic and location data is subject to prior judicial control, while access to subscriber identification data is not subject to prior review. Intelligence activity is scrutinised by the Seimas committee on national security and defence and by the Seimas-appointed Intelligence Ombudspersons.

That scrutiny has been tested in court: the Ombudsperson’s office and the State Security Department disagreed over the information an inquiry could obtain under the Intelligence Law; on 19 June 2025 the Regional Administrative Court ordered the department to reconsider, and on 16 July the department replied that nothing new warranted a change. The order of the rows is the security score, and a server’s location is not a recommendation.