Top News

The Centre is reportedly working on a fresh legal framework to regulate virtual private network (VPN) providers. The new rules could require VPN providers to establish a physical presence in India, appoint compliance officers and designate local personnel to liaise with the government.

As per an Indian Express report, the proposed framework is also expected to include penal provisions for non-compliance, including possible jail terms for local employees of VPN companies. 

The obligations are likely to be modelled on those imposed on large social media intermediaries under the Information Technology (IT) Rules, 2021.

The move comes amid growing concerns within the government that VPNs are increasingly being used to bypass restrictions on apps, accounts and online content blocked in India. 

VPNs mask users’ IP addresses and encrypt internet traffic, enabling anonymous browsing and access to geo-restricted content. The Centre, however, has raised concerns over their use to bypass content-blocking orders.

Officials believe the existing 2022 directions issued by the Indian Computer Emergency Response Team (CERT-In) have failed to secure compliance from global VPN providers, prompting the need for a broader legal framework, the report said.

VPN providers have largely refused to comply with the 2022 CERT-In directions, which require them to collect and retain user information, including names, email IDs, contact numbers and IP addresses, for five years, it added. 

The government now wants VPN companies to maintain local points of contact so authorities can direct them to restrict access to content blocked in India. Officials argue that VPNs weaken the effectiveness of geo-blocking orders by allowing users to route internet traffic through servers located outside the country.

The push also comes as India has significantly expanded its content-blocking regime. The government reportedly issued more than 24,000 content-blocking orders in 2025, compared to over 12,000 in 2024.

The Centre’s renewed push follows a sharp rise in VPN usage during the temporary blocking of Telegram in India last month, highlighting how users increasingly rely on such services to bypass government-imposed restrictions.

According to reports, downloads of leading VPN apps jumped 49% above their recent daily average, rising to 2,08,000 from about 1,39,000 after the restrictions on Telegram were announced — the biggest spike since the beginning of 2025.

The proposed law revives a long-running dispute that began in April 2022, when CERT-In directed VPN providers, cloud service providers and virtual private server (VPS) operators to collect and retain customer information, including names, email IDs, contact numbers, IP addresses and usage records, for at least five years to support cybersecurity investigations.

Major VPN providers, including Proton VPN, NordVPN, ExpressVPN and Surfshark, opposed the directive, arguing that mandatory data retention was incompatible with their no-logs privacy policies. Rather than comply, several companies removed their physical servers from India and began routing Indian traffic through virtual servers located in countries such as Singapore.

At the time, Proton VPN said it had “no intention of complying with this invasive mass surveillance law”, adding that removing its servers from India was the only option consistent with its privacy commitments.

The 2022 directions also drew criticism from digital rights groups and legal experts, who argued that mandatory data retention without a comprehensive data protection framework could facilitate surveillance, undermine user privacy and expose journalists, activists and whistleblowers to greater risks. 

The government, however, maintained that the measures were necessary to strengthen cybersecurity and improve cybercrime investigations.

The post Centre Plans New Legal Framework To Tighten Oversight Of VPN Providers appeared first on Inc42 Media.