A VPN is legal to install almost everywhere a tourist goes. What changes at the border is what the law punishes, what the network blocks, and what stops working.
Dubai's two-million-dirham clause
The number that circulates in travel forums is real. Article 10 of the UAE's Federal Decree-Law No. 34 of 2021, the country's cybercrime statute, sets fines of AED 500,000 to AED 2,000,000 (roughly $136,000 to $545,000), with possible imprisonment, for anyone who circumvents a network's IP addressing to commit an offence or evade detection. The UAE Public Prosecution has repeated that warning publicly.
What the article does not do is ban the software. Lawyers quoted by Gulf News point out that the decree never explicitly prohibits VPN use in the UAE, and corporate tunnels are routine across the Emirates. The exposure sits in the purpose. Checking a bank account on hotel Wi-Fi is one thing. Routing an unlicensed internet calling service through a tunnel is another, and the same legal reading treats unauthorised VoIP as a violation in its own right. Expatriates, who make up the large majority of the country's residents, have lived with that distinction for years.
Most visitors never get near that line. The more common failure is technical: a hotel network that filters VPN traffic, a phone down to 15% by mid-afternoon, a service with no server in the traveler's home country at the exact moment a banking app starts flagging the login. None of those problems has anything to do with Article 10, and all of them are decided before the flight.
Because the phone carries the whole trip, the benchmarks worth reading are handset ones: speed loss on mobile data, battery drain across a day of transfers, and how many countries a network actually reaches. Measured results on how VPNs hold up on a phone abroad put those three figures side by side, which is the comparison that matters before the departure gate, and much less so after it.
Russia's double lockout
Russia is the clearest case of a country restricting VPNs without criminalising the people who use them. A 2017 law bars VPN services from providing access to state-blocked websites, and by February 2026 the authorities had blocked at least 469 services under it, according to Human Rights Watch. In 2025, lawmakers banned VPN advertising, introduced fines for intentionally searching for "extremist" material online (including through a VPN) and made VPN use an aggravating circumstance for certain crimes.
Personal use is still legal. The Kremlin said so on April 15, 2026.
For a visitor, the practical problem is stranger. In April 2026, the Ministry of Digital Development instructed more than 20 of the country's largest internet companies to detect VPN connections and refuse service, and Russian websites began turning away tunnelled traffic around that deadline. A traveler with the VPN switched on can reach Instagram, blocked since 2022, then watch a domestic service decline the same session. Switch it off, and the Western apps go dark again. Apple also pulled several VPN apps from the Russian App Store in March 2026 at the request of Roskomnadzor, which settles where installation has to happen: at home.
China and the roaming detail most guides skip
China has required government approval for VPN providers since a 2017 notice from its Ministry of Industry and Information Technology, and unapproved apps are absent from local app stores. Enforcement has historically fallen on sellers and domestic providers rather than visitors, a pattern that offers no guarantee.
Roaming is what changes the planning. Data on a foreign SIM or a roaming eSIM is routed back through the home carrier's gateway, so the filtering applied to domestic networks never touches it. Hotel Wi-Fi works differently. Join it, and the restrictions return.
Travel advisers in China describe the same scene again and again: a guest whose messaging apps worked all day loses them on the first evening, the moment the phone latches onto the hotel network. A travel VPN installed before arrival covers that gap, along with the laptop, which rarely has a roaming connection at all. The audience for that advice has grown since December 2024, when China extended visa-free transit to 240 hours and turned the firewall into a layover problem for millions of short-stay visitors.
When there is nothing left to tunnel through
Iran sits at the far end. A February 2024 resolution of the Supreme Council of Cyberspace banned VPN use unless explicitly authorised, and on January 8, 2026, the country went almost completely offline. A VPN needs international bandwidth to travel over, and no obfuscation protocol can revive a connection that has been switched off at the source. In October 2026, Iranian cyber officials went further, promising jammers and GPS spoofing against Starlink terminals.
Iran is an outlier in severity, not in direction. A July 2025 report by the European University Institute and Freedom House, Tunnel Vision, found that at least 21 of the 72 countries covered by Freedom on the Net had blocked anti-censorship tools such as VPNs within five years. Every one of them was rated Not Free or Partly Free.
Europe is writing VPN rules too, just more politely
Democracies regulate differently, and the difference is instructive. In May 2025, a Paris court ordered five VPN providers to block 203 domains linked to illegal sports livestreams, as Freedom House noted in its 2025 assessment of France. The ruling fined no user. What it did was treat a VPN provider as an intermediary a judge can instruct, in the same category as a content-delivery network.
That model is where the next round of rules is most likely to land, in Europe and well beyond it. Fewer fines at airports, more obligations on providers, shorter server lists, apps that quietly vanish from one regional store and not another. For travelers, the question of legality is drifting away from the border. It gets settled weeks earlier, by what a provider is still permitted to offer and what the phone already has installed when it boards.
