Is it legal to use a VPN?Four categories, and where each country sits
In most of the world, yes. We classify the exceptions into four categories and cross them against how many providers actually publish servers there.
A VPN is ordinary network technology. Companies use one to connect remote staff to internal systems, and that use is unremarkable everywhere. The question people are really asking is narrower: are there countries where connecting through one can get me into trouble, and is the country I am going to one of them?
There are, and the list is shorter than the internet suggests. We sort them into four categories, because "banned" covers four quite different situations that call for different decisions.
- Category 1 — using a VPN can itself be penalised. A very small group.
- Category 2 — providing, advertising or licensing is regulated. The restriction targets companies, and reaches you as a shorter list of options.
- Category 3 — legal to use, but traffic is interfered with. The largest group.
- Category 4 — no open connection to the international internet at all.
- Separately from all of it: most streaming services prohibit VPN use in their terms. That is an account matter, not a legal one.
Category 1: using one can itself be penalised
This is the group people mean when they say VPNs are banned, and it is small. The clearest case is China, where regulations dating from 1996 prohibit connecting to the international internet other than through approved channels. The text covers individuals as well as organisations, and the penalties set out are administrative rather than criminal: warnings, suspension of the connection, and fines up to 15,000 yuan.
Reported enforcement has concentrated on people who sold or supplied access rather than on individuals connecting for their own use. That is a description of what has been reported, not a guarantee about any particular case.
Turkmenistan is the odd one out in this group: there is no law naming VPNs, and users have nonetheless been fined. Where the restriction lives in enforcement practice rather than in a statute, reading the statute tells you nothing.
Category 2: providing or advertising is what is regulated
Here the rules point at the companies. Russia requires providers to connect to a state filtering system and blocks those that refuse; several major providers withdrew their Russian servers rather than comply. India's 2022 rules require providers with servers in the country to retain customer records for five years, and the response was similar — physical Indian servers came out, and virtual Indian addresses hosted elsewhere went in.
The effect on a traveller is indirect but real. You are not the target of the rule, and you still end up with a much shorter list of providers that can actually help you there.
It also means the raw country count needs reading carefully. A provider listing India may be listing a virtual location. It gives you an Indian IP address, which is what a streaming service checks, but it is not a machine in India.
Category 3: legal, but interfered with
This is the largest group and the one most people actually encounter. Turkey, Egypt, the United Arab Emirates, Vietnam, Venezuela and Iraq all sit here. Nothing prohibits you from using a VPN; connections are disrupted during particular periods or for particular services, and providers are blocked and unblocked without notice.
This is where obfuscation matters — traffic shaped to look like ordinary HTTPS rather than a recognisable VPN handshake. Of the seven providers we track, five publish a feature list, and four of those five name obfuscation: NordVPN (obfuscated servers), Surfshark (Camouflage Mode), Mullvad (obfuscation and censorship circumvention) and Private Internet Access (obfuscation). Windscribe does not.
It is also where the coverage count can mislead in the opposite direction. All seven providers publish a Turkish location — and every one of them publishes exactly one city. Full coverage with no second address means that when one stops working, there is no move left inside the country.
Category 4: there is no open connection to begin with
North Korea and, in practice, Afghanistan sit here. The question of which provider to choose does not really arise, because general public access to the international internet is not available. We include these countries in our counts for completeness rather than as a recommendation.
Where the "VPNs are banned in 10 countries" figure comes from
You will see a number — usually ten, sometimes fifteen — quoted without a source. It comes from collapsing our four categories into one, which is why it is both true and useless. Russia regulating providers and North Korea having no international connection at all are not the same fact, and neither is what a traveller means by "banned".
We separate them because the decision differs. In category 2 you need a provider that stayed; in category 3 you need obfuscation and a spare; in category 1 you need local advice we are not in a position to give; in category 4 the question does not arise. One number cannot carry four decisions.
The same collapsing explains why lists disagree with each other. A country that requires providers to register appears on some lists and not others, depending on whether the writer counted regulation as a ban. Ours is published with the category attached so you can see which kind of restriction each entry is.
What to actually do before you travel
The single most common failure has nothing to do with legality. Provider websites are themselves blocked in the countries where you most need one, so you cannot sign up, download an app or recover a password once you have arrived. Everything has to be in place before you board.
A short list that covers most of it:
- Install and sign in on every device before you leave, including the tablet you nearly did not bring.
- Turn obfuscation on if the app has it — it is usually off by default because it costs a little speed.
- Note two or three server locations that work, rather than relying on the app's automatic choice, which may pick something blocked.
- Consider a second provider in the countries in category 3. When one is identified, a different company using a different protocol is frequently unaffected, and the money-back windows make testing two nearly free.
