Here’s more on their methodology:
Our researchers looked for evidence of VPN restrictions through official and media publications. Depending on the information found, each country was classed according to one of four categories:
- “No evidence,”
- “Restricted in the past,”
- “Currently restricted,”
- and “Possible restrictions.”
The latter category comprises countries with sufficient evidence to infer VPN restrictions but not enough to confirm them.
An example would be North Korea, where the internet is heavily restricted, but no official statement on VPN restrictions could be found.
Here’s more of their data by country:
| Country | Current Restriction Status | Start date | End date | More on the restrictions |
|---|---|---|---|---|
| Egypt | Currently restricted | 8/18/2018 | Ongoing | Egypt’s President signed the Anti-Cyber and Information Technology Crimes legislation into law on August 18, 2018. The anti-cybercrime law gave the Egyptian government the power to block any websites it deemed to be a threat to national security and national economy. People who attempt to access the blocked websites, for example by using VPNs, could also be sentenced to 1 year in jail or a fine of up to EGP100,000. |
| Tanzania | Currently restricted | 7/17/2020 | Ongoing | On July 17, 2020, a new set of Electronic and Postal Communications (Online Content) Regulations were passed. As per one of the regulations, “a person shall not render, possess or distribute technology, program, application or any other related thing that allows or helps users to have access to prohibited content", meaning the use of VPN technology to access restricted content was made illegal. The regulations include ten different categories of prohibited content. The definitions received a lot of criticism for being vague and overly broad, creating space for censorship. |
| China | Currently restricted | 1/22/2017 | Ongoing | In January of 2017, China's Ministry of Industry and Information Technology (MIIT) announced a more than a year-long campaign to overhaul internet access services. The MIIT issued a notice on January 22nd making it unlawful to provide circumvention tools without the ministry’s pre-approval. In July of 2017, Apple removed 674 VPNs from its App Store in China, citing compliance with government regulations. In August of 2017, the Cyberspace Administration of China (CAC) ordered five websites, including shopping giant Alibaba, to remove vendors that offered access to VPNs. |
| India | Currently restricted | 4/28/2022 | Ongoing | On April 28, 2022, India's cyber agency Computer Emergency Response Team (CERT-In) issued a directive saying that data centers, VPN, VPS and Cloud service providers operating in India are required to store customer logs for 5 years. In June of 2022, the Indian government barred its employees from using third-party VPN and anonymization services. |
| Iran | Currently restricted | 03/10/2013 | Ongoing | In 2013, the government blocked "illegal" VPN access and said "only legal and registered VPNs can from now on be used", although no law was passed. In 2017, MTN Irancell announced that consumers using VPNs will not receive a 50% discount when visiting domestic websites, discouraging VPN use. In 2020, it was announced that the CDICC had drafted a regulation for establishing a "legal VPN" scheme. People would have to apply to purchase VPNs and secure approval from the government based on their need, with factors potentially including one's profession. In 2022, several key provisions to the “Regulatory System for Cyberspace Services Bill” were made. If passed into law, control over key communication infrastructure will be delegated to armed forces and security agencies. One of the bill's chapters, in practice, would lead to the introduction of a blanket ban against all international services, including encrypted communication tools. Access to services provided by companies that do not comply with the government's requirements would be throttled and could be banned from operating in Iran. |
| Iraq | Currently restricted | 6/15/2014 | Ongoing | During the war with IS, the government disabled the internet in certain regions, blocked social media websites, and instituted restrictions on VPNs as part of their defense strategy: "Due to the current national security concerns and the exceptional developing situation in our beloved country, the national security advisory board has decreed the following: Firstly, stopping all Internet services completely and absolutely for the districts of Nineveh, Al-Anbar, Saladin, Kirkuk, Diyala. Secondly, stopping all access to Virtual Private Networks (VPN) in all of Iraq starting at 4:00PM and until 7:00AM daily. Thirdly, stopping all access to the following Internet applications in all of Iraq: Facebook, YouTube, WhatsApp, Viber and Skype." While it is still technically illegal to use circumvention tools, the ban is not strongly enforced. |
