Legality of web proxies and VPNs is one of the most frequently asked questions and one of the most nuanced answers. The short version: in most countries no law targets the technology itself, and the content you access through it is still governed by local law. This page summarises the specific rules we could tie to a dated source, as checked in October 2026. Where we could not find a source, we say so instead of guessing.
Nothing on this page is legal advice. Laws change and are enforced unevenly. Consult a qualified lawyer in your jurisdiction for your specific situation. AnyProxy operates as an ordinary web service and makes no political claims.
The distinction that matters most
Two different legal questions get conflated:
Tool legality. Is it legal for you to use a web proxy or VPN at all?
Content legality. Is it legal for you to access specific content through any means, including a proxy?
In most countries, no law addresses the tool: proxies are ordinary web infrastructure. Companies run forward proxies to filter staff traffic, and much of the web sits behind reverse proxies such as Cloudflare. Content legality depends on what you access. A proxy is not a legal shield: if a piece of content is illegal where you are, accessing it through a proxy is still illegal.
Where no specific rule applies
In most of the world, including the European Union, the United Kingdom, the United States, Canada, Japan, South Korea, Australia, Brazil and most of Latin America, we know of no law that restricts an individual’s use of a proxy or VPN as such. In those places, opening a page through a proxy raises no tool-specific legal issue; if the content is illegal, the content law applies.
Some countries in this group block specific sites or apps without restricting the tools. India is the clearest example: its Section 69A orders are addressed to platforms and ISPs, such as the June 2020 order that banned TikTok and 58 other apps and the November 2020 order that added AliExpress (Tribune India, 24 Nov 2020). The ban on the service stays in place whatever route you take.
Countries with specific, dated rules on circumvention tools
In June 2021 Rest of World, citing a PureVPN report, counted nine countries that ban VPNs, naming Russia, China, Iran, Iraq and Turkey among them (Rest of World, 13 Jun 2021). Counts like this depend on how “ban” is defined, so the country notes below stick to what specific laws say.
Russia. A law signed on 30 July 2017 and in force from 1 November 2017 lets Roskomnadzor block VPNs and “anonymisers” that do not restrict access to sites on its blocklist. The head of the Duma’s information committee said at the time that it carried no fines for users (The Moscow Times, 31 Jul 2017). That changed in part in 2025: a law passed on 22 July 2025 fines individuals 3,000 to 5,000 roubles for knowingly searching for materials listed as “extremist”, including through a VPN, and fines advertising VPNs (Meduza, 22 Jul 2025; Human Rights Watch, 24 Jul 2025). Using a VPN to commit a crime was also made an aggravating factor.
China. In January 2017 the Ministry of Industry and Information Technology announced a campaign, to run until March 2018, under which creating or renting cross-border channels, including VPNs, without government approval is forbidden (Caixin, 25 Jan 2017). The notice targets providers; enforcement against individual users is reported to be uneven, and we have not verified a current primary source on it.
Iran. On 20 February 2024 the Supreme Council of Cyberspace announced a resolution banning the use of VPNs without a legal permit; buying and selling them was already prohibited. Iranian legal experts have disputed whether the council has the authority to make such a rule (TechRadar, Feb 2024). In August 2026 Iran also required new platform blocks to be approved by the president (Iran International, 10 Aug 2026).
United Arab Emirates. Federal Decree-Law 34 of 2021 sets fines of Dh500,000 to 2 million for manipulating an IP address, for example with a VPN, to commit or hide a crime (Gulf News). The offence is tied to an illegal purpose, not to using the tool. Separately, only licensed operators may offer VoIP, which is why WhatsApp calls are restricted while WhatsApp itself is not (Khaleej Times, 23 Jun 2017).
Pakistan. The PTA asked businesses and freelancers to register their VPNs and set a 30 November 2024 deadline for blocking unregistered ones. It did not enforce the deadline, and in December 2024 the PTA chairman said no VPN had been blocked and over 31,000 had registered (Arab News). We found no rule that penalises individual users.
Other countries. Turkey, Belarus, Turkmenistan and North Korea are often named in lists like this one. We did not find a dated primary source on their current rules for individual users while preparing this update, so we do not describe them here. If you live in one of these countries, get local advice.
The specific content categories that matter regardless of country
Some content is illegal to access in almost every country regardless of the tool used:
- Child sexual abuse material.
- Terrorist recruitment and incitement to violence, in most jurisdictions.
- Copyright infringement, with rules that vary by country.
- Fraud, identity theft and unauthorised access to computer systems.
Using a proxy to access any of the above does not change the legal position. As Russia’s 2025 law shows, some jurisdictions treat the use of such tools during a crime as an aggravating factor.
Workplace and managed-network policies: a separate agreement
Beyond national law, employers, schools and other organisations can prohibit proxy or VPN use through an acceptable-use policy. That is a private agreement, separate from law:
- The tool being legal in your country does not override an acceptable-use policy at work or on another managed network.
- Breaking such a policy can lead to disciplinary action, losing access, or worse, depending on its terms.
- The network operator can see connections to proxy domains, such as AnyProxy’s regional server names, in its network logs even when it cannot see the pages inside the encrypted connection. See can my ISP see I used a proxy?.
Check what your employer or network operator prohibits before using a proxy on their network.
The privacy-law dimension
For users in the EU, the GDPR gives rights over personal data that an operator holds, and under its Article 3 it can apply to operators outside the EU that offer services to people in the EU:
- Right of access to the data held about you.
- Right to erasure.
- Right to object to processing.
- Right to data portability.
A well-run proxy operator publishes a policy that explains how to use these rights. AnyProxy’s privacy policy says what we can record (destination hosts, session identifiers, a hashed IP address) and how to ask for access or deletion. It does not promise a fixed deletion window, and AnyProxy is not a no-logs service.
The one-line summary
- Most of the world: no tool-specific law found; content laws apply.
- Russia, China, Iran, UAE: specific rules exist, with the dates and sources above; how they are enforced varies.
- Pakistan: VPN registration was announced in 2024 but not enforced as of December 2024.
- Anywhere: check local law; this page is not legal advice.
The universal recommendation
Two operating principles that apply everywhere:
-
Do not use a proxy to access content that is illegal in your jurisdiction. The proxy does not change the law that applies to the content.
-
Do not break acceptable-use policies at work or school on the theory that a proxy is invisible. Network logs show connections to proxy servers, and on managed devices administrators can see more.
For everyday use, such as opening a news site or reaching a service that does not operate in your country, using a web proxy is unremarkable in most jurisdictions. Where the rules above apply, read them first.