- Check the current position rather than trusting an article. Rules in categories 1 and 2 change without much notice.
Nothing here is exotic advice. It is what people who live in these countries actually do, and the reason they do it is that the alternative is being stuck with a phone that cannot reach anything.
Why the answer changes depending on who is asking
A tourist, a resident and a business traveller face genuinely different versions of this question, and articles that give one answer are answering only one of them.
For a short-stay visitor in almost every country, the practical risk is close to zero and the practical problem is availability — will the thing work. For a resident in a category 1 or 2 country, the calculation is different, involves local knowledge we do not have, and is not something to take from a comparison site. For someone travelling on business, the employer's own VPN is usually the relevant tool and is treated quite differently from a consumer service by everyone involved.
We write for the first case and say so, rather than implying that one answer covers all three.
The restriction almost everyone actually runs into
Not one of those categories is what stops most people. What stops them is a streaming service's terms of use, which almost universally prohibit using a VPN to change your apparent region. The consequence is an account measure — a block, occasionally a cancellation — rather than anything legal.
Articles that answer "is it legal?" with "yes, so relax" are skipping the half that can actually cost you something. Both halves are worth knowing, and they are different questions with different answers.
Every country we classify, with the provider count beside it
Here is the whole classification in one table, with our daily provider count next to each entry. The two are collected independently — the category comes from the law or the reporting, the count from the providers' own server lists — so where they line up, that is a finding rather than a construction.
| Category | Country | Providers publishing a location |
|---|---|---|
| Category 1 | China | 3 of 7 |
| Category 1 | TM | 0 of 7 |
| Category 1 | Tanzania | 1 of 7 |
| Category 2 | Belarus | 2 of 7 |
| Category 2 | India | 6 of 7 |
| Category 2 | Iran | 1 of 7 |
| Category 2 | Myanmar | 4 of 7 |
| Category 2 | OM | 0 of 7 |
| Category 2 | Pakistan | 5 of 7 |
| Category 2 | Russia | 2 of 7 |
| Category 3 | Egypt | 5 of 7 |
| Category 3 | Iraq | 1 of 7 |
| Category 3 | SY | 0 of 7 |
| Category 3 | Turkey | 7 of 7 |
| Category 3 | UG | 0 of 7 |
| Category 3 | United Arab Emirates | 6 of 7 |
| Category 3 | Venezuela | 5 of 7 |
| Category 3 | Vietnam | 6 of 7 |
| Category 4 | Afghanistan | 1 of 7 |
| Category 4 | KP | 0 of 7 |
| No restriction | Japan | 7 of 7 |
| No restriction | Hong Kong | 7 of 7 |
| No restriction | Singapore | 7 of 7 |
Categories are VPN LIFE's classification, with the law or report behind each on our Japanese page. Provider counts are our own daily count. Countries where no provider publishes a location do not appear in the count and are listed as 0 in our classification: Turkmenistan, Oman, Uganda, Syria and North Korea.
Read down the first column and the pattern is hard to miss: the tighter the restriction, the fewer providers bother to be there. Read across the Turkey row and you get the counter-example that stops it being a rule.
What the coverage numbers show about all this
We count how many of seven providers publish a location in each of 155 countries, every day. Sorted against the categories above, the pattern is consistent: the tighter the restriction, the fewer providers are there. Turkmenistan, Oman, Uganda, Syria and North Korea have none at all — the option does not exist rather than being risky.
Turkey is the exception that shows the categories are about law rather than availability: it is subject to active interference and all seven providers still publish a location. Availability and usability are not the same measurement, and we only claim the first.
Frequently asked questions
Is it legal to use a VPN in my country?
In the large majority of countries, yes, and no permission or registration is required. The exceptions are the four categories above. Rules in categories 1 and 2 change with little notice, so check the current position before travelling rather than relying on an article — including this one.
Can I be identified if I use one?
That depends on what the provider keeps and on the law it operates under. Five of the seven providers we track name an outside firm that examined their no-logs claim, and five state their jurisdiction: Panama, the Netherlands, Sweden, the United States and Canada. Those two facts tell you more than any marketing page.
Does a VPN make what I do legal?
No. It changes which address a service sees; it does not change what the law says about what you do. Anything that is an offence without a VPN remains one with it, and in some jurisdictions using one while committing an offence is treated as an aggravating factor.
Conclusion
Four categories, and a very small first one. For most travellers the practical question is not whether a VPN is permitted but whether one that works is available — and that is a question our daily counts can answer directly.
Our full country-by-country classification, with the law or report behind each entry, is published in Japanese on this page. Nothing here is legal advice.
Every figure on this page comes from our own daily collection or our own measurements. The files are published as open data under CC BY 4.0, and the method — including what the numbers do not prove — is on how we test.