How to read this page

Two different questions hide under “is it legal”: can you get in trouble for using a VPN at all, and can the VPN’s use change the legal character of something else you do. Most restriction-tier countries police the second thing and the suppliers, not tourists checking email. That distinction is why the tiers below matter more than a binary yes/no map, and why every line here cites the rule rather than the rumour. Laws in this area move; this page carries a verification date for exactly that reason.

Country rules on this page last verified July 2026.

Tier 1: legal, unremarkable

Nearly everywhere you are likely to fly: all of the EU and EEA, the UK, the US and Canada, Japan, South Korea, Thailand, Vietnam, Indonesia, Australia, New Zealand, most of Latin America and Africa. VPN use is lawful, common and commercially ordinary; corporate travel policies frequently require it. Nothing to think about beyond the usual which-one question.

Tier 2: restricted, licensed, or partially blocked

China. Licensed-VPNs-only under the 2017 MIIT framework; enforcement aims at providers and sellers, and tourists using personal VPNs are not a documented enforcement target. The full picture, including what technically works, is in our China guide.

Russia. VPNs are not banned outright, but services refusing to filter content are blocked, advertising VPNs is prohibited, and the blocked list grows continually. Foreign visitors’ personal use is not a prosecution pattern; connectivity itself is the practical problem.

Iran. Only state-approved VPNs are legal, and the approved ones defeat the purpose. Enforcement against individuals exists but concentrates on sellers and political cases. Tourists should assume everything is monitored and act accordingly.

Türkiye and Egypt. VPN use is legal, but many VPN providers’ sites and protocols are blocked in waves, particularly around political events. Install before arrival, same rule as China.

India. Legal, with 2022 CERT-In rules requiring VPN providers to log user data or exit their Indian servers; most majors moved to virtual Indian servers abroad. Affects server choice, not legality of use.

Tier 3: banned, or close enough to treat as banned

North Korea and Turkmenistan ban circumvention outright. Belarus has banned anonymisers since 2015. Iraq maintains a formal ban enforced unevenly. Oman prohibits unlicensed VPN use under its telecom regulations, a ban long under-enforced for business travellers but formally on the books. The practical advice for all five is the same: these are not places to test the enforcement gap as a visitor. If work requires connectivity there, that is a conversation with your employer’s security team, not a consumer VPN purchase.

Myanmar belongs on this page’s restricted list too: post-2021 rules criminalised unauthorised VPN use amid wider internet shutdowns, with enforcement that is real but unevenly applied. Travellers still going should treat connectivity there the way this page treats Tier 3.

The UAE, because everyone asks

VPN use is legal in the UAE, where much of the business economy runs on it. The catch is Federal Decree-Law No. 34 of 2021: using a VPN to commit an offence, and the offence list includes accessing blocked services, brings fines reported up to AED 2 million. The infamous example is VoIP: WhatsApp and FaceTime calling are restricted, and using a VPN specifically to circumvent that is the textbook case the fine framework describes. Practical translation: a VPN for banking and browsing is normal; advertising that you are calling home over a VPN is unwise.

Blocked is not illegal: the network layer

A separate question travellers conflate with legality: plenty of networks block or throttle VPN traffic in countries where VPNs are perfectly lawful. Hotel and conference wifi sometimes blocks VPN protocols to enforce content filtering or simply through misconfiguration; airline wifi frequently blocks them for bandwidth reasons; university and corporate guest networks filter by policy. None of this carries legal meaning, and the fix is technical: obfuscated modes dress VPN traffic as ordinary HTTPS and pass through most such filtering, or you move to mobile data, where no venue’s network policy applies.

The reverse confusion also matters: a VPN connecting successfully tells you nothing about legality. In Tier 2 countries the connection often works precisely because enforcement focuses elsewhere, and treating “it connects” as “it’s fine” inverts the actual logic. The tiers above are about law; your connection quality is about network engineering; keep the two files separate and consult the right one for each decision.

One practical crossover: if VPN traffic is blocked at the network layer and you fall back to raw wifi, the ordinary public-network hygiene matters more, not less, so downshift what you do on that connection accordingly, and save the banking for mobile data.

The traveller’s rules of thumb

Install and test before you fly, always: every restricted country blocks the download more aggressively than the use. Prefer providers with obfuscation for Tier 2 travel, which in our lineup means the NordVPN obfuscated servers or Proton’s Stealth. Keep sensitive activity off networks you cannot judge regardless of legality, which is the ordinary hotel-wifi hygiene that applies everywhere. And when a country sits in Tier 3, believe the tier.