Is Using a VPN Illegal?

This page is part of the Proton VPN FAQ Hub.

Is using a VPN illegal in the UK, the US or the EU?

No. Is using a VPN illegal in any of the three markets most readers of this site actually live in? Not in Britain, not in America, and not anywhere in the European Union. No UK statute makes it an offence for an adult to route traffic through an encrypted tunnel. In July 2026 the government put the question beyond argument when Technology Secretary Liz Kendall told Parliament that ministers would not age-gate or ban VPNs, and Online Safety Minister Kanishka Narayan said publicly that the decision had been taken not to limit them. Ofcom regulates the services you visit, not the software on your laptop.

The position in the United States is the same at federal level and in every state that has passed an age-verification law since 2023: those statutes place duties on websites, not on the people visiting them, and none of them criminalise VPN software. In the European Union, the Commission stated in May 2026 that there was no crackdown on VPNs, even whilst it was pushing an EU-wide age verification app and floating a pan-European digital age of majority. Encryption is legal in all three, privacy tooling is legal in all three, and the regulatory argument is about what platforms must do rather than what you may install.

Which countries restrict or ban VPNs?

The restrictive list is short, well documented and fairly stable, and Proton keeps a country-by-country account of VPN legality alongside the usual press coverage. In almost every case the law targets the provider rather than the person at the keyboard: the state demands a licence, the licensed services agree to filter, and everything unlicensed gets blocked at the network layer. That distinction matters, because plenty of scare copy conflates a ban on selling a VPN with a criminal penalty for using one.

Here is where the position is genuinely restrictive, as of August 2026:

• China: VPN services require state approval, unlicensed providers are blocked by the Great Firewall, and foreign companies are expected to route through licensed leased lines.
• Russia: a 2017 law required VPN providers to connect to the state blocklist registry. From 1 September 2025, administrative fines apply for deliberately searching for material on the extremist register, including over a VPN, and separately for advertising VPN services.
• Iran: only state-licensed VPNs are permitted and selling or promoting unlicensed ones is an offence, yet use remains widespread, including reportedly amongst officials.
• Belarus: Tor and VPN services have been targeted for blocking since 2015.
• Turkmenistan: one of the most aggressive blockers in the world, where VPNs are treated as prohibited rather than merely discouraged.
• Myanmar: the Cybersecurity Law of 2025 took effect on 30 July 2025 and sets penalties of one to six months imprisonment, a fine of one to ten million kyat, or both, for unauthorised VPN use.
• North Korea: the open internet is unavailable to almost the entire population, so the question hardly arises.
• United Arab Emirates: owning and using a VPN is not itself an offence, but Article 12 of Federal Decree-Law No. 34 of 2021 penalises using a fraudulent IP address to commit a crime or prevent its discovery, carrying imprisonment and a fine of AED 500,000 to AED 2,000,000.

Does a VPN being legal make illegal activity legal?

No, and this is the part that marketing copy tends to skip. A VPN changes how your traffic is routed and who can read it in transit. It does not change the criminal law of the country you are sitting in. Fraud, harassment, copyright infringement, buying prohibited goods and accessing illegal material are offences whether or not the packets took a detour through Zurich first. If an activity would get you charged without a VPN, it will get you charged with one, and BAIZAAR would rather say that plainly than let a product page imply otherwise.

The second half of that reality check is technical. A VPN hides your IP address from the sites you visit and hides your browsing from your ISP, and that is the whole of what it does. It does not hide you from the account you are logged into, from the card you paid with, from the device fingerprint your browser hands over, or from anyone with lawful access to the provider itself. Swiss no-logs policies and independent audits raise the bar considerably, but treating a VPN as a licence to misbehave is a category error about what the technology is for.

Can you be prosecuted just for switching a VPN on?

In the UK, the US and the EU, no. In the restricted countries listed above, the honest answer is that the risk is real but usually indirect. Enforcement historically falls on people who run, sell or advertise unlicensed services, on companies that fail to comply with licensing rules, and on individuals who used a VPN in the course of something else the state objected to, with free VPN apps caught by the same rules. Russia’s September 2025 rules are the notable shift, because they attach an administrative fine to the act of searching for listed material rather than to the tool itself.

If you are travelling to or living in one of those jurisdictions, do not calibrate your risk from a blog post, this one included. Laws change, enforcement patterns change faster, and the gap between what a statute says and what happens in practice can be enormous in both directions. Get advice from a lawyer qualified in that jurisdiction, and check whether your employer already has a policy covering it.

What about rules that are not laws at all?

A great deal of what people mean by is using a VPN illegal turns out to be contract law rather than criminal law. Your employer’s acceptable use policy, your university network rules, a streaming service’s terms of use and a platform’s terms of service can all prohibit VPN connections. Breaking those gets your account suspended or your IT department cross. It does not get you arrested, and the two categories deserve to be kept separate.

The same applies to sites that simply refuse VPN traffic. Banks, ticketing sites and streaming platforms routinely blocklist known VPN IP ranges, which is a business decision rather than a legal one. You may find yourself locked out of a service whilst doing nothing remotely unlawful, and no amount of switching servers changes the fact that the site is entitled to decline the connection.

Why does a provider’s home jurisdiction still matter?

If VPN use is legal where you are, the next question is what law applies to the company holding your connection. Proton is headquartered in Switzerland, outside both the EU and the US, and Swiss courts have declined to extend telecoms-style data retention duties to VPN providers. That is a structural point rather than a marketing one: it determines which government can compel what, and how quickly.

It has been tested. When India’s CERT-In directive in 2022 ordered VPN providers to log customer names, addresses and IP allocations for five years, Proton declined to comply and pulled its physical servers out of the country, serving Indian IP addresses through smart routing from Singapore instead. Several other providers did the same. Whether you use the free tier or a paid Proton VPN Plus plan, the practical protection comes from that combination of jurisdiction, published no-logs policy and independently audited open-source apps, not from the legality of VPNs in the abstract.

---