Are VPNs Legal in India? The Tunnel Isn't Permission
India hasn't banned the VPN button. It has put serious duties around the companies behind it—and using a tunnel doesn't excuse what travels through it. The connection can be legal while the activity isn't. Same VPN. Two different questions.
Open a company laptop in a Bengaluru hotel. Its approved employer VPN reaches a private work dashboard. A consumer app on a personal phone can also build a tunnel, but it has a different operator, purpose, destination, and record trail.
People and organizations in India still use VPN technology for privacy and remote access. Covered consumer VPN services also face customer-record and logging rules, while an April 2026 government advisory warns providers about facilitating access to illegal and blocked betting and prediction-market platforms.
So don't ask only, “Can I connect?” Ask what you're doing, whether that exact route is authorized, which provider serves you, where its server really sits, and what records the company must keep.
The Short Answer: A VPN Isn't a Permission Slip
India doesn't treat every VPN connection as a crime. The government itself uses VPNs for secure remote access, and the rules expressly distinguish consumer services from enterprise and corporate VPNs.
That doesn't make every use lawful.
A VPN changes a network route. It can't turn prohibited gambling, fraud, unauthorized access, harassment, copyright infringement, or another unlawful act into permitted conduct. A blocked site also doesn't become legal merely because a different route reaches it.
The Ministry of Electronics and Information Technology's April 2026 advisory focuses on VPN providers and intermediaries facilitating access to illegal and blocked online betting and prediction-market services. It's a sharp example of the rule: a working connection answers a technical question, not a legal one.
Private rules sit beside public law. An employer can restrict personal VPNs on a work laptop. A bank can challenge a login from an unexpected address. A streaming service can enforce location terms. “VPNs aren't blanket-banned” doesn't cancel any of those rules.
The 2022 Rules Changed What Providers Must Record
In April 2022, the Indian Computer Emergency Response Team issued directions under Section 70B of the Information Technology Act.
The official CERT-In directions tell covered data centers, virtual private server providers, cloud providers, and VPN service providers to register specified customer information and retain it for five years or longer after service ends.
The list is concrete: validated customer names and addresses, contact numbers, the period of service, the purpose for hiring it, allotted or used IP addresses, registration email and IP details with a timestamp, and ownership pattern.
The same directions separately require covered entities to enable ICT-system logs, keep them securely for a rolling 180 days, and maintain those logs within Indian jurisdiction. Five years of subscriber information and 180 days of system logs aren't the same bucket. Don't blur them into one dramatic but inaccurate “five years of browsing history” claim.
These are provider obligations. They don't say a VPN makes a person anonymous, nor do they prove that every provider can see every page. Encryption, service design, server location, account records, and legal duties all affect what exists to be disclosed.
- Maps the many ways companies and governments collect data during ordinary online activity
- Makes large-scale surveillance understandable without requiring a technical background
- Helps readers question privacy promises and recognize the tradeoffs behind convenient services
Consumer and Company VPNs Share a Name, Not a Rule
The CERT-In FAQ defines “VPN Service” for the customer-registration requirement as internet-proxy-like VPN service offered to general internet subscribers. It says that requirement doesn't apply to enterprise or corporate VPNs under that definition.
Picture both routes.
Turn on a consumer privacy VPN. Your device routes covered internet traffic into an encrypted connection to the provider's server. The local ISP sees that connection, its timing, and its volume. The VPN provider operates the next hop. Public websites see the VPN server's IP, while signed-in accounts, cookies, browser fingerprints, and anything you submit can still identify you.
Now connect that Bengaluru work laptop to the company VPN. The device routes covered work traffic to the employer's gateway, while excluded traffic may still go direct. The local ISP sees the encrypted gateway connection plus any excluded service connections. The employer can log or inspect covered work traffic and enforce policy. Internal destinations see the employer route and employee account; excluded public destinations see the hotel's ordinary IP. The purpose is access to company systems—not hiding the employee from the company.
