Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Most guides to this question settle on a comforting formula: the rules go after providers, enforcement against individuals is rare, everybody does it anyway. Two of those three statements are defensible. The first one is not.
China’s implementing regulations set out an administrative fine for a person who reaches the international internet through an unapproved channel. The amount is modest and the enforcement is uneven, but the provision exists and it names the user rather than the company. That makes China different from every other jurisdiction we have written about, and it is the part that gets left out.
The US State Department puts it more bluntly than any VPN site will. Its advisory calls VPN use illegal in most cases. It names device confiscation, a fine and detention among the possible outcomes.
Is a VPN Legal in China?
Only if it is licensed, and licensed services are not private ones. Unapproved cross-border connections are a regulatory violation. The implementing rules provide for an administrative fine of up to RMB 5,000 for an individual and RMB 15,000 for an organisation, alongside an order to disconnect. Criminal prosecution has been reserved for operators and sellers.
The Rules That Actually Apply
Three documents do the work, and they were written decades apart.
The 1997 network security regulations and their implementing measures are where the individual penalty lives. Reach the international internet through an unapproved channel and the rules set a fine. For an individual the ceiling is RMB 5,000; for a legal entity, RMB 15,000. Authorities may also warn, order a disconnection and confiscate any gains.
The MIIT notice of January 2017 on cleaning up the internet access service market is the one usually quoted. It states that without approval from telecommunications regulators, nobody may establish or lease dedicated lines — virtual private networks explicitly included — for cross-border activity. It was framed as a measure against unauthorised providers, and its effect was to make any unapproved cross-border connection a violation.
The Cybersecurity Law sits above both and was amended in October 2025, with the changes taking effect on 1 January 2026.
⚠️ Notice what the 1997 rules do that the other two do not. They reach the individual directly. Turkey obliges internet companies to block; India obliges providers to keep records; the UAE penalises what you do behind a connection. Only in this framework does the text describe an ordinary person connecting and attach a number to it. If you want the plain version of what the technology does before any of this, what a VPN actually hides has it without the legal frame.
| Country | What the rule aims at | Reaches the user? |
|---|---|---|
| Turkey | The tunnel — ISPs must block | No |
| The UAE | Conduct behind an address | No |
| India | The provider's records | Not nationally |
| China | Provider, tunnel and user | Yes |
| Brazil | Nothing, until a court acts | For 39 days |
| Indonesia | Paperwork — registration | No |
| The UK | The destination you visit | No, and ministers said so |
| The US | The platform, state by state | No, in all twenty-seven |
| Russia | The search, not the tool | Only if you went looking |
| Australia | The platform, and the tunnel itself | No — platforms must detect it |
| France | The VPN provider itself | No, the orders bind five companies |
| Italy | The provider, by regulator order | No, but one VPN left the market |
| Spain | The provider, by injunction without a hearing | No, and only two firms were named |
| Germany | The provider's logfile, for three months | No, and the courts twice removed it |
What Changed on 1 January 2026, and What Did Not
This is where most of the current coverage goes wrong, and the error runs in one direction.
What is in force: the amended Cybersecurity Law, effective 1 January 2026. It raised penalties substantially — reported ceilings reach RMB 10 million in the most serious cases, with some fines calculated as a multiple of illegal income. These provisions are aimed at businesses and service providers, not at a tourist opening a news site.
What is not in force: a draft Cybercrime Prevention Law, published for public comment by the Ministry of Public Security on 31 January 2026. Its Article 44 addresses the supply of tools and services that help others reach blocked material. Reported figures for individuals under the draft run to RMB 500,000 and fifteen days’ detention.
⚠️ A draft published for comment is not a law. It may pass, it may be amended, it may sit. Several sites have reported the draft’s numbers as though they already applied, which turns a proposal into a threat and a reader into a customer. We flag it because anyone planning a trip should know it exists — and because knowing it is a draft is the difference between preparing and panicking.
The Licensed Option Is Not a Private One
There are lawful VPNs in China. Understanding what they are settles most of the question.
A provider needs a B13 licence, classified as a Class I value-added telecommunications service and administered under MIIT oversight. Foreign ownership is capped at 50%, requiring a joint venture, and registered capital requirements run from one million yuan for a single province to ten million for cross-provincial operations.
In practice, multinationals do not run their own. They lease approved cross-border lines from the state carriers, which is simpler and is what the framework was designed to channel them towards.
A company using one becomes a network operator under the Cybersecurity Law, with obligations to monitor security status and retain network logs for at least six months.
⚠️ Read that last line again in the context of why people buy a VPN. An approved tunnel is one the authorities can reach. The 2017 rules also restrict leased international lines to internal office use, and published summaries note that they make no provision for an individual to use a licensed service for personal reasons. A lawful VPN in China is a corporate connection with a log requirement attached — which is not the product anyone means when they ask this question.
