VPNs with servers in Portugal

On 4 December 2023, in Acórdão 800/2023, the Court, at the request of the President of the Republic, found unconstitutional Decree 91/XV’s amendment of article 4 read with article 6 as to the data listed in article 6(2), and did not find the other norms under review unconstitutional. Lei 18/2024 of 5 February 2024, in force the next day, then amended Lei 32/2008.

Under Lei 32/2008 as Lei 18/2024 rewrote it (article 6), providers of publicly available electronic communications services or public networks must keep subscribers’ civil identification data, other basic data and the IP addresses assigned to a connection’s source for one year. Traffic and location data may be kept only on judicial authorisation, as long as strictly necessary. Whether a VPN operator is a provider bound by these rules is not established.

Under Decree-Law 66/2015 of 29 April the right to operate online games and betting is reserved to the State and granted by licence (articles 8 and 9). Within 48 hours of notification that an unlicensed operator is offering such games, internet intermediaries must follow the regulator’s instructions to bar access, including by interrupting communications with the offer (article 31).

In January 2026 a news report said Vodafone had blocked the Polymarket betting site on its networks, which lacks a Portuguese licence.

Defamation (article 180 of the Criminal Code) carries imprisonment of up to six months or a fine of up to 240 days, and insult (article 181) up to three months or 120 days. Statements in writing, gestures or images are treated like spoken ones (article 182), and the penalties rise by a third where the means or circumstances ease their spread (article 183). Defamation and insult are prosecuted on private accusation (article 188).

To identify the person behind an account, authorities may seek the data Lei 32/2008 requires providers to hold, including the IP address assigned to a connection. Transmission of the data needs an investigating judge’s authorisation, and the person concerned must generally be notified within ten days, though notification can be deferred during an investigation.

The intelligence services of the Portuguese Republic Information System (SIRP) are governed by the framework law, Lei 30/84, as amended by Organic Law 4/2014. A Conselho de Fiscalização, whose members the Assembly of the Republic elects, oversees the services’ activity, and a Comissão de Fiscalização de Dados of three prosecutors, designated by the Prosecutor General, oversees the data centres of the two services.

The order of the rows is the security score, and a server’s location is not a recommendation.