| Myanmar | Currently restricted | 1/13/2022 | Ongoing | On Jan 13, 2022, Myanmar's military junta issued a draft bill that would ban the use of VPNs and punish those who use them with fines and/or a jail sentence. Even though the law hasn't officially been passed yet, there are reports of junta officials already using it to check people's phones for VPN software. |
| Oman | Currently restricted | 8/27/2010 | Ongoing | In August, 2010, Oman’s Telecom Regulation Authority (TRA) made a call for Public Consultation/Opinion on a regulation to be made a law that would prohibit the use of VPNs. The proposed law imposed a fine of 500 Omani Rial on individuals and 1,000 Omani Rial on companies without the proper permit. Note: could not find any sources confirming the law had been passed. |
| Pakistan | Currently restricted | 3/15/2010 | Ongoing | On March 15, 2010, the Pakistan Telecommunication Authority (PTA) published Monitoring and Reconciliation of Telephony Traffic Regulations (MRITT). In August of 2011, the PTA sent a legal notice to all ISPs, ordering them to inform authorities if any of their customers are using VPNs. As per Freedom House, "the mandate was never properly implemented". In May of 2014, the PTA issued a notice requiring VPN users to "apply to PTA for registration of their VPN connections through their respective service providers". The same type of notices were again issued in June of 2020 and September of 2022. As per Digital Rights Foundation, the PTA claims to use the 2010 MRITT as the base for these notices. |
| Turkey | Currently restricted | 11/04/2016 | Ongoing | On November 4th, 2016, the Information and Communication Technologies Authority ordered ISPs to block Tor and several VPN providers. Earlier in the day, the government had already blocked various social media and online communication tools. The independent monitoring organization TurkeyBlocks had also reported throttling and other forms of censorship, linking the disruptions and blocks to the arrests of pro-Kurdish party leaders. |
| Turkmenistan | Currently restricted | 12/01/2014 | Ongoing | A new law, “On legal regulation of the Internet development and Internet services in Turkmenistan”, adopted in December 2014, put in place restrictive regulations, including disproportionate limitations on online content for overly broadly defined activities. Note: many sources list 2015 as the year of the ban, although OSCE listed December, 2014. While the use of anonymizing technology doesn't seem to have been addressed directly, sources state that as per the law, "attempts to use proxy servers and VPN are detected and blocked; their users are subjected to administrative penalties and summoned for “preventive conversations” to the Ministry of National Security, where they face intimidation." There are reports of VPN restrictions having intensified in 2019, 2021 and 2022. |
| The U.A.E. | Currently restricted | 11/12/2012 | Ongoing | The president of the UAE issued a decree on combating cybercrimes on November 12, 2012, and an amendment for it in 2016. While the 2016 amendment was widely reported as the beginning of VPN restrictions in the UAE, Kellie Blyth, a UAE-based lawyer who specialises in telecommunications, media and commercial laws, clarified the situation to Gulf News: “The legal position regarding the use of VPNs in the UAE has not changed. It was and remains an offence to use VPN to commit a crime, or to try to prevent its discovery <...> Previously, the potential fines ranged from Dh150,000 to Dh500,000. Now, they have been increased to any amount from Dh500,000 to Dh2 million. This is in addition to a potential custodial sentence, which existed previously". The Telecommunications and Digital Government Regulatory Authority (TDRA) supported this view in a more detailed statement which said the law wasn't new in its essence, and that the only changes were related to tightening the penalty or punishment for any violation. |