Why the Sites Reassuring You Are Selling Something
Worth saying plainly, including about ourselves.
Almost every page ranking for this question belongs to a VPN affiliate. So does this one. The commercial incentive runs in a single direction: a reader who concludes the risk is negligible buys a subscription, and a reader who concludes otherwise does not.
We are not going to resolve that by being reassuring. The record shows three things at once. Enforcement has concentrated on operators and sellers. Reported cases against individuals involved other conduct rather than browsing alone. And a foreign government advisory calls the practice illegal in most cases.
⚠️ We do not publish methods for evading network-level blocking, here or anywhere. Deep packet inspection identifies protocol signatures as a matter of routine, the same restrictions reach Tor, and the consequences of getting it wrong fall on the person inside the country rather than on the website describing the technique.
How China Compares
Different targets in every framework — which is the useful way to hold them.
Turkey regulates the tunnel. Internet providers must block VPN services, so reaching one is the difficulty. No provision penalises use.
The UAE regulates conduct. The statute never names VPNs; it reaches what you do behind a masked address.
India regulates the company. Providers with local servers must retain subscriber records for five years, which emptied the country of physical hardware.
China regulates all three at once — the provider through licensing, the tunnel through the firewall, and the user through an administrative fine.
Russia regulates the search. Its 2025 provision fines a person for looking for listed material and names circumvention tools as one route. The connection itself still carries no penalty.
One feature survives everywhere, including here: business and institutional access is permitted, provided it goes through approved channels. Our wider legality guide covers why the technology itself is so rarely the thing being regulated.
What This Means Before a Trip
Practical points, all concerning lawful preparation rather than anything else.
Decide before you fly, not after. Provider websites and app stores are unreliable from inside, so whatever you intend to have installed needs to be installed and tested at home. Our setup guide covers the checks that confirm a connection is doing what it claims.
Most itineraries are not only China. Hong Kong, Japan, Singapore and Korea have no equivalent restriction, and ordinary travel connectivity is the larger part of the problem for most people — as is what hotel and airport networks actually expose.
Free services are the wrong answer here specifically. A provider funded by selling data is a poor fit for a jurisdiction with this much interest in data, and only three free tiers are worth trusting anywhere.
And it is worth asking whether you need one at all for a short trip. We answer that honestly rather than commercially, and for a week of email and maps the answer is often no.
How We Research
This page draws on published summaries and translations of China’s 1997 network security regulations and their implementing measures, the MIIT notice of January 2017 on the internet access service market, the Cybersecurity Law as amended with effect from 1 January 2026, the draft Cybercrime Prevention Law published for comment on 31 January 2026, and the US State Department’s China travel advisory. Where a source treated the draft as enacted, we did not follow it. We are not lawyers, we cannot read the Chinese gazette, and this is not legal advice. We do not publish methods for evading network-level blocking, and where sources described such methods we excluded them. Our full approach lives on the About Us page.
China VPN Legality FAQ
Not for ordinary browsing. Criminal prosecutions have fallen on people who built or sold unauthorised cross-border services, and on those who used one while committing another offence. For an individual simply connecting, the framework provides an administrative fine rather than imprisonment.
The implementing rules set a ceiling of RMB 5,000 for an individual reaching the international internet through an unapproved channel, and RMB 15,000 for an organisation. Authorities may also order the connection terminated and confiscate any gains. Enforcement is uneven rather than systematic.
Partly. Amendments to the Cybersecurity Law took effect on 1 January 2026 and raised penalties, mainly for businesses and service providers. A separate Cybercrime Prevention Law was published in draft for public comment on 31 January 2026. The larger figures circulating online come from that draft.
Licensed ones. A provider needs a B13 value-added telecommunications licence, and companies typically lease approved cross-border lines from the state carriers instead. Those connections carry log-retention obligations of at least six months, which makes them a compliance tool rather than a privacy one.
They apply to anyone connecting from within the country. Reported enforcement against foreigners has been sporadic and has tended to involve sensitive regions or other conduct. The US State Department advisory describes VPN use as illegal in most cases and lists device confiscation among possible consequences.
The Verdict
Unapproved VPN use in China is a regulatory violation, and the rules name the individual. An administrative fine of up to RMB 5,000, an order to disconnect, confiscation of gains — modest numbers, unevenly applied, but written down.
Criminal exposure has fallen on operators and sellers, and reported cases against individuals have involved other conduct rather than browsing alone.
The frightening 2026 figures are from a draft, published for comment on 31 January 2026 and not enacted at the time of writing. The amendment that did take effect on 1 January raised penalties for businesses.
And the lawful option is not the private one. A licensed connection carries a log-retention obligation and is designed for corporate use, which is the honest answer to why so few people are asking about it.
⚠️ If your trip is short and your needs are ordinary, the most useful thing on this page may be the question of whether you need a VPN at all. For anything beyond that, ask a China-qualified lawyer rather than a review site — including this one.