From Naypyidaw to Novosibirsk: A Global Snapshot of the Countries Criminalizing VPN Use in 2026

While Western democracies debate registration regimes and advertising restrictions, a smaller but growing group of governments has already moved well past the discussion stage. In these countries, using or providing a VPN is not a matter of ongoing legislative debate — it is a criminal offense, sometimes carrying prison time, sometimes carrying extraterritorial reach that follows citizens even when they leave the country. As Western regulators inch toward tighter VPN oversight, this global tier of outright bans offers a preview of where more aggressive versions of that regulatory instinct can ultimately lead.

The Clearest Case: Myanmar’s Cybersecurity Law

Perhaps the starkest recent example comes from Myanmar, where a sweeping Cybersecurity Law formally came into force roughly a year ago, criminalizing the provision of VPN services without explicit government approval. Penalties under the law include several months of imprisonment and fines for individuals found operating or providing unauthorized VPN access, and the statute notably includes extraterritorial provisions allowing Myanmar citizens abroad to be prosecuted for VPN-related activity even outside the country’s borders.

The legal crackdown followed an earlier, more improvised phase of enforcement, in which the ruling authorities ordered internet service providers to block VPN applications alongside major social media platforms, while simultaneously deploying network-level surveillance infrastructure reportedly capable of intercepting and attempting to decrypt VPN traffic. The subsequent formal law represented a shift from ad hoc technical blocking toward a codified legal framework — arguably a more durable and more easily enforced form of restriction, since it creates clear criminal liability rather than relying solely on a technical cat-and-mouse game between state censors and VPN providers.

The Established Bans: A Small But Consistent List

Myanmar joins a short list of countries where VPN use is comprehensively illegal, a list that has remained relatively stable in recent years:

• North Korea maintains what is widely regarded as the most restrictive internet environment in the world, with virtually no legal path to unauthorized VPN use for ordinary citizens.
• Belarus has banned VPN and Tor usage as part of a broader crackdown on internet freedom following years of political unrest.
• Turkmenistan maintains extensive state control over internet infrastructure, with VPN use effectively prohibited in practice even where not always explicitly named in statute.
• Oman restricts VPN use primarily through licensing requirements that make unauthorized use illegal for most residents and visitors.

The Larger “Restricted But Not Banned” Tier

Beyond the small number of outright bans sits a much larger and more consequential group of countries that heavily restrict, rather than fully prohibit, VPN use — a category that includes some of the world’s largest economies and internet populations:

• China permits only government-approved VPN services, primarily intended for business use, while blocking unauthorized providers through the country’s extensive filtering infrastructure. Unauthorized VPN use exists in a persistent legal gray zone, tolerated in practice for many ordinary users but subject to periodic, often unpredictable enforcement waves.
• Russia has progressively tightened restrictions on VPN providers, requiring registration and blocking services that fail to comply with content-filtering demands, while maintaining criminal and administrative penalties for services facilitating access to blocked content.
• Iran restricts VPN use to a small number of licensed providers, with unauthorized VPN use widespread in practice despite significant legal risk, reflecting a familiar pattern in which restrictive laws coexist with widespread circumvention by a tech-literate population.
• Türkiye, the United Arab Emirates, Egypt, and Uganda each maintain their own variations of heavy restriction, typically combining licensing requirements with selective enforcement against providers and, in some cases, individual users.
• India has introduced data-retention and registration requirements for VPN providers that have prompted several major international providers to withdraw physical servers from the country entirely, opting instead to offer virtual server locations from outside its borders rather than comply with local logging mandates.

The Pattern Connecting Authoritarian Bans to Democratic Debates

What makes this global tier relevant to the current debates in London, Brussels, Canberra, and dozens of U.S. statehouses is not that democracies are on the verge of adopting Myanmar-style criminal penalties — virtually no serious policymaker in any of those jurisdictions is proposing anything close to that. Rather, it is that every restrictive regime in this list began, in some form, with a narrower stated justification: protecting national security, protecting children, preventing the spread of illegal content, or maintaining social stability. The technical and legal machinery built to serve those narrower justifications has, in nearly every case, expanded over time to cover a broader set of restrictions than initially proposed.

