Is using a VPN legal and safe? What it fixes and what it doesn't

What a VPN actually does

A VPN (virtual private network) builds an encrypted tunnel (a scrambled connection that outsiders cannot read) from your device to a server run by the VPN provider. From there, your traffic continues to the websites you visit.

Two things change. First, your internet provider and the owner of the local network, such as a hotel or a cafe, can no longer see which websites you visit. Second, websites see the VPN server's IP address (the number that identifies an internet connection) instead of yours. That is why a VPN can make you appear to be in another country.

Germany's Federal Office for Information Security (BSI) points out two limits. The encryption only covers the path between your device and the VPN server. And a VPN usually makes your connection somewhat slower.

Is using a VPN legal?

In Germany and the rest of the EU we found no law that bans using a VPN. The BSI even describes watching a German TV media library while on holiday abroad as a useful application. At the same time, the BSI reminds readers that some countries do forbid VPNs.

Rules elsewhere can be strict. The UK government's travel advice says that, under China's cybersecurity laws, online services such as VPNs need a licence from the Chinese government. The same advice says VPNs are illegal in Turkmenistan and are usually blocked as soon as the authorities identify them. Iran has blocked VPNs without government approval since 2013, and Russia has banned various VPN services, according to the Wikipedia overview of VPN blocking.

Two more points matter. A legal VPN does not make an illegal act legal. And laws change, so check the current official travel advice for the country you are in. This guide is general information, not legal advice.

Legal is not the same as allowed by the service

Many websites and streaming services decide in their own terms of use where you may watch. Terms of use are a contract with the service. If you break them, the service can refuse to play content or limit your access.

Netflix is a clear example. Its terms say you may watch primarily in the country where you set up your account, and they forbid getting around its content protections. Its help centre describes the error "You seem to be using a VPN or proxy" and says VPNs are not supported for live events or on the ad-supported plan.

So before you use a VPN for streaming, check whether a free and permitted route exists. Inside the EU, paid services must keep working while you travel; our guide on streaming in the EU explains how.

What a VPN hides and what it does not

The digital rights group EFF warns that VPN advertising often promises far more than a VPN can deliver. Here is a realistic picture.

• Hidden from your internet provider and the local network: which websites you visit. This helps on a public network you do not trust.
• Hidden from websites: your real IP address and therefore your approximate location.
• Not hidden from the VPN provider: it can see the traffic your internet provider would otherwise see. You move your trust from one company to another.
• Not anonymous: websites can still recognise you through logins, cookies (small files that remember you), tracking pixels and browser fingerprinting (recognising a browser by its settings).
• Less important on public Wi-Fi than it used to be: most web traffic is already encrypted with HTTPS (the lock symbol), which protects the content of your visits.
• Not out of reach of the law: the provider must follow the laws of the countries where it does business and can receive requests from authorities.

How to judge a VPN provider

Because all your traffic flows through the provider, the BSI calls choosing one a matter of trust. The checks below help you decide whom to trust.

Our comparison at /vpn turns checks like these into points from public documents, with a source and a date for every fact. Whether we earn a commission plays no part in the points or the order.

• Independent no-logs audit: an outside firm checks whether the provider really keeps no records of what you do. Look for the auditor's name, the date and what was checked. Proton VPN, for example, says it has passed five yearly no-logs audits and links the reports; the latest is by the firm Securitum. Mullvad publishes infrastructure and app audits by firms such as Cure53 and Radically Open Security. EFF reminds readers that an audit is a snapshot: practices can change afterwards.
• Jurisdiction (the country whose laws apply to the company): the BSI notes that German data-protection law does not apply to servers abroad. EFF advises checking where a provider does business and when it hands data to authorities.
• Open-source apps (apps whose code anyone can read): experts can check what the app really does. Proton VPN publishes its Windows, Android, iOS/macOS and Linux apps on GitHub, and Mullvad keeps its desktop and mobile app code in one public repository.
• Refund rules: read them before you pay. NordVPN, for example, offers 30 days for new subscriptions but says purchases through Apple's App Store follow Apple's refund rules. Windscribe refunds only within 7 business days and while usage stays below 10 GB.
• Business model: ask how the service pays for itself. EFF notes that some free VPNs sell user data.
• Modern protocols: EFF names WireGuard and OpenVPN as common choices and warns that the old PPTP protocol uses broken encryption.

Are free VPNs safe?

Some are, many are not. The BSI warns that people often pay for a free VPN with their personal data, which can be analysed for marketing, and that free plans usually come with limits or poorer connections.

EFF adds that an app in an official app store is not automatically trustworthy. A VPN app there can still collect and share data or even distribute malware.

A free plan from a provider that also sells paid plans can be a reasonable way to test. Our comparison notes which providers offer one. Be careful with any free VPN that does not explain how it earns money.

When not to use a VPN

A VPN is a tool for a few specific jobs. In the situations below it often causes more trouble than it solves. Switching it off for a moment is usually the quickest test.

• Online banking and important accounts: security systems look at where a login comes from. Google, for example, may block a sign-in when it does not recognise the device or the location. A VPN changes the location these systems see, which can trigger extra checks or a temporary block.
• Security codes and two-factor sign-ins (a second step, such as a code on your phone): if a code or an approval keeps failing, switch the VPN off and try again from your normal connection.
• Streaming on plans or at events that do not support VPNs, such as Netflix live events or its ad-supported plan.
• Websites that show a bot check (a test that asks you to prove you are human): the check is not a country block, so a VPN is the wrong tool.
• Countries that restrict VPNs: follow local law and the current official travel advice.
• Technical errors such as DNS, certificate or server errors: a VPN does not repair the website.

More guides

• Website blocked in your country or just down? How to tell the difference The signs of a country block (HTTP 451, Cloudflare 1009, region messages) versus an outage, a five-minute self-test, and when a VPN helps or does not.
• Watching your streaming subscription while travelling in the EU EU Regulation 2017/1128 lets you use paid streaming subscriptions while visiting another EU country. Who it covers, how checks work, what to do if blocked.