Are VPNs Legal? Where VPNs Are Being Restricted in 2026

Key Takeaway:
In the US, the UK and almost all of Europe, using a VPN is legal, and that hasn’t changed in 2026. What has changed is that lawmakers keep trying: Utah passed the first US state law aimed at VPN users (a judge has blocked its key part), Wisconsin dropped a VPN clause and its governor then vetoed the whole bill, a Michigan bill would make internet providers block VPNs, and a new bill in Congress would let courts order VPNs to block piracy sites. The UK considered age-restricting VPNs and decided in July 2026 not to. Real VPN bans exist, but in countries like China, Russia and Iran, where the state already controls the internet.

Most VPN restrictions being proposed in 2026 don’t start out as VPN laws. They start as age-verification laws for adult websites or as anti-piracy laws, and then run into the same problem: a VPN lets anyone appear to be somewhere else. So a VPN clause gets added. Here’s what each proposal actually does, where it stands as of October 2026, and why banning VPNs is much harder than it sounds.

This is a plain-English summary, not legal advice. Laws change; the sources at the end are where to check the current position.

The Three Ways Governments Go After VPNs

Almost every restriction falls into one of three types, and they affect you very differently:

Block the people using them. Websites are told to detect VPN connections and refuse them, usually so an age check or a regional rule can’t be avoided. You can still use a VPN; some sites just won’t let you in with one. Utah and the original Wisconsin bill took this route.
Make the VPN do the blocking. VPN companies are ordered to stop their users reaching certain sites, the way some countries already order internet providers to. The new US piracy bill works like this.
Ban or license the VPNs themselves. Only government-approved VPNs are allowed, and internet providers are made to block the rest. This is what China, Russia and Iran do, and what the Michigan bill would attempt.

🇺🇸 The United States: Fights in the States, and Now in Congress

There is no federal law against using a VPN in the US. The action is in state legislatures, which have spent two years passing age-verification laws for adult sites, and those laws keep colliding with VPNs.

Utah: the first law, now partly blocked

Utah’s SB 73 made it the first state to require websites to treat a visitor by their actual location, not the location their VPN shows. On 24 September 2026 a federal judge blocked that “actual location” requirement, accepting the argument that perfect geolocation isn’t possible. The rest of Utah’s age-verification law still applies. The full story is in our article on Utah’s VPN law being blocked.

Wisconsin: VPN clause dropped, then the bill vetoed

Wisconsin’s age-verification bill (AB 105 / SB 130) originally required adult sites to block every visitor connecting through a VPN. After a wave of criticism, lawmakers struck that clause in February 2026. The bill passed without it, and on 3 April 2026 Governor Tony Evers vetoed it anyway, on privacy grounds: it would have pushed adults to upload ID documents or face scans, with no limits on passing that data on to third parties. Wisconsin has no VPN restriction.

Michigan: the most extreme proposal, still in committee

Michigan’s HB 4938, the “Anticorruption of Public Morals Act”, was introduced on 11 September 2025 and goes much further than the others. Alongside banning a wide range of online content for all users, not just children, it treats VPNs, proxies and encrypted tunnels as “circumvention tools” and, as reported, would require internet providers to block them, with fines of up to $500,000. It was sent to the House Judiciary Committee, and we found no record of it moving since. Critics point out that it would also break the VPNs businesses, schools and remote workers rely on every day.

Congress: a piracy bill that names VPNs

In September 2026, Rep. Darrell Issa introduced the American Copyright Protection Act (H.R. 10364). It would let copyright owners get a court to label a foreign website a “foreign piracy site”, and then get orders requiring internet providers, DNS services and VPN providers to stop US users reaching it. Smaller services, under 100,000 US users, are exempt. The EFF opposes it, arguing that a site can be labelled without even appearing in court and that the bill reaches into tools people use to stay safe online. A competing bill, the DEFEND IP Act (H.R. 10575), targets internet providers and DNS resolvers but leaves VPNs out. Neither had had a hearing as of mid-October.

Pushback is organised, too: on 25 September 2026 the group Fight for the Future held its second “Defend VPNs” day of action, asking people to contact lawmakers.

🇬🇧 The United Kingdom: Considered, Then Ruled Out (for Now)

When the Online Safety Act’s age checks began in July 2025, VPN downloads in the UK jumped, and the pressure to do something about it followed. In January 2026 the House of Lords voted 207 to 159 for an amendment requiring rules to stop VPN services being provided to children, and the resulting Children’s Wellbeing and Schools Act gave the government the power to act once it had consulted.

