Yes, VPNs are legal in the US. No federal law prohibits buying, installing, or using one, and VPN connections are standard equipment across federal agencies, hospitals, banks, and most large employers. The legal questions worth understanding aren’t about the technology itself. They’re about what you do through it, what your employer allows on its devices, what happens at the border, and what a VPN provider can be compelled to hand over.
The Tool Is Legal; the Conduct Isn’t Always
A VPN encrypts your traffic and hides your IP address. It doesn’t rewrite criminal law. Every offense that exists without a VPN still exists with one, and prosecutors don’t need your IP address to build a case. The technology changes your visibility online, not your legal exposure.
Copyright Infringement
Downloading or distributing copyrighted material without permission is illegal no matter how you connect. Federal copyright law allows both civil suits and criminal charges, and the Digital Millennium Copyright Act separately makes it illegal to circumvent technological protections on copyrighted works.1U.S. Copyright Office. The Digital Millennium Copyright Act of 1998 Copyright holders identify infringers through methods beyond IP tracking, including digital watermarks and metadata embedded in files, so hiding your IP alone doesn’t prevent detection.
Hacking and Unauthorized Access
The Computer Fraud and Abuse Act makes it a federal crime to intentionally access a computer without authorization or to exceed the access you’ve been given. A basic violation carries up to one year in prison, rising to five years when the offense is committed for financial gain or to further another crime, and up to ten years for repeat offenders. Espionage or damage to critical infrastructure can reach twenty years.2Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers Routing an attack through a VPN doesn’t change the charges.
Fraud, Exploitation, and Harassment
Identity theft, financial fraud, cyberstalking, and distribution of child sexual abuse material are all federal crimes with severe penalties regardless of how someone connects. Distribution or receipt of child sexual abuse material carries a mandatory minimum of five years and a maximum of twenty for a first offense, rising to fifteen and forty years with a prior conviction.3Office of the Law Revision Counsel. 18 U.S. Code 2252 – Certain Activities Relating to Material Involving the Sexual Exploitation of Minors A VPN is a technical obstacle to an investigation, not a legal defense.
Spoofing Your Location for Online Gambling
Using a VPN to appear in a state where you aren’t physically located, so you can bet on a licensed platform, sits in a gray area that tilts against you in practice. The federal Wire Act targets those “engaged in the business of betting or wagering,” which generally means operators rather than casual bettors.4Office of the Law Revision Counsel. 18 U.S. Code 1084 – Transmission of Wagering Information; Penalties The Unlawful Internet Gambling Enforcement Act similarly focuses on gambling businesses and payment processors, not individual players.5Federal Trade Commission. Unlawful Internet Gambling Enforcement Act
The real risk sits at the platform and state level. Licensed sportsbooks and casinos verify your location with geolocation software, and defeating it violates their terms. If caught, you can expect account suspension, forfeiture of winnings, and a permanent ban. Some states treat geolocation fraud as a regulatory violation carrying fines, though enforcement against individual bettors has been rare so far. Federal prosecution of a casual bettor is unlikely; losing your winnings and your account is not.
Streaming Region Blocks and Terms of Service
Using a VPN to reach content that isn’t available in your region violates the terms of service of virtually every major streaming platform, including Netflix, Hulu, Amazon Prime Video, and Disney+. If detected, the usual consequence is a temporary block, an account warning, or in persistent cases, account suspension. Permanent bans are uncommon for casual users.
Violating a company’s terms of service is a breach of contract, not a crime. The Supreme Court drew that line in Van Buren v. United States (2021), holding that the Computer Fraud and Abuse Act’s “exceeds authorized access” provision applies to people who reach areas of a system that are off-limits to them, not people who use an authorized system in a way that breaks a policy. The Court noted that a broader reading would turn “millions of otherwise law-abiding citizens” into criminals.6Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021) A streaming service can cut off your account. The government isn’t going to prosecute you for watching foreign Netflix.
What Investigators Can Still Get From a VPN
VPNs feel anonymous, but federal investigators have tools to reach behind them. Under the Stored Communications Act, the government can compel electronic communications providers to disclose stored communications and subscriber records. Content stored 180 days or less requires a warrant. Subscriber records without content can be obtained with a subpoena or court order.7Office of the Law Revision Counsel. 18 U.S. Code 2703 – Required Disclosure of Customer Communications or Records
Whether the provider actually has anything to hand over depends on its logging practices. Some providers keep genuine no-log policies and don’t record which users connected to which servers or reached which sites. In multiple federal investigations, Private Internet Access was subpoenaed for user logs and demonstrated it had none to produce. US-based providers are subject to US legal process, but no current federal law requires VPN companies to retain user activity logs. A provider that doesn’t collect data has nothing to disclose.
Not every no-log claim holds up. Some providers quietly keep connection timestamps, bandwidth logs, or payment records that indirectly identify users. If you’re using a VPN for real privacy, the logging policy and its track record under legal pressure matter more than the marketing.
Border Crossings and Device Searches
Your rights shift at the border. Customs and Border Protection has broad authority to search electronic devices at ports of entry, and that authority reaches every traveler regardless of citizenship. The power draws from customs, immigration, and national security statutes reinforced by Supreme Court precedent on inspecting items crossing the border.8U.S. Customs and Border Protection. Border Search of Electronic Devices at Ports of Entry
For a basic inspection of your phone or laptop, CBP needs neither a warrant nor reasonable suspicion. An advanced search, where officers connect external equipment to copy or analyze the device’s contents, requires reasonable suspicion and supervisor approval under CBP policy. If your device is locked and you refuse to unlock it, CBP can’t deny a US citizen entry, but it can seize and detain the device. Foreign nationals face a different calculus, because refusal can be factored into admissibility.
One limit works in a VPN user’s favor. CBP may only search data physically stored on the device at the time of inspection. Officers are required to disable network connectivity before searching, and they may not use your device to reach cloud-based files. Anything stored locally, including VPN configuration files, browser history, or cached data, is fair game.
Personal VPNs on Work Devices
Employers in the United States have broad authority to control what happens on company-owned equipment, and that includes banning personal VPN software. Most corporate IT policies prohibit it, because an unauthorized VPN creates a blind spot in security monitoring.
Installing a personal VPN on a work device can trigger anything from a warning to termination, depending on the policy and how strictly it’s enforced. In an at-will employment state, which covers most of the country, an employer generally doesn’t need a specific reason to fire you, and an IT policy violation is a straightforward one. Even where employment protections are stronger, circumventing company security monitoring is the kind of violation that typically survives challenge. If you need privacy for personal browsing, use your own device on your own network.
Why VPNs Stay Mainstream
The reason VPNs remain legal and widely used is that they do genuinely important work. Businesses rely on them to give remote employees secure access to internal networks and to protect sensitive data moving across the public internet. Healthcare organizations use VPNs to meet HIPAA’s requirement that electronic protected health information be encrypted in transit. Financial firms use them to help satisfy SEC Regulation S-P, which requires policies protecting customer records against unauthorized access.
For individuals, common uses include protecting data on public Wi-Fi at airports and coffee shops, keeping an internet provider from tracking browsing habits, and communicating privately. Journalists, activists, and anyone handling sensitive information routinely use VPNs as a baseline security measure. None of that creates any legal risk.