The short answer
In the overwhelming majority of countries — the whole of the EU, the UK, the US, Canada, Australia, Japan, India, Brazil, most of Africa and Latin America — using a VPN is entirely legal, unremarkable, and done daily by banks, hospitals and governments. There is no licence, no registration and no restriction.
A handful of countries treat it differently, and the differences are more specific than headlines suggest. In every case the distinction that matters is between using a VPN and operating or selling one, and between what the statute says and what is actually enforced.
The countries with restrictions
China. No published statute makes personal use a crime. A 2017 notice from the Ministry of Industry and Information Technology targets unlicensed VPN operators and resellers, and a small number of individuals have been fined about ¥1,000 under older network-access regulations. Foreign visitors have never been prosecuted. The real risk is technical: the connection stops working. See the China guide.
Iran. The strictest of the group. Selling VPNs without a licence has long been criminal, and a February 2024 resolution of the Supreme Council of Cyberspace made using an unlicensed VPN an offence in principle. In practice most of the country uses one, and enforcement falls on sellers and on activists whose online activity is the actual charge. See the Iran guide.
Russia. Personal use is not an offence. A 2017 law requires providers to filter the state blocklist, which foreign providers refused, so they are blocked instead. Since March 2024 advertising VPNs is an offence, and since September 2025 deliberately searching for material on the “extremist” list is an administrative offence even through a VPN. See the Russia guide.
United Arab Emirates. Using a VPN is legal. Article 10 of the 2021 cybercrime law penalises using one to commit or conceal a crime, with fines from AED 500,000. Because gambling, adult content and unlicensed VoIP are themselves restricted, using a VPN to reach them is within scope. Ordinary use is not. See the UAE guide.
Turkey. Legal to use. The regulator can and does order ISPs to block specific VPN providers’ services, and the 2022 disinformation law criminalises spreading false information online regardless of how it was posted. See the Turkey guide.
Others with meaningful restrictions include Oman, Belarus, Turkmenistan and North Korea, where the rules range from licensing requirements to outright prohibition.
Visitor versus resident
This distinction is under-discussed and it matters. A tourist in China or the UAE using a VPN for email and streaming is in a materially different position from a citizen using one to publish criticism of the government. The statute may read the same; the enforcement does not. Every country page on this site states the law and then says, separately, what has actually happened to people.
What stays illegal either way
A VPN is not a legal shield. Copyright infringement is still infringement — Germany’s Abmahnung industry and the US settlement-demand cases exist regardless. Fraud, harassment, buying prohibited goods and accessing prohibited material remain offences. What a VPN changes is the difficulty of attributing the act to you, which is not the same as making it lawful, and in the UAE and Russia the use of a VPN in the course of an offence is itself an aggravating factor.
Terms of service are not law
Streaming services, some gaming platforms and a few retailers prohibit VPN use in their terms. Breaching a contract is not a crime. In practice the platforms respond by blocking the connection, and no major streaming service has been reported suspending accounts for it. Buying region-priced subscriptions through a VPN is the behaviour that does get accounts flagged, because it costs the company money rather than merely annoying it.