Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Every other European country in this series pushed a rule outward, towards platforms or providers. Germany keeps pushing the same rule inward, towards its own internet companies, and its courts keep sending it back.
The government is now on its third attempt. Nothing in any version has ever mentioned a VPN.
Is a VPN Legal in Germany?
Yes, entirely, and the question has never been close. No German law restricts buying, installing or using one, and no party in the Bundestag has proposed it. Businesses run them by default. What Germany argues about instead is whether internet providers must keep a record of which customer held which IP address, and for how long.
What Germany Actually Regulates
The subject of the argument matters, because it explains why a VPN is relevant at all.
The target is the access provider, not the tunnel. Draft after draft has obliged the company selling you a connection to log technical details about it. None has obliged anyone to block, detect or register a VPN.
Therefore the German story looks nothing like the Latin ones. A French court ordered five providers to block domains, and a Spanish court did the same without telling the defendants. Berlin has never gone near that idea.
⚠️ The argument is about records, and records are what a VPN moves. Your provider stops seeing which sites you reach, so its log becomes considerably less interesting. What a VPN hides and what it does not sets out the limits of that honestly.
The Third Attempt
Two versions have already failed, which is why the current one is written so narrowly.
Blanket retention went first. German courts struck down the broad Vorratsdatenspeicherung as unconstitutional, and the fight continued for years afterwards.
Then Europe finished the job. In September 2022 the Court of Justice ruled on a challenge brought by Telekom Deutschland and SpaceNet, holding that EU law precludes general and indiscriminate retention of traffic and location data. In 2023 the Federal Administrative Court confirmed that the German rules conflicted with EU law.
The Justice Ministry published a new draft on 22 December 2025. On 22 April 2026 the federal cabinet approved it: access providers would store IP addresses and port numbers for three months, and nothing else.
⚠️ This is not yet law. Both the Bundestag and the Bundesrat must pass it, and the industry association eco has already warned that it conflicts with the case law.
The Carve-Out That Matters
Here is the detail that makes this page worth reading rather than skimming.
The 2022 judgment did not close every door. Alongside the prohibition, the court held that member states may require general and indiscriminate retention of IP addresses in order to combat serious crime, subject to strict proportionality.
So Berlin built the new bill in exactly that gap. Three months, IP addresses and port numbers only, with judicial checks on access.
⚠️ Notice which category survived. Of everything Europe’s highest court examined, the one item it left available is precisely the item a VPN replaces with somebody else’s. That is not an argument for buying one, but it does explain why the German debate and the VPN market keep circling each other.
Who Can Ask, and How Easily
The draft grew between December and April, and the growth went in one direction.
The circle of requesters widened. Reporting by netzpolitik.org describes access extending beyond police and prosecutors to other authorised bodies, including the domestic intelligence service, tax authorities and customs.
The threshold dropped as well. Authorities previously had to show that an investigation would be hopeless by other means; the new wording asks only that it would otherwise be significantly more difficult.
⚠️ Meanwhile the storage itself stays with the provider. Nobody hands a database to the state, and every request still passes through a legal process — a distinction worth keeping when headlines call this warrantless surveillance.
Nothing Here Reaches the User
Worth saying plainly, as in every page of this series.
No German statute penalises VPN use. No fine, no offence, no registration, no proposal.
Every obligation lands on a company. The access provider keeps the record, answers the request and carries the cost — the same shape as the Indian directive aimed at provider records.
⚠️ Germany therefore sits at the opposite end from its neighbours. Britain put a duty on platforms and ruled out touching VPNs, while France and Spain reached the providers through courts. Germany has spent a decade arguing with itself about a logfile instead.
If You Are Visiting or Living There
Ordinary points, all lawful.
Nothing restricts you. Install what you like, connect where you like, and expect none of the sports and adult blocking Italy produced.
