VPN logging policies and privacy jurisdictions: the 2026 reference table

Almost every VPN privacy page says the same three things: the company keeps nothing, it lives somewhere with friendly laws, and an auditor once agreed. Those claims are cheap to make and, until a court order or a police search arrives, impossible to check. This page is the reference I wanted and could not find: what the law in each jurisdiction actually says as of September 2026, with the statute or judgment linked, and the ten best-documented cases where police tested a VPN's logging claim, with what they walked away with.

The short version is uncomfortable for the whole industry, including us. The country on the "about us" page turns out to be a weak predictor of what happens when the order arrives. The presence or absence of identifying data on the day is what decides it.

What does a VPN logging policy actually cover?

Two different things get called "logs", and privacy pages blur them on purpose. Activity data is what you did through the tunnel: the sites, the DNS queries, the traffic. Connection data is the bookkeeping around the tunnel: when an account connected, to which server, and how much data moved. A provider can keep the second without the first, and most commercial services do, because bandwidth abuse and simultaneous-connection limits are hard to enforce otherwise.

The question a court asks is narrower than either: can this company, today, link an IP address seen at a given time to a paying customer? That link can exist in a connection record, in an account system, in a payment processor's records or in a fraud-prevention tool. It rarely lives in the place the privacy page talks about.

Le VPN's own position is one sentence long: we keep connection logs, not activity logs. The point of this article is to give you the tools to test a sentence like that, ours included.

Which countries force VPN providers to keep data?

The table compiles the retention position of the jurisdictions where most commercial VPNs are incorporated, plus the four that changed the market by legislating against it. "Reaches VPNs" means the retention duty applies to a VPN service operating from that country, not only to licensed telecom carriers. Sources are the statute, the judgment, or the government's own statement wherever one exists.

Read across the third column and the pattern is plain. Of 16 jurisdictions, five have a retention duty in force that a VPN operating there could fall under. India wrote its rule for VPN services by name. Russia, France, the United Kingdom and Australia wrote theirs for operators, hosting providers or "telecommunications operators", definitions broad enough to reach a VPN and, so far, rarely tested against one. Everywhere else there is no duty at all. The favourite "privacy haven" countries and the supposedly hostile Netherlands or Romania sit in the same row: no retention statute.

Does the Five Eyes list still matter?

Less than the marketing suggests. The Five Eyes (United States, United Kingdom, Canada, Australia, New Zealand) is a signals-intelligence sharing arrangement dating from the 1946 UKUSA agreement. The Nine and Fourteen Eyes extensions come from Snowden-era documents describing the "SIGINT Seniors Europe" group, which adds Denmark, France, the Netherlands and Norway, then Belgium, Germany, Italy, Spain and Sweden. The Wikipedia entry on Five Eyes tracks the primary documents.

What these agreements govern is how intelligence agencies share what they have already intercepted. What they do not govern is whether a magistrate in Panama City or Road Town can order a company to produce records, which is a matter of domestic criminal procedure and mutual legal assistance treaties. Panama has had an MLAT with the United States since 1995; the British Virgin Islands answer requests through the UK. The second table below shows the practical result: the two clean US cases came from a Five Eyes country, and the two providers that produced identifying data in 2017 and 2021 were based in Hong Kong and Switzerland.

A definition worth keeping: a VPN's jurisdiction is the country whose courts can compel the company that runs the service, which is not always the country where the servers are, and rarely the country whose flag appears on the pricing page.

Which retention laws are changing in 2026?

Three files are open at once, and all three would move VPN providers from the "no duty" to the "duty" column if they pass as drafted.

The European Union is on its fifth attempt. The 2006 Data Retention Directive was annulled in Digital Rights Ireland (8 April 2014); national copies fell in Tele2 and Watson (21 December 2016), La Quadrature du Net (6 October 2020) and SpaceNet (20 September 2022). The Court softened in La Quadrature du Net II (30 April 2024), accepting general retention of IP addresses tied to civil identity for ordinary crime. The Commission's April 2025 ProtectEU strategy promised a new initiative, an impact assessment opened in May 2025, a Council presidency paper of 27 November 2025 recorded most member states wanting a one-year retention floor that national law could exceed, and at their informal meeting in Dublin on 17 July 2026 justice ministers backed the principle. The legislative text was still unpublished when this article went live. The Commission's own data retention page is where it will appear first.

Germany is trying to get ahead of Brussels. The Justice Ministry published a draft on 22 December 2025, cabinet adopted it on 22 April 2026, the Bundesrat adopted its amendments on 12 June, and the Bundestag held the first reading on 24 June 2026 before referring it to committee. The duty is narrow on paper (IP address plus port number, 3 months, internet access providers) and the industry association eco has already said it expects the same fate as the two previous attempts. A German VPN is an access provider in the ordinary sense of the word, so the bill's definitions will matter.

