India plans big move against VPN web privacy tools

The new framework could require VPN operators to establish offices in India and hire compliance officers who can address grievances raised by the government, two senior government officials told The Indian Express. Penal consequences, including jail terms for local employees, are also being considered in case of non-compliance, it is understood. Much of these requirements and penalties are also present for large social media companies under India’s Information Technology (IT) Rules, 2021.

“In the last few months, we have been observing that users are able to bypass content, accounts and online services that have been blocked by the government on various grounds by using VPN services. The 2022 Cert-In directives that required VPN providers to store some usage data have not managed to rein in these companies as they have simply refused to comply. So, the need for a full-fledged law is being felt,” a senior government official said, requesting anonymity.

Queries sent to the Ministry of Electronics and IT did not elicit a response until publication.

VPN services allow users to mask their IP addresses and browse the Internet via servers located elsewhere, making it appear like the traffic is coming from a different jurisdiction, while hiding the original location. India’s censorship orders typically require companies to geo-block content within the country’s jurisdiction, so, by using a VPN server located in the US, for instance, people can visit content that has been blocked here. They are also a way to anonymously browse the web, and are largely seen as a privacy-enhancing service.

India has stepped up its content blocking ecosystem in recent years, with over 24,000 orders issued in 2025, up from the over 12,000 orders it had issued in 2024, The Indian Express had earlier reported.

Another official said the need for having local points of contact for VPN companies is being felt so that the government can direct these services to not allow access to content that is being blocked, as such services “otherwise defeat the purpose”.

For instance, when the Centre temporarily blocked Telegram ahead of the NEET-UG retest last month, David Peterson, general manager at Proton VPN, a major VPN provider, said that daily registrations for the service from India jumped by more than 120%. Peterson’s post on X and his account were both blocked in India after he shared this information.

The 2022 Cert-In directive required VPN service providers along with data centres and cloud service providers, to store information such as names, email IDs, contact numbers and IP addresses (among other things) of their customers for a period of five years. In response, VPN operators like Proton VPN, NordVPN, ExpressVPN and Surfshark, had removed their servers physically located in India and had started routing traffic coming from India via Singapore.

“We have no intention of complying with this invasive mass surveillance law, leaving us no choice but to remove our VPN servers from Indian jurisdiction,” Proton VPN had said at the time.