Jurisdiction still deserves a thought. Germany sits inside the Fourteen Eyes arrangement, so a provider incorporated elsewhere changes who holds the record — Proton VPN operates from Switzerland, and Mullvad issues an account number instead of asking for an email.
Set it up before you travel as ordinary preparation — our travel guide covers what breaks in hotels.
Test the connection once. Running the leak checks confirms the tunnel does what the app claims.
Choosing a provider is a separate question. That guide covers ARD and ZDF from abroad, and why jurisdiction weighs more heavily in Germany than access does.
⚠️ Not legal advice. We are not lawyers, the bill has not passed, and both chambers may amend it substantially.
Where Germany Sits Against the Rest
The frameworks in this series differ mostly in who receives the instruction. Germany aims at the access provider and asks it to remember rather than to block.
Its courts also behave differently. Elsewhere they extended the reach of blocking; here they twice removed it.
| Country | What the rule aims at | Reaches the user? |
|---|---|---|
| Turkey | The tunnel — ISPs must block | No |
| The UAE | Conduct behind an address | No |
| India | The provider's records | Not nationally |
| China | Provider, tunnel and user | Yes |
| Brazil | Nothing, until a court acts | For 39 days |
| Indonesia | Paperwork — registration | No |
| The UK | The destination you visit | No, and ministers said so |
| The US | The platform, state by state | No, in all twenty-seven |
| Russia | The search, not the tool | Only if you went looking |
| Australia | The platform, and the tunnel itself | No — platforms must detect it |
| France | The VPN provider itself | No, the orders bind five companies |
| Italy | The provider, by regulator order | No, but one VPN left the market |
| Spain | The provider, by injunction without a hearing | No, and only two firms were named |
| Germany | The provider's logfile, for three months | No, and the courts twice removed it |
Our wider legality guide covers why the legal-or-illegal framing answers this question badly almost everywhere.
How We Research
This page draws on the Court of Justice judgment of September 2022 in the Telekom Deutschland and SpaceNet cases as reported by Euronews, on eco’s statements of April 2026 following the cabinet decision and on its account of the 2023 Federal Administrative Court ruling, on Gleiss Lutz for the Justice Ministry draft bill of 22 December 2025, on the Berlin Herald and Telecompaper for the cabinet approval of 22 April 2026 and the three-month scope, and on netzpolitik.org for the widened circle of requesting authorities and the lowered threshold. We do not run our own tests and we do not publish circumvention instructions for any jurisdiction. Our full approach lives on the About Us page.
Germany VPN Law FAQ
No. German law contains no offence for using, buying or installing one, and no party has proposed restricting them. Companies across the country rely on the technology daily. The legislative argument concerns what internet access providers must record, and it says nothing about the software their customers run.
Not yet, under current law. On 22 April 2026 the federal cabinet approved a bill requiring access providers to keep IP addresses and port numbers for three months. Both the Bundestag and the Bundesrat must still pass it, and the industry association eco argues that it conflicts with European case law.
Courts dismantled it. The Court of Justice ruled in September 2022 that EU law precludes general and indiscriminate retention of traffic and location data, and in 2023 the Federal Administrative Court confirmed that the German rules conflicted with EU law. The current bill is the third attempt.
No published case has penalised anyone for the connection itself. Obligations in every draft fall on companies rather than on subscribers. As everywhere, whatever you do through the tunnel remains subject to the same law as if you had done it directly.
It changes who holds the record rather than removing it. Your access provider would log which address it assigned you, but not which sites you reached, because the tunnel hides that. The VPN provider then occupies that position, which is why its jurisdiction and audit history matter.
The Verdict
Using a VPN in Germany is legal, and no draft has ever suggested otherwise. The country regulates the company that sells you a connection, not the software you run over it.
The current bill asks that company to remember your IP address for three months. The cabinet approved it in April 2026, both chambers must still pass it, and two earlier versions died in court.
That history is the useful part. Germany is the country in this series where judges kept removing the obligation, and where the government keeps returning with a narrower one.