Same tunnel shape. Different operator, purpose, records, and expectations.
The FAQ's exception doesn't erase other laws or organizational duties. If work data is sensitive or regulated, use only the employer's approved device, profile, and instructions. Don't replace a failed corporate connection with a consumer app and assume the word “VPN” makes the routes interchangeable.
An India Button May Not Be a Server in India
Several providers responded to the rules by removing physical servers from India. Some still advertise an Indian virtual location hosted in another country.
That label can be useful if you need an Indian public IP. It doesn't tell you where the hardware sits, which company owns it, which legal entity holds the account, or which records are retained.
Read the location note and privacy policy together. Ask four plain questions:
- Is the server physically in India or only assigned an Indian IP address?
- Which company is contracting with the customer?
- What connection, account, and payment records does it create?
- Which law and retention period does the provider say apply?
A “no-logs” headline can't answer those questions. The useful version is a narrowly defined policy backed by architecture, an audit with a stated scope and date, and a record of how the company handles legal demands. Our no-logs policy guide explains how to read the claim without treating it as magic words.
Privacy Moves; It Doesn't Vanish
Without a VPN, the local internet provider handles the connection toward each destination. HTTPS usually protects page contents in transit, but the provider can still observe useful connection metadata and destination IPs. Destinations see the connection's ordinary public IP plus account, browser, and submitted information.
With a full-device VPN, covered traffic takes an encrypted route to the VPN server. The local provider sees that tunnel instead of the same destination pattern. The VPN operator now occupies the privileged position at the other end, and destinations see its public IP.
Neither route deletes account history, payment data, cookies, device identifiers, location permissions, or the words typed into a form.
That's why provider jurisdiction matters without becoming the whole story. A distant company can still collect too much. A beautifully written policy can still cover only part of the system. An audit can still be old or narrow. Privacy is a chain of specific claims, not a flag beside a server name.
If the goal is less tracking, pair the VPN decision with browser controls, unique passwords, strong multifactor authentication, careful app permissions, and fewer unnecessary accounts. The tunnel handles a route. It doesn't clean up every identifier riding through it.
- Connects through USB-C or NFC, covering many newer computers and compatible phones
- Adds a phishing-resistant physical check to passkeys and supported multi-factor logins
- Works without a battery, code display, or wireless pairing process
How to Choose Without Guessing
Start with the activity. If it would be unlawful without a VPN, don't use a VPN to do it. For regulated work, an investigation, journalism, political activity, or another high-stakes situation, get advice from a lawyer qualified in Indian law rather than relying on a provider's sales page—or this article.
Then inspect the service:
- Identify the company and jurisdiction serving the account.
- Confirm whether each India location is physical or virtual.
- Read exactly which subscriber, connection, diagnostic, and payment records it keeps.
- Check retention periods and the conditions for legal disclosure.
- Look for independent audits, then read their dates and scope.
- Install from the verified provider site or an official app store.
- Test the kill switch, DNS handling, and IPv6 behavior before relying on them.
Don't assume the cheapest plan creates the smallest record. Free services still need a business model, and paid services can still collect data. Compare the policy with the app's permissions and observed behavior.
For a company VPN, the checklist changes. Use the issued configuration, learn which traffic goes through it, and ask what to do when it fails. A personal VPN shouldn't be an improvised backup route into company systems.
Check the Rule That Exists Today
Legal summaries age badly. Product pages age faster.
CERT-In keeps the directions, FAQ, and implementation notices on its official Section 70B directions hub. Check it before making a consequential decision. For the statute itself, use the Information Technology Act on India Code.
The clean conclusion isn't “VPNs are legal, carry on.” It's more useful than that.
VPN technology hasn't received a blanket ban in India. Covered providers still face substantial data duties. Specific activities can still be illegal, blocked, or against private rules. Know which question you're answering before one successful connection makes the decision for you.