| Belarus | Currently restricted | 2/19/2015 | Ongoing | On February 19th, 2015, the Communications Ministry published a decree that mandates how access to certain online resources should be limited by Internet providers at the request of the state. Some of the limitations deal directly with anonymizing services: "The state inspection, upon discovering Internet resources, anonymizing services (proxy-servers, anonymous networks like Tor and others), that allow Internet users to access online resources whose identifiers are included on the limited access list, will add the identifiers of these Internet resources and anonymizing services to the list as well." |
| Russia | Currently restricted | 11/01/2017 | Ongoing | On November 1st, 2017, a law prohibiting technology that provides anonymous access to banned websites came into force. The law, approved by the Duma, banned the use of VPNs and other technologies, known as anonymizers, that allow people to surf the web anonymously. Not much had been done to enforce the law until March 28, 2019, when Russia's online regulator, Roskomnadzor, said it had written to 10 popular VPN services to demand they connect their systems to the watchdog's blacklist of banned websites, so their users are no longer able to view the forbidden content. They were given 30 days in which to do so, failing which, "Roskomnadzor may decide to restrict access to the VPN service." Only one provider - Kaspersky Lab - complied. More VPN providers were blocked in 2021. |
| Algeria | No evidence | |||
| Angola | No evidence | |||
| Benin | No evidence | |||
| Botswana | No evidence | |||
| Burkina Faso | No evidence | |||
| Burundi | No evidence | |||
| Cameroon | No evidence | |||
| Cabo Verde | No evidence | |||
| The Central African Republic | No evidence | |||
| Chad | No evidence | |||
| Comoros | No evidence | |||
| Congo | No evidence | |||
| Ivory Coast | No evidence | |||
| Congo DR | No evidence | |||
| Djibouti | No evidence | |||
| Equatorial Guinea | No evidence | |||
| Eswatini | No evidence | |||
| Ethiopia | No evidence | |||
| Gabon | No evidence | |||
| Gambia | No evidence | |||
| Ghana | No evidence | |||
| Guinea | No evidence | |||
| Guinea-Bissau | No evidence | |||
| Kenya | No evidence | |||
| Lesotho | No evidence | |||
| Liberia | No evidence | |||
| Libya | No evidence | |||
| Madagascar | No evidence | |||
| Malawi | No evidence | |||
| Mali | No evidence | |||
| Mauritania | No evidence | |||
| Mauritius | No evidence | |||
| Morocco | No evidence | |||
| Mozambique | No evidence | |||
| Namibia | No evidence | |||
| Niger | No evidence | |||
| Nigeria | No evidence | |||
| Rwanda | No evidence | |||
| South Sudan | No evidence | |||
| São Tomé and Príncipe | No evidence | |||
| Senegal | No evidence | |||
| The Seychelles | No evidence | |||
| Sierra Leone | No evidence | |||
| Somalia | No evidence | |||
| South Africa | No evidence | |||
| Togo | No evidence | |||
| Tunisia | No evidence | |||
| Zambia | No evidence | |||
| Zimbabwe | No evidence | |||
| Afghanistan | No evidence | |||
| Armenia | No evidence | |||
| Azerbaijan | No evidence | |||
| Bangladesh | No evidence | |||
| Bhutan | No evidence | |||
| Brunei Darussalam | No evidence | |||
| Cambodia | No evidence | |||
| Georgia | No evidence | |||
| Hong Kong | No evidence | |||
| Israel | No evidence | |||
| Japan | No evidence | |||
| Kuwait | No evidence | |||
| Kyrgyzstan | No evidence | |||
| Laos | No evidence | |||
| Lebanon | No evidence | |||
| Malaysia | No evidence | |||
| The Maldives | No evidence | |||
| Mongolia | No evidence | |||
| Nepal | No evidence | |||
| The Philippines | No evidence | |||
| Qatar | No evidence | |||
| South Korea | No evidence | |||
| Singapore | No evidence | |||
| Syria | No evidence | |||
| Tajikistan | No evidence | |||
| Timor-Leste | No evidence | |||
| Taiwan | No evidence | |||
| Vietnam | No evidence | |||
| Yemen | No evidence | |||
| Albania | No evidence | |||
| Andorra | No evidence | |||
| Austria | No evidence | |||
| Belgium | No evidence | |||
| Bosnia and Herzegovina | No evidence | |||
| Bulgaria | No evidence | |||
| Croatia | No evidence | |||
| Cyprus | No evidence | |||
| Czechia | No evidence | |||
| Denmark | No evidence | |||
| Estonia | No evidence | |||
| Finland | No evidence | |||
| France | No evidence | |||
| Germany | No evidence | |||
| Greece | No evidence | |||
| Hungary | No evidence | |||
| Iceland | No evidence | |||
| Ireland | No evidence | |||
| Italy | No evidence | |||
| Latvia | No evidence | |||
| Liechtenstein | No evidence | |||
| Lithuania | No evidence | |||
| Luxembourg | No evidence | |||
| Malta | No evidence | |||
| Monaco | No evidence | |||
| Montenegro | No evidence | |||
| The Netherlands | No evidence | |||
| North Macedonia | No evidence | |||
| Norway | No evidence | |||
| Poland | No evidence | |||
| Portugal | No evidence | |||
| Moldova | No evidence | |||
