VPN rules depend on your jurisdiction, the service you use, and what you do online. Check the applicable law and official guidance before relying on a country label.
By Andreas Lazarou · Content reviewed 7 September 2026
What this guide covers
A VPN is a networking tool. Permission to use that tool, permission to operate a VPN service, and permission to access particular content are separate questions. A working connection or an available app is not evidence that every use is lawful.
Correction, 7 September 2026: We removed the earlier unsourced 195-country classifications, statistics, and “legally verified” label. The examples below identify what specific official sources say and where they leave questions open. This is general information, not legal advice or a complete survey of current national laws. Ask a qualified local adviser about your circumstances.
Selected country sources
| Country | What the source establishes | What to check next |
|---|---|---|
| United Kingdom | The NCSC publishes guidance for organisations deploying VPNs to connect devices in different locations securely. | This is organisational security guidance, not a legal opinion on a particular personal activity, service contract, or overseas destination. |
| India | CERT-In’s 28 April 2022 directions set recordkeeping requirements for covered VPN service providers. They include specified subscriber information retained for five years or longer where law requires. FAQ 34 distinguishes these services from enterprise or corporate VPNs. | Check the current directions, subsequent amendments, and the provider’s actual obligations. These documents should not be simplified into a blanket ban on every individual VPN connection. |
| United Arab Emirates | A 2016 statement by the telecommunications regulator, published by WAM, explained that companies could use VPNs for internal networks and distinguished this from misuse to commit or conceal an offence. | This is a historical clarification, not a complete statement of today’s law. Check current UAE legislation and telecom rules for the intended activity. The old page’s “corporate use only” label was too broad to rely on. |
| China | Australia’s current Smartraveller advice for China warns that access to many foreign internet services is prohibited and that laws can be broadly enforced. | Travel advice is not a VPN licence or a comprehensive list of VPN offences. Obtain current local guidance on the intended service and use; availability does not establish permission. |
Sources reviewed on 7 September 2026. A source’s publication date and scope are stated where material. Countries omitted here have not been classified by this guide; omission does not mean either legal or prohibited.
How to check the rules where you are
- Identify the activity. Distinguish connecting to an employer’s network, using a consumer service, running a VPN business, accessing restricted content, and sharing files.
- Start with the competent authority. Look for the national legislation portal, telecommunications regulator, cybersecurity authority, or an official gazette. For travel, read your government’s destination advice as well.
- Check the status of the text. Record its date, whether it has taken effect, amendments, the people or businesses covered, and any licensing or registration exceptions. A proposed bill is not automatically an enacted rule.
- Separate law from service terms. A streaming platform, employer, school, or network operator can impose conditions separate from national criminal law. Read the rules that apply to your account and network.
- Resolve uncertainty before relying on a summary. Ask a qualified local lawyer or the relevant authority. A vendor’s claim that its app works in a country does not answer the legal question.
Before travelling or using a work VPN
Ask your employer which remote access service and devices are approved for the destination. Check relevant travel advice and the local rules before departure, and again if circumstances change. Keep lawful alternative ways to reach important contacts and essential services if your normal apps are unavailable.
Keep personal and work requirements separate. An organisation’s permitted internal-network arrangement does not automatically cover every consumer VPN or every activity performed through it. Avoid treating an affiliate review or social media anecdote as legal clearance.
What technical features cannot establish
Encryption, a kill switch, multiple VPN hops, or an obfuscated protocol describe technical behavior. They do not grant permission, guarantee anonymity, or eliminate enforcement risk. A no-logs claim also needs to be read alongside the provider’s policy, jurisdiction, and applicable obligations.
For the technical distinctions, read what a VPN does, how VPN connections work, and VPNs versus proxies. Our editorial method explains the difference between documented features and measurements.
Frequently asked questions
Does a VPN make an otherwise unlawful activity legal?
No. A VPN changes how traffic is routed; it does not provide legal permission for the underlying activity. Check the rules that apply to your circumstances.
Does an app working in a country prove it is allowed?
No. Technical availability, provider marketing, and app-store access do not establish legal permission. Consult current official guidance for the intended use.
Why is there no green or red label for every country?
A useful classification needs dated sources, a defined activity, and the relevant exceptions. We removed the earlier unsourced global labels rather than present them as verified law.
What should I do if my country is missing?
Check your national legislation portal and telecom or cybersecurity regulator. For travel or work, also consult official destination advice and your employer; obtain local legal advice when the rules are unclear.
Suggest a correction
If you find a relevant law or official update, send the source and effective date. Include the country and activity covered so the information can be assessed in context.