Digital rights researchers who track VPN legislation across jurisdictions describe this as a recognizable trajectory: informal blocking gives way to formal registration requirements, registration requirements give way to content-cooperation mandates, and content-cooperation mandates can, under the right political conditions, give way to outright prohibition. Not every country follows this full trajectory, and most democracies show no current sign of moving past its earliest stages. But the pattern is consistent enough that comparative legal scholars increasingly treat the authoritarian tier not as a separate category entirely disconnected from Western debates, but as a preview of where the underlying regulatory logic can lead if left unchecked by judicial review, free press scrutiny, and organized civil society pushback.

“Every government that has ever fully banned VPNs started by describing a narrower problem it wanted to solve. The lesson for democracies currently debating registration and disclosure regimes isn’t that they’re on the same path as Myanmar — most clearly are not — it’s that the legal tools being built now could, in a different political climate, be repurposed for far more than their original stated goal,” said a researcher at an international digital rights monitoring organization.

The Economics of a VPN Ban

Beyond the legal and human rights dimensions, outright VPN bans carry measurable economic costs that researchers have increasingly attempted to quantify. Studies examining internet restrictions in several of the countries on this list have found that broad connectivity disruptions and VPN crackdowns tend to coincide with reduced foreign investment, disrupted remote work arrangements for multinational employers with local staff, and diminished participation in the global digital economy more broadly, since modern international business increasingly depends on secure remote connectivity that heavily restrictive VPN regimes directly undermine.

This economic dimension helps explain why even governments strongly inclined toward tighter internet control often carve out explicit exceptions for licensed business use, as seen in China’s approval process for corporate VPN services. The tension between wanting tight control over ordinary citizens’ internet access and needing to preserve enough connectivity to remain attractive to international business and investment is a recurring theme across nearly every country on this list, and it shapes how these restrictions are actually designed and enforced far more than their public statutory language sometimes suggests.

Civil Society Responses and Circumvention Culture

In every country on this list, restrictive VPN policy has been met with organized and often resourceful circumvention efforts from local civil society, journalists, and ordinary technically-inclined citizens. Digital rights organizations operating in exile or underground have historically distributed alternative circumvention tools, mirrored blocked VPN provider websites, and published country-specific guidance helping residents evaluate which tools remain functional as government blocking techniques evolve. This ongoing technical arms race, blocking followed by circumvention followed by more sophisticated blocking, has repeated itself across nearly every jurisdiction in this article, and there is little indication that either side is close to a decisive, lasting advantage.

Practical Guidance for Travelers and Global Users

For individuals traveling to or living in jurisdictions with restricted or banned VPN status, the legal risk is genuinely significant and varies enormously by country. Useful principles include:

• Research the specific current legal status before traveling, since restrictions in this space change more frequently than most travelers expect, and enforcement intensity can shift with little public notice.
• Understand that “illegal” does not always mean “unenforced,” and conversely that widespread tolerance in practice does not mean the underlying legal risk has disappeared — enforcement waves in several restricted markets have historically arrived with little warning.
• Extraterritorial provisions, as seen in Myanmar’s law, are a growing and under-appreciated risk for citizens and dual nationals who may assume that leaving a restrictive country’s borders also leaves behind its legal jurisdiction.
• Business travelers relying on VPNs for secure corporate access should confirm with their employer’s legal and security teams whether their destination country has government-approved alternatives or reporting obligations that differ from consumer VPN use.

Closing Thoughts

The global map of VPN legality is far from static, and the direction of travel in 2026 points toward tighter restriction almost everywhere, whether through the criminal statutes of Myanmar and Belarus or the registration debates unfolding in London and Brussels. For an industry built on the premise of open, borderless internet access, that trend represents the central regulatory challenge of the decade.

Perhaps the most important lesson from this global snapshot is that legal status alone rarely tells the whole story. A country can maintain restrictive statutes while tolerating widespread everyday use, just as a country with no formal VPN law at all can still create a hostile environment for the technology through informal pressure on providers or aggressive network-level interference. Understanding the practical reality in any given jurisdiction, not just the text of its statutes, remains essential for anyone whose safety, livelihood, or basic communication depends on reliable, private internet access. Tedony will continue tracking legal status changes across every major jurisdiction as this global picture continues to evolve.