| Romania | No evidence | |||
| San Marino | No evidence | |||
| Serbia | No evidence | |||
| Slovakia | No evidence | |||
| Slovenia | No evidence | |||
| Spain | No evidence | |||
| Sweden | No evidence | |||
| Switzerland | No evidence | |||
| Ukraine | No evidence | |||
| The U.K. | No evidence | |||
| Antigua and Barbuda | No evidence | |||
| Bahamas | No evidence | |||
| Barbados | No evidence | |||
| Belize | No evidence | |||
| Canada | No evidence | |||
| Costa Rica | No evidence | |||
| Dominica | No evidence | |||
| The Dominican Republic | No evidence | |||
| El Salvador | No evidence | |||
| Grenada | No evidence | |||
| Guatemala | No evidence | |||
| Haiti | No evidence | |||
| Honduras | No evidence | |||
| Jamaica | No evidence | |||
| Mexico | No evidence | |||
| Nicaragua | No evidence | |||
| Panama | No evidence | |||
| St. Kitts and Nevis | No evidence | |||
| St. Lucia | No evidence | |||
| St. Vincent and the Grenadines | No evidence | |||
| Trinidad and Tobago | No evidence | |||
| The U.S. | No evidence | |||
| Argentina | No evidence | |||
| Bolivia | No evidence | |||
| Brazil | No evidence | |||
| Chile | No evidence | |||
| Colombia | No evidence | |||
| Ecuador | No evidence | |||
| Guyana | No evidence | |||
| Paraguay | No evidence | |||
| Peru | No evidence | |||
| Suriname | No evidence | |||
| Uruguay | No evidence | |||
| Australia | No evidence | |||
| Fiji | No evidence | |||
| Kiribati | No evidence | |||
| The Marshall Islands | No evidence | |||
| Micronesia | No evidence | |||
| Nauru | No evidence | |||
| New Zealand | No evidence | |||
| Palau | No evidence | |||
| Papua New Guinea | No evidence | |||
| Samoa | No evidence | |||
| The Solomon Islands | No evidence | |||
| Tonga | No evidence | |||
| Tuvalu | No evidence | |||
| Vanuatu | No evidence | |||
| Eritrea | Possible restrictions (not enough evidence) | Unknown | Unknown | Eritrea is sometimes referred to as Africa's North Korea. State-run Eritrea Telecommunication Services Corporation (EriTel) is the sole operator of both landline and mobile telephone communication infrastructure, and the only internet service provider. Only around 1.3% of the population uses the internet (ITU, 2017). The internet is very slow (one source lists 1.7Mbps in 2017), and there is no mobile internet in the country. |
| Sudan | Possible restrictions (not enough evidence) | 04/01/2019 | Unknown | As per Freedom House, several free VPNs became inaccessible in April of 2019 amid social media blocks. |
| Bahrain | Possible restrictions (not enough evidence) | Unknown | Unknown | As per Freedom House, "internet freedom in Bahrain remains restricted". "The government restricts the use of many VPNs <...> Access to websites of popular VPNs and anonymity services like Hotspot Shield, Express VPN, and Tor are blocked, which makes it difficult to download their client applications. However, the connectivity and functioning of these VPN clients and Tor browsers remained unaffected during the coverage period." No sources for these statements are provided by Freedom House or could be found online. |
| North Korea | Possible restrictions (not enough evidence) | 01/01/2000 | Ongoing | North Korea has its own intranet (Kwangmyong) which opened in 2000, and it can be implied that resources like commercial VPNs are not accessible through it. |
| Indonesia | Possible restrictions (not enough evidence) | 03/01/2017 | Unknown | On July 7th, 2014, the Ministry of Communication and Information Technology (MCIT) published a decree under which Indonesian ISPs were granted the authority to ban “negative content” at their own discretion. As per Freedom House, an OONI report which covered the period of June 22nd, 2016, to March 1st, 2017, found that "three tools offering VPN services or anonymous browsing were subject to blocking". In the summer of 2019, a representative from the MCIT was cited as calling for regulations for licensing VPNs, although it's still not clear if, or when, such regulations could materialize. |
| Jordan | Possible restrictions (not enough evidence) | Unknown | Unknown | A number of VPN services were reportedly inaccessible two times during 2021 - in mid-March when Clubhouse was blocked following protests over an oxygen shortage that led to the deaths of COVID-19 patients, and in April amid a localized internet shutdown following what the authorities referred to as a coup attempt. As per Freedom House, "authorities failed to provide justification for these restrictions. Officially, the TRC is the entity responsible for issuing blocking orders to ISPs. However, the TRC has stated that it does not possess the authoritative power to restrict access to such services without a legal order <...> there had been no previous restrictions on VPNs in Jordan, although the TRC warned against their use in 2019". |
