Yes, VPNs are legal in the USA. No federal or state law bans individuals or businesses from routing their internet traffic through an encrypted tunnel, and millions of Americans do it every day for privacy, remote work, and security on public Wi-Fi. What a VPN cannot do is change the legal status of what you do while connected to it. If an activity is a crime without a VPN, it is a crime with one.
Why U.S. Law Permits VPN Use
The United States has no statute banning, licensing, or restricting VPN use. That puts it in a very different category from countries like China, Russia, or Iran, which either outlaw VPNs entirely or allow only government-approved providers.
The closest federal law comes to touching the subject is the Wiretap Act, and it actually cuts in favor of encryption. Under 18 U.S.C. § 2511, it is a crime to intentionally intercept someone else’s electronic communications, and the statute treats encrypted or scrambled traffic as a recognized protective measure rather than as something suspicious.1Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Encrypting your own connection is the digital equivalent of sealing an envelope. The law does not punish you for making your communications harder to read.
Everyday uses — shielding browsing history from an internet service provider, protecting a laptop on hotel Wi-Fi, connecting to an employer’s internal network, reaching a U.S. subscription while traveling abroad — all sit comfortably inside the law.
When VPN Use Becomes Illegal
A VPN is a tool, and its legality tracks what you do with it. Federal prosecutors do not treat the presence of a VPN as a defense. They treat it as evidence of intent to hide.
Hacking and Unauthorized Access
The Computer Fraud and Abuse Act makes it a federal crime to access a computer without authorization, or to exceed the access you have. Using a VPN to mask your IP address while breaking into a system is the same offense as doing it from your home connection, with penalties that scale from one year up to ten depending on what you took and why.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
The Supreme Court narrowed one piece of the CFAA in 2021. In Van Buren v. United States, the Court held that “exceeds authorized access” means reaching areas of a computer you were never entitled to enter, not simply misusing access you legitimately have.3Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021) That distinction can matter for insiders. For someone with no authorization who uses a VPN to hide an intrusion, Van Buren changes nothing.
Copyright Infringement
Downloading or distributing copyrighted movies, music, software, or games without permission is illegal whether or not a VPN hides your IP. Willful infringement becomes a federal crime when it involves commercial gain or when the copied material tops $1,000 in retail value within 180 days.4Office of the Law Revision Counsel. 17 USC 506 – Criminal Offenses Criminal penalties can reach five years on a first offense and ten on a second, with heavier exposure for pre-release works.5Office of the Law Revision Counsel. 18 USC 2319 – Criminal Infringement of a Copyright
Federal prosecutors generally reserve criminal charges for large-scale operations. The realistic risk for an individual is a civil lawsuit from the copyright holder, where statutory damages can run up to $150,000 per work. A VPN may delay discovery. It does not prevent it.
Fraud
The federal wire fraud statute reaches any scheme to defraud that uses interstate electronic communications, and a VPN connection qualifies. Sentences can run up to 20 years, or 30 if the scheme targets a financial institution or exploits a federally declared disaster.6Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television Phishing, identity theft, or running a fraudulent online store from behind a VPN adds nothing to the defense and can weigh against the defendant at sentencing as evidence of deliberate concealment.
A VPN Does Not Make You Invisible to Law Enforcement
This is the part most people get wrong. A VPN encrypts traffic between your device and the VPN server. It does not remove you from the reach of federal investigators.
Under the Stored Communications Act, the government can compel any electronic communication service provider, including a VPN company, to hand over stored communications with a warrant. Subscriber records and connection logs can be obtained with a subpoena or court order.7Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records Whatever records a provider keeps are reachable.
For terrorism and espionage investigations, the FBI can go further. A National Security Letter lets the FBI demand subscriber names, addresses, billing records, and connection history from a wire or electronic communication service provider without going to court, typically paired with a gag order that blocks the provider from telling the user anything about it.8Office of the Law Revision Counsel. 18 USC 2709 – Counterintelligence Access to Telephone Toll and Transactional Records
Marketing claims about “no-logs” policies do not solve this. Some providers genuinely retain nothing. Others advertise that they do not log and then produce logs when subpoenaed. IPVanish, which promoted a strict no-logs policy, gave the Department of Homeland Security a user’s real IP address, connection timestamps, and subscription details during a 2016 criminal investigation, and the data identified the suspect. What matters is what data actually sits on the provider’s servers when a legal demand arrives, not what the marketing page says.
Streaming and Terms of Service
Using a VPN to watch a streaming platform’s content from another country is one of the most common questions people have about legality. It is not a crime under any federal or state law, and no one has been prosecuted for it. What it usually does violate is the streaming service’s terms of use.
Platforms license content country by country. Connecting through a VPN to appear elsewhere lets you reach content the platform is not licensed to show you in your actual location. The consequences are contractual: a blocked connection, a suspended account, a canceled subscription. None of that is a criminal penalty.
The CFAA does not fill the gap either. After Van Buren, breaking a service’s rules while using an account you legitimately hold is not the same as accessing information you were never entitled to see.3Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021) For a paying subscriber, the VPN issue is between them and the platform.
Workplace, School, and Government-Device Rules
Private organizations set their own rules on networks and devices they control. An employer can prohibit personal VPNs on company laptops to keep visibility over network traffic. A school can block VPN connections to enforce content filters. These are policy decisions, not laws.
Federal facilities can be stricter still. Lawrence Berkeley National Laboratory, for example, prohibits commercial or free VPN services on lab-owned devices entirely and may block VPN traffic at the network level.9Berkeley Lab. External VPN Usage Policy Government agencies and contractors also have to work around Section 889 of the FY 2019 National Defense Authorization Act, which bars procuring telecommunications equipment and services from certain foreign companies, so a VPN tied to a prohibited entity is off-limits for government use.10U.S. Election Assistance Commission. What is Section 889 of the FY 2019 NDAA?
Breaking one of these rules will not get you arrested. It can get you fired, expelled, or cut off from a network.
When Businesses Are Expected to Use One
For organizations handling sensitive data, a VPN is closer to a compliance requirement than an optional privacy tool. The HIPAA Security Rule directs covered entities to safeguard electronic protected health information during transmission, and lists encryption as an “addressable” standard that must either be implemented or replaced with a documented equivalent.11GovInfo. 45 CFR 164.312 – Technical Safeguards Most healthcare organizations meet that standard by requiring VPN access. Financial institutions, government contractors, and companies subject to data protection rules operate under similar expectations, where the legal risk points the other way: failing to encrypt transmissions can bring regulatory penalties and breach liability.
Picking a Provider With the Legal Picture in Mind
VPN use being legal does not mean every provider deserves your trust. A few things matter from a legal standpoint:
- Jurisdiction. A U.S.-based provider answers to U.S. warrants, subpoenas, and National Security Letters. Foreign providers may be harder for federal authorities to reach, and may also be subject to weaker consumer protection.
- Logging practices. “No-logs” claims vary in honesty. Independent audits give some weight to the claim; providers caught retaining logs despite the marketing give the opposite.
- Transparency reports. Voluntary disclosures about how many government requests a provider receives, and how it responds, tell you more than the sales page does.
Using a VPN in the United States is your right. What you do while connected to it still has to be legal on its own.