VPNs with servers in North Macedonia

The listed data include the name and address of the subscriber to whom an IP address was assigned during the communication. Operators must hand it to competent authorities on request (art. 176(3)); the technical means may not be sited outside the country (art. 176(5)); data is destroyed after the period unless it was accessed and preserved (art. 177). Whether a VPN operator is covered is not established.

In case U.br. 137/2017 (Official Gazette 213 of 17 October 2024) the Constitutional Court opened a review of articles 176–178, finding they lack clear, precise and detailed limits on the intrusion, and gave Parliament six months to amend them. The Court’s review of its 2025 work records that the oldest case it decided that year, received in 2017 and against this Law, ended with the proceedings discontinued.

The Minister of Digital Transformation has ordered public electronic communications networks to restrict access to unlicensed online gambling sites, adding further sites by successive orders.

Causing or inciting hatred, discord or intolerance on discriminatory grounds carries one to five years (Criminal Code art. 319); spreading racist and xenophobic material through a computer system, one to five years (art. 394-d); publicly negating or justifying genocide or war crimes through an information system, one to five years (art. 407-a). Articles 319 and 394-d rise to ten years where an official position is abused or violence or property damage results.

Under article 287(8) of the Criminal Procedure Code, operators must submit retained metadata on a public prosecutor’s request.

In decision U.br. 139/2010 of 15 December 2010 the Constitutional Court annulled provisions of the earlier Law on Electronic Communications that gave the authorised bodies direct access to the content of communications without a firm legal framework, finding insufficient safeguards against abuse. In 2024 it dismissed the challenge to article 175 because it had been deleted when the new Law on Interception of Communications began to apply on 1 November 2018.

A 2021 analysis for DCAF found the parliamentary oversight committee’s powers too limited to review the legality of interception effectively, the Civilian Control Council’s status undefined and so non-functional, and metadata open to inspection without a court order. The order of the rows is the security score, and a server’s location is not a recommendation.