Very few countries ban VPNs outright. In practice, the riskiest places are those where VPNs are legal only if they are state-approved: China, Iran, Myanmar, Russia and Belarus. In those countries, unlicensed services are blocked, and the authorities can punish users or sellers. A second group, including the UAE, Egypt, Oman and Turkey, has no general VPN ban but criminalizes using VPNs to commit crimes or reach blocked content, or blocks VPN providers without a specific law.
For most travelers and residents, the legal text matters less than enforcement, which is often vague and inconsistent. In the documented cases, it more often targeted sellers, installers and people earning money over a VPN than ordinary users.
VPN legal status by country (2026)
| Country | Status | Legal basis | Enforcement examples | Source |
|---|---|---|---|---|
| China | Only government-approved VPNs allowed | MIIT banned unlicensed VPNs in 2017 | VPN blocking intensifies before major political events; hundreds of VPN apps missing from Apple’s China store; 2023 Chengde income confiscation case | Freedom House, 2024; China Digital Times, 2023 |
| Russia | Use legal; non-compliant providers blocked | Law 276-FZ (2017); VPN advertising ban (2025) | 197 VPN services blocked by Oct 2024; 761 VPN apps removed from Apple’s store in March 2026 | HRW, 2017; Barents Observer, 2024; Mediazona, 2026 |
| Iran | Unlicensed VPNs prohibited | Supreme Council of Cyberspace resolution (Feb 2024) | NordVPN, Proton VPN and TunnelBear inaccessible; user penalties unspecified | RFE/RL, 2024; Freedom House, 2024 |
| Belarus | Anonymizers blocked | 2015 order to block Tor, proxies and anonymizers | Psiphon, Turbo VPN, HUB VPN and TunnelBear inaccessible in 2024 | Global Voices, 2015; Freedom House, 2024 |
| Turkmenistan | Effectively banned | No explicit VPN statute found in our sources | Users told to swear on the Koran not to use VPNs; campaign against users and installers | RFE/RL, 2021; IPHR, 2026 |
| North Korea | No public access to the global internet | State control of networks | Smartphones reach only a state intranet | Freedom House, 2025 |
| Myanmar | Licensed providers only | Cybersecurity Law (Jan 1, 2025) | Major VPNs blocked June-July 2024; up to six months’ prison for unauthorized VPN installation or service | RFA, 2025; Freedom House, 2025 |
| Egypt | Grey area; circumvention may be criminal | Anti-Cyber and IT Crimes Law No. 175/2018 | About 394 VPN and proxy sites blocked since May 2017 | Andersen, 2024; Freedom House, 2021 |
| UAE | Legal; criminal misuse punished | Federal Decree-Law 34/2021, Art. 10 | Fines of AED 500,000-2 million and/or prison for IP fraud used to commit or hide a crime | Gulf News, 2022; Freedom House, 2024 |
| Oman | Grey area; licensing framework | TRA regulation | Regulator says it licenses rather than bans; enforcement against individuals not documented | Khaleej Mag, 2025 |
| Turkey | Legal, but many VPN services blocked | Administrative blocking by the BTK | 17 VPN services blocked in Dec 2023 without a court order | Freedom House, 2024 |
| Pakistan | Legal; registration push stalled | PTA registration rules (Nov 2024) | PTA said in Dec 2024 it would not block unregistered VPNs | Freedom House, 2025 |
| India | Legal; logging mandate for providers | CERT-In Directions (April 2022) | Major providers moved their servers out of India; a new law has been reported | MediaNama, 2026 |
Countries where unapproved VPNs are illegal
China
China’s Ministry of Industry and Information Technology banned unlicensed VPNs in 2017. Since then, illegal VPN operations have increasingly been shut down or blocked, and blocking typically escalates before high-profile political events (Freedom House, 2024). Most users are never punished, but there are cases. In August 2023, police in Chengde fined a programmer 200 yuan and confiscated 1.058 million yuan he had earned while using a VPN to work for a foreign client. They treated the income as illegal proceeds (China Digital Times, 2023).
Iran
Iran had already criminalized selling and distributing VPNs. In February 2024, a Supreme Council of Cyberspace resolution endorsed by the Supreme Leader extended the ban to using any unlicensed VPN (Freedom House, 2024). The decree does not say what happens to people who break it, and an expert quoted by RFE/RL said that blocking VPNs completely is not technically feasible (RFE/RL, 2024). In practice, the ban is enforced mainly through blocking. Freedom House also notes that internationally routed traffic costs more than domestic traffic, which makes VPN use more expensive.
Russia
Russia’s 2017 law, 276-FZ, left VPN use legal but requires providers to cut off access to sites banned in Russia, and it lets Roskomnadzor block providers that refuse (HRW, 2017). Since 2024, enforcement has escalated sharply:
- Roskomnadzor had blocked 197 VPN services as of October 2024 (Barents Observer, 2024).
