Are VPNs legal? Blocked in some places, aimed at sites in others

What the pages say, and what they leave out

This page reports what ten pages say. It is not legal advice, and the answer to “are VPNs legal?” changes with the country, so we name a country only where one of the pages we read names it. Those pages are from Freedom House, the US State Department, the Electronic Frontier Foundation (EFF), the UK government, the Federal Trade Commission (FTC) and Netflix.

The pages we read do not state in one sentence that using a VPN is legal in the United States or the United Kingdom. What they do describe is different. Freedom House describes places where VPNs were blocked, and places where using or promoting them was made a crime. EFF describes a Utah law, SB 73, that told adult websites to block VPN users or work out where they were, and that a federal judge stopped from being enforced for now. The UK government’s page is a survey of how children use VPNs, and it does not say whether that use is lawful or unlawful.

So the sources show where governments have acted against VPNs and where a law aimed at VPNs was halted. Whether an ordinary person in a given country is breaking a law by turning one on is a question they leave unanswered in so many words. EFF’s guide to choosing a VPN, revised on 28 July 2026, adds a note: it tells readers to keep up to date on security news for specific countries’ policies on VPNs, and it gives VPN bans as an example of what to watch.

Where the tool is blocked or criminalized

Blocking a VPN service is a different act from punishing the person who uses one, and Freedom House reports both. It writes that in late October 2024 Roskomnadzor, Russia’s telecommunications and media regulator, blocked 197 VPNs, and that Moscow began blocking them in 2021 and intensified the effort after launching its full-scale invasion of Ukraine in 2022. In July 2024, it says, Apple removed 25 VPNs from its app store at Roskomnadzor’s request, and Apple was reported to have removed 98 apps by September. Freedom House adds that China had ordered such removals in 2017, and that Russian government agencies reportedly spent at least $145 million on government-approved VPNs in 2024 while blocking them for ordinary people. Its Russia report for 2025, covering 1 June 2024 to 31 May 2025, lowered the country’s score on one indicator, restrictions on anonymous communication or encryption, from 1 to 0, and lists the expanded blocking of VPNs and the orders to remove them from app stores among the reasons.

On using versus promoting, the wording differs by country. For Iran, Freedom House says the government criminalized the use of “unauthorized” VPNs in February 2024, including ones that do not mirror its censorship. For Russia, it says a law passed ahead of the March 2024 presidential election criminalizes the advertisement and promotion of banned VPNs, and lets the government charge people who advertise these tools or instruct others in how to use them. In a general sentence, it also refers to criminal penalties for simply using or promoting these applications. We keep the two descriptions apart because the page does not say that Russia punishes ordinary use in the way it says Iran does.

Three more cases come from the same Freedom House article. In late November 2023 the Turkish government restricted access to 16 of the most popular VPNs in the country. In May 2024 the state-owned operator Beltelecom blocked VPNs in Belarus, which affected voting for the Coordination Council, a platform Belarusians could reach only through a VPN. That same month Myanmar’s ruling junta launched a firewall that blocked a slew of VPNs, which Freedom House says effectively limited users to 1,500 websites.

Two counts from Freedom House look alike and are not the same. Its special report Tunnel Vision says anti-censorship tools were blocked in at least 21 of the 72 countries covered by Freedom on the Net 2024 over five years, all ranked Not Free or Partly Free, and that governments have also criminalized people’s use of such tools, placed onerous legal restrictions on VPNs and forced app stores to remove them. The article counts a different thing: governments in at least 41 of the 72 countries blocked political, social or religious content.

China, as the US State Department reports it

The State Department’s Country Reports on Human Rights Practices for 2023 is a report by the US government about another government, not a Chinese rule, and it covers 2023. With that said, its China chapter says the government continued efforts to limit VPN use. It describes two tiers: the government permitted some users, including major international companies, to use VPNs, while many smaller businesses, academics and citizens were prohibited. It also says the government regularly penalized those caught using unauthorized VPNs.

The chapter gives one case, which it attributes to a Radio Free Asia report from June: a Uyghur university student was sentenced in 2017 to 13 years in prison for using a VPN to view “illegal information.” The report does not say more about the charge in that passage, so we do not either.

The same chapter describes selective tolerance. It says the government tacitly allowed individuals to use VPNs to reach X, Facebook, Instagram and other websites normally inaccessible in the country, for the purpose of attacking views that criticized the government. It also says encrypted apps such as Telegram, WhatsApp and Signal were regularly blocked, and VPNs disrupted, especially during sensitive times of the year and around important political events.

Freedom House and the State Department do not describe China the same way. The Freedom House article we read mentions China twice: as the government that ordered VPN removals from app stores in 2017, and as tied with Myanmar as the worst-surveyed country in its report. It does not describe a Chinese VPN rule. For the legal detail on China we use the State Department chapter.

