Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Eleven frameworks into this series, France produces a first. A court did not tell platforms to check ages, and it did not tell internet providers to block sites. It named five VPN companies and ordered them to do the blocking themselves.
The people using those services were never mentioned. That gap between who gets ordered and who gets punished is the whole subject of this page.
Is a VPN Legal in France?
Yes, and nothing suggests otherwise. No French law restricts buying, installing or using one, and no government has proposed such a rule. What changed since May 2025 sits one level up: the Paris Judicial Court has repeatedly ordered named VPN providers to block piracy domains for users in France. Those orders bind companies, not subscribers.
Four Orders in Eight Months
The pattern started with football and has not stopped since.
15 May 2025 was the landmark. Acting for Canal+ and the Ligue de Football Professionnel, the Paris Judicial Court ordered NordVPN, CyberGhost, Surfshark, ExpressVPN and Proton VPN to block 203 domains carrying pirated Champions League, Premier League and Top 14 streams. They had three days to comply.
June and July brought more. beIN Sports won an order covering seven domains streaming WTA tennis. Canal+ added five carrying Formula One, on 18 July.
December added a dynamic list. On 18 December the same five providers were ordered to block thirteen further domains, and ARCOM can extend that list whenever mirrors appear. The measures run to the end of the 2025/26 season on 24 May 2026.
⚠️ The legal hook is a sports statute, not a privacy law. Article L.333-10 of the French Sports Code lets rights holders demand blocking from “technical intermediaries”, and the court decided VPNs qualify. Canal+ called that recognition a first, and it was.
The No-Logs Defence Failed
This part deserves attention, because the reasoning travels.
Surfshark and NordVPN argued they cannot identify French users at all. Their infrastructure keeps no logs, so selective blocking would mean building the very capability their product exists to avoid.
The court disagreed on a narrow point. Blocking a domain does not require storing anything about who tried to reach it. The order therefore asks for nothing the no-logs policy forbids.
⚠️ Serving as a bridge counts as transmission, in the court’s reading. That sentence is the precedent, and it applies to any intermediary that helps traffic arrive somewhere.
The industry pushed back hard. The i2Coalition, which runs the VPN Trust Initiative, called infrastructure-level blocking misguided and ineffective, and pointed out that VPNs neither host nor promote the content. ExpressVPN and the others complied anyway, because the alternative is contempt.
The Other Front: Age Verification
Meanwhile a second thread ran through 2025, and it looks familiar.
The SREN law gave ARCOM the power to demand real age checks on adult sites, with a technical framework published in October 2024. On 6 March 2025 the regulator issued formal notices to seventeen platforms.
Aylo left instead. On 4 June 2025 it suspended Pornhub, YouPorn and RedTube for every French IP address, calling the required checks intrusive and dangerous. France was its second-largest market.
VPN signups spiked within the hour. Reported figures put Proton VPN’s French signups up roughly tenfold in thirty minutes, with NordVPN and ExpressVPN also climbing.
⚠️ Then a court paused the whole thing. On 17 June 2025 the Paris administrative tribunal temporarily suspended the ministerial order, citing the country-of-origin principle in the EU Digital Services Act. The sites became briefly reachable again. Britain reached a similar position by a different route, and its ministers ruled out touching VPNs at all.
Nobody Has Been Penalised for Connecting
Worth stating plainly, because the headlines invite the opposite conclusion.
No French statute makes VPN use an offence. Not the Sports Code, not the SREN law, not the Penal Code article behind the age rules, which addresses making explicit content available to minors.
Every measure so far has an intermediary as its target. Rights holders sue companies. Regulators notify platforms. Courts order providers.
⚠️ That is now the dominant design across this series. Australia told platforms to detect VPN traffic; France told the VPNs themselves to block domains. Neither touched a user, and both were more effective than a ban would have been.
Italy reached the same providers without a courtroom. Its regulator wrote the duty into a rulebook, and the clock there runs for thirty minutes rather than three days.
Spain produced the sharpest version. A Córdoba court granted LaLiga measures against two named providers in February 2026 without calling either to a hearing, and in May the same court refused to fine one of them.
The Detail That Undercuts All of It
France also has something no other framework in this series has produced.
A French mobile operator ships a VPN that defeats the blocks. Free includes an mVPN in its mobile plans, routing through the Netherlands, and its founder confirmed publicly that it reaches sites blocked in France.