| Kazakhstan | Possible restrictions (not enough evidence) | Unknown | Unknown | In 2017, a Deputy Chairman of the State Control Committee was quoted as saying: "In principle, we solved the problem with anonymizers, but again, the process of their creation is constant, as and detection and blocking. To some extent, this is a fight against windmills. The task of countering illegal content is to limit the average Internet user from the risk of stumbling upon unwanted information by accident". On June 9th, 2019, NetBlocks reported that "VPN services were also blocked" amid internet and online service disruptions on the day of presidential elections. As per Freedom House, "many anonymizing tools are blocked" and "the authorities have confirmed that they can block VPNs using court decisions or orders from the MISD". As per an official response by the Ministry of Information and Social Development (MISD) to Freedom House's information request, "in 2020, the regulator blocked 148 circumvention tools". |
| Saudi Arabia | Possible restrictions (not enough evidence) | Unknown | Unknown | As per Freedom House, "the websites of many circumvention tools, such as Tor and major VPN providers, are blocked by the government", although no sources are provided or could be found via desk research. |
| Sri Lanka | Possible restrictions (not enough evidence) | 04/01/2021 | Unknown | As per NetBlocks, access to at least one major VPN provider was restricted on April 22nd, 2019, amid social media restrictions, following a series of scheduled bombings targeting churches and hotels. As per Freedom House, in April of 2021, "state-owned Sri Lanka Telecom (SLT) introduced unlimited data packages which blocked VPNs, torrents, peer-to-peer (P2P) applications, and messaging app Telegram as part of their terms and conditions". |
| Thailand | Possible restrictions (not enough evidence) | 2/20/2017 | Unknown | As per an OONI report, the website of at least one VPN provider had been blocked in February of 2017. As per Freedom House, the website of at least one internet circumvention tool had been blocked in February of 2021. |
| Uzbekistan | Possible restrictions (not enough evidence) | 09/01/2019 | Unknown | As per Freedom House, "in September 2019, users complained that several VPN services, including CyberGhost VPN, Express VPN, and NordVPN were blocked by Uztelecom". |
| Cuba | Possible restrictions (not enough evidence) | 10/14/2020 | 11/18/2020 | As per AccessNow, "users in Cuba have indicated that they have not been able to access Telegram since October 14, 2020, and also some neutral private networks (VPN)". As per Freedom House, Telegram and several popular VPNs were inaccessible for "approximately five weeks". A Cuban programmer cited by 14ymedio "explained that after the tests he has carried out to determine why the VPNs began to fail in October, he has found evidence of blocking by DPI (deep packet inspection). The expert also verified that in the case of some VPNs that were much more complex to block, the Cuban authorities' alternative was to prevent access to pages related to the service so that it would be difficult to find and download them. This was the case with one of the most popular VPNs, NordVPN, as he explained." |
| Venezuela | Possible restrictions (not enough evidence) | 2/15/2019 | Ongoing | According to user reports, and as reported by Freedom House and Venezuelan internet watchdog VE Sin Filtro, several VPN providers were blocked by state-run ISP CANTV and some other major ISPs for periods of time between 2019-2022 amid other internet restrictions due to political turmoil in the country. |
| Uganda | Restricted in the past | 07/01/2018 | 07/01/2021 | The government ordered ISPs to start blocking VPNs after people started massively using the technology to evade the social media (OTT) tax which was put into place on July 1st, 2018. The OTT tax was replaced by a general internet tax on July 1, 2021. A spokesperson of the Uganda Communications Commission (UCC) has been cited as saying: “Efforts have been made” to demand that telecom operators block VPN use in Uganda. But while some were indeed blocked for the most part, “It had,” he said, “not been successful.” |
Patrick Mahaffey says
Why do you assume that all of your readers know what VPN stands for? There is not one explanation of it so I had to look it up, and I am not a technophobe!