- A law signed on July 31, 2025 banned VPN advertising, with fines of 50,000 to 80,000 rubles for individuals. A companion law fines people 3,000 to 5,000 rubles for deliberately searching for “extremist” material (Meduza, 2025).
- Using a VPN is not enough for a conviction on its own, but it can be treated as evidence of intent (The Moscow Times, 2025).
- By late 2025, authorities were disrupting the VLESS protocol, and in March 2026 Apple removed 761 VPN apps from the Russian App Store (Mediazona, 2026).
Myanmar and Belarus
Myanmar’s junta blocked major VPNs in mid-2024. Its Cybersecurity Law, in force from January 1, 2025, then made unauthorized VPN installation or service punishable by up to six months in prison and a fine (RFA, 2025). RFA’s report did not document any arrests under the law.
Belarus ordered ISPs in 2015 to block Tor, proxies and anonymizers (Global Voices, 2015). In 2024 several VPN apps became unreachable, possibly in connection with elections (Freedom House, 2024).
Turkmenistan and North Korea
The sources reviewed name no explicit statute banning VPNs in Turkmenistan. Even so, RFE/RL reported in 2021 that people applying for home internet were told to swear on the Koran that they would not use VPNs (RFE/RL, 2021). A 2026 IPHR report describes a long campaign against both VPN users and people who install VPNs for others (IPHR, 2026). In North Korea, the question barely arises: ordinary smartphone users can reach a state intranet but not the global internet (Freedom House, 2025).
Countries where VPNs are legal but restricted
In the UAE, VPN use is not explicitly prohibited. However, Article 10 of Federal Decree-Law 34 of 2021 punishes using another IP address to commit or hide a crime with prison and/or a fine of AED 500,000 to 2 million (Gulf News, 2022). Freedom House notes that using a VPN for banned VoIP calls can be prosecuted and that official guidance remains confusing (Freedom House, 2024).
In a 2024 analysis, the law firm Andersen reads Article 14 of Egypt’s Law 175/2018 as covering the use of tools such as VPNs to reach blocked websites. The penalties are at least one year in prison and fines of EGP 50,000 to 100,000 (Andersen, 2024). The sources reviewed document no prosecution of a user for VPN use alone. Authorities have blocked about 394 VPN and proxy websites since 2017 (Freedom House, 2021).
Oman’s regulator proposed in 2010 to limit VPNs to approved institutions, with fines for individuals (The Next Web, 2010). In April 2025 it said it regulates digital services through licensing, not outright bans (Khaleej Mag, 2025). A July 2026 warning from the regulator dealt with security risks and did not address legality (Muscat Daily, 2026).
Turkey’s telecom regulator blocked 17 VPN services in December 2023 without a court order (Freedom House, 2024). Pakistan announced VPN registration rules in November 2024. A month later it backed down from blocking unregistered services after the Law Ministry found it lacked legal standing (Freedom House, 2025). India’s 2022 CERT-In directions require VPN providers to keep customer records for five years. Major providers responded by moving their servers abroad, and officials are now reported to be drafting a new law (MediaNama, 2026).
Practical advice for travelers and residents
- Check the specific country before you travel. The table is a starting point, not legal advice. Laws change quickly, and Russia and Iran have tightened their rules several times since 2024.
- Expect blocking more than prosecution. In most restrictive countries, the practical risk for a visitor is that VPNs simply don’t connect. Most punishments documented in these sources involved selling or installing VPNs, or earning income over one, not casual browsing.
- In the UAE and Egypt, liability depends on what you do over the VPN, such as unlicensed calling or reaching blocked content.
- A VPN that is officially allowed in a restrictive country is not necessarily private. Under Russia’s 2017 law, for example, a VPN that keeps operating legally must block the sites on the state’s blocklist.
- Install a VPN before you arrive, because VPN websites and app-store listings are often blocked inside restrictive countries.
Methodology and limitations
The table draws on Freedom House’s Freedom on the Net and Freedom in the World reports, primary legal texts where available, and reporting by RFE/RL, RFA, Human Rights Watch, Mediazona, Meduza, The Moscow Times and regional outlets. Each claim links to its source. Where the legal basis is a regulator’s statement or a secondary legal analysis rather than published legislation, the text says so.
Some 2025 Freedom House country reports are abridged, so 2024 editions are cited where they contain more VPN detail. Enforcement data are anecdotal: no government publishes statistics on VPN prosecutions. For Turkmenistan, Oman and Egypt, the legal position is ambiguous and is described that way, without a firm label. The list covers the jurisdictions most often cited for VPN restrictions, so countries not listed are not necessarily VPN-friendly.