A deputy referred the matter to ARCOM in September 2025. The question is unresolved, and the service was still running as this page went up.
⚠️ So one arm of French policy blocks domains at five foreign VPN companies while a domestic carrier routes around them. We are not recommending that service, and we do not publish workarounds. It matters here because it shows what infrastructure blocking achieves against a determined market.
If You Are Visiting or Living There
Practical points, all lawful.
Nothing here restricts you. Install what you like and connect where you like. Expect age checks on some sites, and expect a handful of piracy domains to fail on the five named providers.
Set it up before you travel if you can, purely as ordinary preparation — our travel guide covers what tends to break in hotels rather than in law.
Test the connection once. Running the leak checks takes ten minutes and confirms the tunnel does what the app claims.
Choosing a provider is a separate question. French catch-up television is free to watch, so an address in the right country is usually the whole job — and the blocklist above touches none of it.
⚠️ A VPN moves your apparent location and nothing else. It does not change which law applies to you, which is the point the American page makes at length about a very different system. What a VPN actually hides is the honest version of the same idea.
⚠️ Not legal advice. We are not lawyers, the orders changed four times in eight months, and the December list can grow at ARCOM’s request.
Where France Sits Against the Rest
| Country | What the rule aims at | Reaches the user? |
|---|---|---|
| Turkey | The tunnel — ISPs must block | No |
| The UAE | Conduct behind an address | No |
| India | The provider's records | Not nationally |
| China | Provider, tunnel and user | Yes |
| Brazil | Nothing, until a court acts | For 39 days |
| Indonesia | Paperwork — registration | No |
| The UK | The destination you visit | No, and ministers said so |
| The US | The platform, state by state | No, in all twenty-seven |
| Russia | The search, not the tool | Only if you went looking |
| Australia | The platform, and the tunnel itself | No — platforms must detect it |
| France | The VPN provider itself | No, the orders bind five companies |
| Italy | The provider, by regulator order | No, but one VPN left the market |
| Spain | The provider, by injunction without a hearing | No, and only two firms were named |
| Germany | The provider's logfile, for three months | No, and the courts twice removed it |
The target keeps moving up the chain. Turkey aimed at the tunnel, China at everyone, Australia at the platform, and France at the provider.
Only China and Russia reach the person connecting. Our wider legality guide covers why the legal-or-illegal framing answers this question badly almost everywhere.
How We Research
This page draws on TorrentFreak’s reporting of the Paris Judicial Court orders of May, June, July and December 2025, on Connexion France and Cybernews for the Canal+ and LFP case and the i2Coalition response, on TechRadar for the December order and the rejected no-logs arguments, on CNN and Vice for Aylo’s withdrawal on 4 June 2025 and ARCOM’s response, and on French reporting of the administrative tribunal’s temporary suspension of 17 June 2025 and the September 2025 referral concerning Free’s mVPN. We do not run our own tests and we do not publish circumvention instructions for any jurisdiction. Our full approach lives on the About Us page.
France VPN Law FAQ
No. French law contains no offence for using, buying or installing one, and no government has proposed restricting them. The court orders issued since May 2025 bind five named VPN companies rather than their subscribers, and they concern specific piracy domains rather than the technology itself.
NordVPN, CyberGhost, Surfshark, ExpressVPN and Proton VPN. The Paris Judicial Court named the same five in four separate orders between May and December 2025, acting for Canal+, the Ligue de Football Professionnel and beIN Sports. Each order gave them three days to comply.
Its owner Aylo suspended access for French IP addresses on 4 June 2025, in protest at the SREN law’s age-verification requirements. The site was not blocked by France; the company withdrew. A Paris administrative tribunal then briefly suspended the ministerial order in June 2025.
No published case has penalised anyone for the connection itself. The Sports Code orders reach intermediaries, and the age-verification rules reach platforms. As everywhere, what you do through the tunnel remains subject to the same law as if you had done it directly.
Yes, with one narrow exception. The five named providers block a list of piracy domains for users in France, and ARCOM can add to that list during the football season. Everything else about the services operates as it does anywhere else.
The Verdict
Using a VPN in France is legal, and nothing in the last two years changed that. No offence exists, no fine attaches, and no bill has proposed one.
What changed is who receives the order. Five named companies, four rounds of blocking, and a court ruling that a service acting as a bridge performs transmission.
For a reader outside France the precedent matters more than the football. A domestic court told foreign VPN providers what their networks must refuse to carry, and they complied within three days.