It consulted from March to May 2026, asking whether children’s VPN use should be limited and even whether everyone should pass an age check to use one. The answer, in the government’s July 2026 response, was direct: “We will not ban or age-gate VPNs.” It noted that children mostly get around age checks in simpler ways, that young people have legitimate reasons to use VPNs, and that age-gating could push people towards riskier VPN services. Instead it has asked Ofcom to research how websites can spot circumvention, and asked VPN providers to work with government on making their products less accessible to children. The government also said it will keep the issue under review, so this may come back.

For now, adults in the UK can legally buy, download and use a VPN.

Where VPNs Really Are Restricted

Outright bans and licensing schemes exist, but they’re found where the state already filters the internet heavily. Rules and enforcement change, so treat this as a starting point and check the current position before you travel.

Country	What the rules say
China	Only government-approved VPNs are allowed; others are blocked by the national firewall, and unapproved VPN apps were removed from app stores.
Russia	VPNs must connect to the state blocklist or be blocked; advertising VPNs is banned, and many services and protocols are blocked.
Iran	Only state-approved VPNs are legal, although unapproved ones are widely used and blocking tightens during unrest.
Myanmar	A 2025 cybersecurity law penalises unauthorised VPN services.
United Arab Emirates	VPNs are widely used by businesses, but using one to commit a crime or reach blocked services is punishable.
India	Legal, but 2022 rules require VPN companies to keep user records for years, which led several providers to remove their servers from the country.
North Korea, Turkmenistan	Ordinary internet access is so restricted that consumer VPNs are effectively banned.

🔍 Why a VPN Ban Is So Hard to Make Work

A VPN isn’t a special kind of internet. It’s an ordinary encrypted connection to a server somewhere else, the same technology companies use so staff can reach work systems from home. (Our plain-English guide to VPNs covers how it works.) That creates three problems for any law that targets them:

Detection is guesswork. Websites spot VPNs mainly by their IP address: VPN servers sit in data centres, and lists of data-centre ranges are easy to buy. That catches most commercial VPNs, but it also catches cloud services and some mobile networks, and misses VPNs that use residential IP addresses. You can see the same signal for yourself: our IP checker labels your connection “VPN or datacentre network” when it comes from one of those ranges.
Location can’t be pinned down. A website only ever sees an IP address and a database’s best guess of where it is, which is often tens of kilometres out even without a VPN. That’s the point the Utah judge accepted. More on why in how accurate IP geolocation is.
The collateral damage is huge. Internet providers can’t easily tell a remote worker’s company VPN from a consumer one. Countries that block VPNs at scale do it with deep packet inspection, which looks at the shape of the traffic itself, and even then VPN services keep adding disguise modes to slip past it.

What This Means for You

In the US, the UK and the EU, using a VPN is legal. What a site can do is refuse to serve you while you’re on one, or ask for an age check anyway.
A VPN doesn’t change what’s legal. Breaking the law through a VPN is still breaking the law, and streaming services can ban VPN use in their terms even where it’s legal. See what Netflix does and doesn’t allow.
If you travel, check the destination. The countries in the table above are the ones where using an unapproved VPN can get you in trouble, not just blocked.
Check that yours actually works. A VPN that leaks your real address doesn’t protect you from anything. The VPN leak test checks your visible IP, WebRTC and IPv6 in about ten seconds.

Frequently Asked Questions

Are VPNs legal in the United States?

Yes. No federal or state law bans using one. Utah requires some websites to deal with VPN users, but a judge has blocked its key part, and Michigan’s proposed ban hasn’t moved out of committee.

Is the UK banning VPNs?

No. The government considered age-restricting them and said in July 2026 that it will not ban or age-gate VPNs, though it will keep the issue under review.

Can my internet provider see that I’m using a VPN?

Usually, yes. It can see that you’re connected to a VPN server and how much data you send, but not which websites you visit or what you do on them. What your ISP can see explains the difference.

Can a website tell I’m using a VPN?

Often. Most VPN servers use data-centre IP addresses, and many sites check for those. It can’t see who you are or where you really are, unless your VPN leaks.

Will VPN companies have to block websites in the US?

Only if the American Copyright Protection Act or something like it becomes law, and only for sites a court has labelled foreign piracy sites. The bill was introduced in September 2026 and hasn’t had a hearing.

Are VPNs Legal? Where Governments Are Restricting Them in 2026