Switzerland is the one that would have hit VPN companies directly. The January 2025 draft revision of the surveillance ordinance (VÜPF) proposed treating "derived communication services" with more than 5,000 users like telecom operators: verify identity, keep metadata 6 months, decrypt on request where the provider holds the keys. Proton and NymVPN said publicly they would leave, Threema said it would fight the ordinance, and Proton began moving infrastructure out. Two parliamentary motions in September 2025 demanded a rewrite; on 11 February 2026 the Federal Council published the consultation results and commissioned an external regulatory impact study before a second consultation, with no binding timetable. The friendly-Switzerland line on a VPN homepage is, for now, still true, and for the first time it is conditional.

Which VPN logging claims have been tested by police or courts?

This is the part no jurisdiction table can replace. Ten cases between 2011 and 2023 are documented well enough to cite: a court filing, the provider's own statement, or both. Providers are named because the cases are public record; the point is the pattern, not the brand.

Score it however you like and jurisdiction loses. Four of the ten produced identifying data: one in the United Kingdom, one in the United States, one in Hong Kong, one in Switzerland. Six produced nothing: two in the United States, one each in Sweden, Switzerland, the British Virgin Islands and Canada. Switzerland appears on both sides of the ledger. What separates the two groups is engineering and account design: whether an IP address ever gets written next to an account identifier, and for how long.

The Proton case deserves a second look because it is the shape of the future. Proton had nothing stored, and that did not matter. Swiss authorities ordered the company to start collecting one user's IP address going forward, and Swiss law obliged it to comply. Retention laws are about the past; targeted logging orders are about the future, and no jurisdiction on the first table forbids them.

What do audits and RAM-only servers prove, and what do they not?

Since 2018 the larger providers have paid Deloitte, PwC, KPMG or Cure53 for periodic assurance reports, and since around 2019 many have moved to diskless servers that boot from a signed image and hold state in memory only. Both are real improvements. Both are also narrower than the press releases.

An audit is an opinion about configuration during the days the auditor looked, scoped by the provider that paid for it. Read the scope section: most cover VPN servers and exclude the account, billing and anti-fraud systems where the IP-to-customer link tends to live. RAM-only servers answer a specific threat, the seized machine, and answer it well: Mullvad's and ExpressVPN's clean outcomes owe more to that design than to Swedish or Caribbean law. They say nothing about a targeted order to log one account from tomorrow.

The three questions that survive all this are simple. Does an IP address ever sit next to an account identifier anywhere in the company's systems? If yes, for how long? And can the company be ordered to create that link for one user on request? A provider whose privacy page answers those three plainly has told you more than any jurisdiction badge.

How to read a VPN privacy policy in ten minutes

Find the legal entity. The privacy policy or terms will name a company and a governing law; if the two differ from the flag on the homepage, the governing-law clause wins. Look up that country in the first table.

Search the policy for "IP". Every policy that mentions IP addresses at all says either that they are stored (for how long?), truncated, or never written. Silence on the point is an answer too.

Check the payment trail. Card and PayPal payments identify you to the payment processor regardless of the VPN's own practice; cash and cryptocurrency do not. This is why Mullvad's search warrant was always going to fail.

Look for a transparency report or warrant canary and check its dates. A report that stopped updating two years ago is a report that stopped.

Ask what happens to a targeted order. The honest answer, in every jurisdiction on the first table, is "we would have to comply with a valid order to begin logging one account". A policy that says otherwise is describing a country that does not exist.

Then apply the same five checks to the pages on this site. Le VPN was founded in Paris, France in November 2010 and keeps connection logs, not activity logs. The online privacy and encryption pages are where to start reading. For the technical side of staying hidden when a connection drops, see the kill switch explainer; for the identity layer beyond the tunnel, the anonymous identity guide.

What this table will look like next year

Three of the rows above carry a date in 2026 and will need rewriting by 2027. If the Bundestag passes the IP retention bill, Germany moves to "yes" and every access provider there, VPNs included, starts keeping 3 months of address assignments. If the Commission publishes its proposal with a one-year floor, the Netherlands and Romania rows, clean since 2015 and 2014, come back into play across the whole EU, France included. And if Switzerland's second consultation keeps the 5,000-user threshold, the country that hosts the most-cited privacy companies in Europe becomes the first to write a retention duty specifically for them.

None of that changes the lesson of the second table. Laws decide what a company must keep. Engineering decides what it has when the order arrives. Judge the second before you trust the first.