Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Swiss jurisdiction is one of the most heavily marketed features in this industry, and we have used it ourselves — our Proton VPN review treats it as a genuine advantage.
That advantage is currently under revision. A proposed update to Switzerland’s surveillance ordinance would extend identification and retention duties to VPN providers, and the country’s own privacy companies have said they would leave rather than comply.
What Is Actually Being Proposed
Precision matters here, because the reporting varies in how alarming it sounds.
The instrument is an ordinance, not a statute. The revision concerns the Ordinance on the Surveillance of Postal and Telecommunications Traffic, pushed by the Federal Council and the justice department as an administrative update rather than a full parliamentary reform.
It would extend existing duties to new categories. Identification and retention obligations currently fall on mobile networks and internet providers. The revision would reach VPN services, messaging apps and social networks.
Reported requirements for services above roughly five thousand users: collect government-issued identification, retain subscriber data including email addresses, phone numbers, addresses and port numbers for six months, and decrypt communications on request where the provider holds the keys.
⚠️ None of this is law today. It is a draft under discussion, reported as possibly entering force during 2026, and it has met resistance across the political spectrum.
Why This Reaches Beyond Switzerland
Because the jurisdiction is a product feature, and it is sold everywhere.
Providers choose a country the way they choose a protocol, and it is one of the few things a VPN genuinely settles. Panama, the British Virgin Islands, Sweden, Switzerland — each one is marketed as an answer to the question of who could compel a disclosure.
Switzerland’s answer was unusually good. No mandatory retention reaching VPN operators, outside the European Union, outside the intelligence-sharing arrangements that shape Germany’s long argument about a three-month logfile. Sweden arrives at a similar answer by a different route, where the providers argue the operator duties never applied to them.
⚠️ If the revision passes, that answer changes for every Swiss provider at once. Proton VPN is the one our readers are most likely to hold — and PrivadoVPN has already announced plans to move to Iceland for the same reason.
And it explains why we weight audits and court records as heavily as we do. A no-logs claim is a statement about systems; a jurisdiction is a statement about what a government could require of those systems tomorrow.
What the Companies Have Said and Done
The response has been unusually direct for an industry that normally issues statements.
Proton’s chief executive said the company would leave. Speaking to Swiss broadcaster RTS in May 2025, Andy Yen called the proposal a major violation of the right to privacy and said the only European country with a roughly equivalent law is Russia.
NymVPN said the same. A smaller Swiss provider, it confirmed it would relocate rather than implement identification requirements.
Proton has already started moving. On 23 July 2025 it announced it was relocating most of its physical infrastructure out of Switzerland and investing over €100 million in the European Union. Its AI assistant went first, to Germany. The company frames this as a response to legal uncertainty rather than an exit, and Proton AG remains headquartered in Geneva.
⚠️ The industry is not unanimous. The Swiss cloud provider Infomaniak publicly criticised Proton’s position on anonymity, then clarified in June 2025 that it also opposes the revision in its current form.
What Is Not Settled
Worth being explicit, because this subject attracts overstatement.
It has not passed. Reporting describes strong resistance in parliament and among providers, and an ordinance can be revised or dropped.
The thresholds and definitions may move. The five-thousand-user figure and the six-month period come from reporting on the draft, not from a final text.
A relocation is not an exit. Moving one product’s hosting is a hedge, and the company has said so in those terms. PrivadoVPN went further and completed a corporate move to Iceland instead.
⚠️ So the honest status is: proposed, resisted, and already changing behaviour. That last part is the one that matters to a buyer.
What This Means for Choosing Now
If you hold a Swiss provider, nothing has changed today. No new obligation applies, and no provider has implemented one.
If jurisdiction is your main reason for buying, spread the risk. Mullvad is Swedish and owned by its founders; IVPN operates from Gibraltar; NordVPN is Panamanian, which is the cleanest answer among the large providers.
If audits matter more to you than the flag, Proton’s record is unchanged and remains among the strongest we cover.
⚠️ And watch what companies do rather than say. Moving infrastructure costs money; press releases do not — which is the same standard we apply to ownership.
Visiting or Living in Switzerland
The ordinary half, and it is short.
Using a VPN there is lawful, and the revision does not change that — it concerns what providers must record, not what users may do. The legal-or-illegal framing answers this badly almost everywhere.
Public networks are the usual reason. Hotels, trains and cafés, unchanged by any of the above.
Swiss broadcasters restrict by territory like every public service, so a Swiss address is what SRF and its counterparts want.
How We Research
This guide draws on TechRadar for Andy Yen’s statements to RTS in May 2025, for NymVPN’s position, for Infomaniak’s criticism and its June 2025 clarification, and for the relocation of Proton’s first product out of the country; on gblock and DoVPN for the reported content of the draft ordinance including the five-thousand-user threshold, the six-month retention period and the decryption obligation; and on Tuta for the background of the 2016 retention law and the 2018 revision that exempted services such as ProtonMail from some obligations. We have described the proposal as a proposal throughout, because it is one. Several sources are published by companies with a commercial interest in the outcome, including Proton’s competitors, so we have used them for reported statements and dates rather than for conclusions. We do not run our own tests. Our method lives on the About Us page.
Switzerland VPN FAQ
Today, yes — no new obligation applies and no Swiss provider has implemented one. A proposed revision to the surveillance ordinance would extend identification and six-month retention duties to VPN services, and until that is resolved the advantage is real but no longer settled.
No. It is a draft revision to an ordinance rather than a statute, advanced by the Federal Council and the justice department, and reporting describes resistance across the political spectrum. Coverage suggests it could enter force during 2026 if adopted.
Proton has said it would leave if the revision passes, and it has begun moving some infrastructure, starting with its privacy-focused AI product. The company describes this as a response to legal uncertainty rather than a decision to exit, and says investing in Europe is not the same as leaving.
According to reporting on the draft, services above roughly five thousand users would collect government-issued identification, retain subscriber data such as email addresses, phone numbers and port numbers for six months, and decrypt communications on request where they hold the keys.
Not on the strength of a proposal. If jurisdiction is your main reason for buying rather than audits or price, it is reasonable to prefer a provider based elsewhere — Sweden, Panama and Gibraltar are the alternatives among the services we review.
The Verdict
Swiss jurisdiction is still a real advantage, and it is no longer a settled one. The revision under discussion would extend identification and six-month retention to VPN providers for the first time.
The companies concerned are treating it as existential. Proton has said it would leave and has already moved a product; NymVPN has said the same.
Nothing has changed for you today. But if you bought a provider for its flag rather than its audits, this is the year to notice that flags are written by governments and can be rewritten by them.