The Global War on VPNs: Who Bans Them, Who Logs You, and Who's Just Faking It

Roughly half the world's internet users live somewhere a VPN is restricted in one way or another. That's not a fringe statistic — it's basically half the planet. And yet the word "ban" gets thrown around so loosely that it's genuinely hard to tell which countries have actually outlawed VPNs, which ones just make them useless through the back door, and which ones are quietly building the infrastructure to do the same thing while insisting, publicly, that nothing has changed.

The Short List: Where a VPN Can Get You Arrested

Only a handful of countries have gone all the way and made VPN use a straight-up crime, no gray area.

North Korea is the extreme case, though almost as a technicality — the vast majority of citizens never touch the global internet at all, so a VPN ban is almost redundant. Turkmenistan comes closest to matching that isolation deliberately: its state-run gateway, Turkmenet, is filtered so aggressively that even obfuscated VPN protocols built specifically to evade detection routinely fail to get through. Officials there have reportedly gone as far as making citizens swear on the Quran that they won't use one.

Belarus folded VPNs into the same banned-technology basket as Tor and encrypted messaging apps back in 2015, and enforcement only got heavier after the 2020 protests — violations there increasingly mean actual jail time, not just a fine. Iraq's ban dates back to 2014, originally framed as a counterterrorism measure, and it's never been walked back or given any carve-out for businesses or personal use. Oman has required government pre-approval for VPN use since 2010, banning personal use outright and even restricting encrypted communications more broadly. Add Iran, which criminalized unauthorized VPN use back in 2013 and tightened it further in 2024, and Myanmar, which imposed a blanket ban following its 2021 coup, and you've got the full list of countries where simply opening a VPN app is, on paper, a criminal act.

Worth noting: in several of these countries, the ban barely slows people down in practice. Reports suggest the overwhelming majority of Iranians still route around it daily. Prohibition and actual usage rates are two very different numbers.

The Bigger Club: Legal on Paper, Useless in Practice

This is where most of the real action is, and it's a far bigger group than the outright-ban list.

China is the textbook example. VPNs aren't illegal there — but only a government-approved shortlist of providers is allowed to operate, and every one of them routes traffic through state-monitored gateways. Everything else runs into the Great Firewall's deep-packet inspection, a system sophisticated enough to identify and throttle VPN traffic patterns even when the app itself is disguised. Apple pulled close to a hundred unauthorized VPN apps from its Chinese App Store in a single sweep, and the filtering has only gotten more precise since.

Russia has taken a slightly different route to a similar destination. VPN software itself was never formally criminalized, but the state has methodically blocked dozens of providers that refused to plug into its national content-filtering registry, and pulled close to a hundred VPN apps from domestic app stores. What's newer, and more interesting, is where this is heading next: officials are now pressuring online platforms directly to lock out users connecting through unauthorized VPNs, rewarding compliant platforms with a spot on an official "white list." Only VPNs licensed by Russia's FSB are technically sanctioned — which, in practice, means the only "legal" VPN option is one built to hand over exactly what a VPN is supposed to hide.

India sits in an odd middle position. VPNs are legal to use, but a 2022 directive already requires providers to retain subscriber data — names, IP addresses, usage duration — for a minimum of five years. That single rule was enough to push several major VPN companies to physically pull their servers out of the country entirely, switching to virtual servers hosted elsewhere just to sidestep the requirement. And the pressure hasn't let up: officials are now reportedly drafting a follow-up plan that would require VPN providers to appoint dedicated compliance officers to coordinate directly with law enforcement and the national cyber response team — modeled on rules originally written for social media platforms.

The UAE and several other Gulf states run a similar playbook: VPNs are legal for legitimate business use, illegal the moment they're used to reach blocked content, and enforced with fines that can run into the hundreds of thousands of dollars. Turkey doesn't ban VPNs outright either — it just blocks most of the popular ones and lets attrition do the rest.

The Countries Pretending Nothing Is Happening

This is the category that gets the least attention, and arguably deserves the most.

In the UK, the trigger was the Online Safety Act's age-verification requirements for adult content, which went into full effect in mid-2025. One VPN provider reported registrations spiking by roughly 1,400% within hours of enforcement starting, largely from people — including plenty of minors — using VPNs to sidestep the age checks entirely. That single side effect has snowballed into a genuine policy debate: the House of Lords has already voted in favor of an amendment aimed at restricting VPN access for under-18s, and the government has opened a formal consultation asking, bluntly, whether VPN purchases themselves should require age verification. Officials insist there's "no plan to ban VPNs" for adults. Whether that holds is a separate question from whether the conversation has already shifted.

The US tells a quieter but arguably more consequential story. There's no ban on the table, and there never has been. But there's a legal wrinkle getting more attention: once a VPN routes an American's traffic through a server outside the country, it can legally be classified as "foreign communication" from a surveillance standpoint — which some argue weakens the constitutional protections that traffic would otherwise have. Nobody's proposing to outlaw VPNs over this. It's a reform-the-surveillance-law argument, not a ban-the-tool argument. But it's a genuine crack in the "VPNs are simply safe in free countries" narrative that doesn't get nearly as much attention as it should.

Australia has taken aim at a narrower target: not VPN use itself, but VPN providers actively marketing their product as a way to dodge geo-blocks and access restrictions, which regulators there increasingly treat as a circumvention problem rather than a privacy one.

None of this amounts to Western democracies banning VPNs — that headline would be false. What's actually happening is narrower and, in some ways, more revealing: the fights aren't about VPNs generally, they're about the very specific things VPNs happen to make easy — dodging age checks, complicating surveillance law, sidestepping licensing regimes for content. The tool isn't the target. What people are doing with it is.

Why the Map Keeps Shifting

Pull all of this apart, and a pattern shows up regardless of which government you're looking at. Full bans cluster in places that already restrict internet access broadly — North Korea, Turkmenistan, Belarus, Iraq — where a VPN ban is really just one more piece of a much bigger censorship apparatus, not a standalone policy. Licensing-and-logging regimes cluster in countries that want to project openness while retaining a kill switch — China, Russia, India, the UAE — where the pitch is "VPNs are legal," but the fine print quietly strips out the one feature that made them worth using. And the "pretending" category is really just democracies discovering, case by case, that a tool built for privacy is also extremely good at defeating whatever new verification system a legislature just passed — and reacting to that specific side effect rather than the tool itself.

If there's one honest takeaway here, it's that "is a VPN legal" is close to the wrong question. The more useful one is: legal to do what, logged by whom, and enforced how consistently. On that question, the honest answer for a lot of the world is "it depends" — and that answer is only getting more complicated, not less.