The United States and the United Kingdom: laws aimed at sites

For the United States, the text we read is EFF’s account, dated 1 October 2026, of a court order about Utah’s SB 73. EFF writes that the law regulates adult websites by requiring them to block VPN users or identify the physical location of visitors using VPNs or similar tools, and that it bars those websites from offering instructions on how to use a VPN to get past the checks. EFF says Utah was, to its knowledge, the first state to target the use of VPNs to avoid age-verification gates. A federal judge issued a preliminary injunction, and the court held that the law likely violates the constitutional prohibition on laws that significantly burden businesses and people outside the state.

The law, as EFF describes it, addresses websites, not the people who browse them. EFF’s reasoning is technical: a website sees only the address of the VPN server, so it has no reliable way to tell whether a connection comes from Salt Lake City, Seattle or Shanghai. It adds that Aylo, the company that sued, does not challenge the provision that stops covered websites from sharing information about VPNs. EFF is a digital-rights group, and its article calls the law draconian.

A second EFF page, on age-gating mandates, says that sites subject to a similar law would face a choice between ceasing operation in the state or blocking all VPN users everywhere. It adds that VPNs “are not foolproof,” and that they should not be needed to reach legally protected speech. We treat that page as EFF’s position, not as a ruling.

For the United Kingdom, the page we read is the government’s Children’s circumvention behaviours online, published on 14 July 2026. The Department for Science, Innovation and Technology commissioned BMG Research to survey 2,299 young people aged 11 to 17. A quarter, 26%, said they had used a VPN in their lifetime and 22% in the last three months. The commonest reasons were keeping activity private (30%), reaching certain websites, apps or games (27%) and watching videos from other countries (25%); 22% of the VPN users said they use one to reach age-restricted sites. The page also quotes Ofcom: daily users of VPN apps in the UK temporarily doubled to about 1.5 million after the child safety duties began, then fell back to about 900,000 by November; the page adds that it was not clear whether children or adults drove the spike. It reports use and motives; it does not say whether the use is legal. We also tried pages from Ofcom and Hansard, but they did not load as readable text, so nothing here rests on them.

What a VPN does not settle

A VPN is a tool, and the pages that mention it as a product speak of its limits more than of its lawfulness. Netflix’s Help Center page is a case in point. It says that with a VPN you may be shown only the titles Netflix has worldwide licensing for, and that you may need to turn the VPN off to see what is available in your region. It also says VPNs are not supported for live events or on an ad-supported plan, and that Netflix customer service cannot help turn one off. That is a rule of the service, not a statement of law; the page does not discuss legality. Our VPN for Netflix page goes through it.

On anonymity, the FTC’s business blog of 22 February 2018 says a VPN app generally is not going to make you entirely anonymous. It says the app shifts trust from the network to the VPN provider, and that sites can still use identifying information you give them directly. The FTC also cites researchers who studied almost 300 VPN apps and found risks in some, and says many free apps sell advertising or share information with third parties. That is the FTC’s view from 2018, and it is about shopping for an app, not about the law. See free VPNs for more.

EFF’s Surveillance Self-Defense guide, last revised on 28 July 2026, is the page most relevant to a question about police. It says a VPN is not a tool for anonymity, that the provider can be pressed by governments or law enforcement to turn over information, and that many providers save as much information as internet providers do. It says a VPN does not protect against law enforcement getting the browsing history saved in a browser or a logged-in search account. The provider, it adds, is subject to the laws of the countries where it does business, including laws on government requests, which sometimes allow officials to collect information without notifying you. For more anonymity, EFF says Tor is a better solution than a VPN; Tor or VPN sets out the difference.

The three pages we read do not say that a VPN changes how the law sees an act, and they do not treat the question in terms of criminal law. What they offer is narrower: the service has its own rules, the tool does not hide everything, and the provider answers to the law of its own country. For the broader uses, what a VPN is used for covers how the same sources describe censorship workarounds.

What we did not use

We tested no VPN and give no legal advice. When we looked on 5 November 2026, Google listed pages from NordVPN, Surfshark, hide.me, Bitdefender, security.org, How-To Geek, Reddit and Quora for the question. We did not open them, so no country named above comes from them, and we do not offer a list of countries. Only the countries that Freedom House or the State Department name in the pages we read appear here.

Two of the sources are old: the FTC blog is from 2018 and the State Department report covers 2023, and we say so where each is used. The Freedom House figures run to 2025, and the Utah order is from October 2026. Laws on this subject change; EFF’s guide to choosing a VPN tells readers to keep up to date on security news for specific countries’ policies on VPNs.