Culvert VPNIs using a VPN legal?
In most countries, yes: businesses and individuals use VPNs every day. A VPN does not make an illegal act legal, and a few countries regulate providers.
In most countries, using a VPN is legal, and it is ordinary: companies use VPNs to connect offices and let staff work remotely, and individuals use them for privacy on networks they do not control. Two qualifications matter. A VPN does not change the legality of what you do through it, so anything that is illegal without one is still illegal with one. And a small number of countries regulate VPNs, typically by controlling which providers may operate or requiring them to register, so the answer can change when you cross a border.
Why VPNs are legal almost everywhere
The technology is older than most people's idea of it. VPNs were built so that a laptop in a hotel could reach an office network as if it were plugged in at a desk, and that is still how most of the world's VPN traffic is used. Banks, hospitals, governments and software companies all depend on it. Outlawing the technology would mean outlawing a basic tool of business, which is why almost no country does.
Consumer VPN apps use the same technology for a different purpose: keeping your traffic private from the Wi-Fi you are on and keeping your address out of website logs. The what is a VPN post explains what that actually involves. None of it is a legal grey area in most places; it is encryption and routing, the same things your bank's app does.
A VPN does not change what you do through it
This is the point people most often get wrong, in both directions. A VPN hides your traffic from the network and your address from websites. It does not make you anonymous, and it does not create a legal exception. If something is a crime, it is a crime through a VPN. If breaking a service's terms would get your account closed, it still will; the service knows who you are by your login, not your address.
The reverse is also true. Using a VPN is not evidence of anything. Wanting privacy on a café network is a normal reason, and it is the reason most people install one.
Where the rules differ
A few countries treat VPNs differently from the rest, and they do it in a few recognisable ways: requiring providers to obtain a licence or register with a regulator, restricting the use of unapproved services, or asking providers to keep records they would not otherwise keep. In those countries the question is less "is a VPN legal?" than "which VPNs, used how?", and the answer comes from that country's current rules rather than from a general article.
This post deliberately does not list countries. Rules change, summaries go stale, and a wrong answer here could matter. If you are travelling, check the current position for where you are going, from an official or reputable legal source, before you rely on a VPN there. The travel checklist has this as its first item.
Legal is not the same as allowed
Three different parties can have a say in whether you may use a VPN, and only one of them is the law.
| Who | What they control | What happens if you ignore it |
|---|---|---|
| The law | Whether VPN use, or certain providers, are permitted | A legal consequence, in the few places it applies |
| The network operator | Their own acceptable-use policy for their Wi-Fi | Loss of access, or a conversation with HR or the school |
| The service you are using | Their terms of service | Account restrictions or closure |
An employer's network policy can forbid VPNs on company Wi-Fi even where the law says nothing. A school can do the same. Breaking those rules is not a crime, but it can still cost you. The office Wi-Fi post covers how to think about that one, since the sensible answer is often to use mobile data for personal traffic rather than argue with the IT department.
Some online services also object to VPN traffic in their terms and may show extra verification or limit features when they see a shared address. That is their policy, not a law, and it is worth knowing before you assume the VPN is broken.
What a provider owes the law
A VPN provider is a company and has to obey the law wherever it operates. That means a lawful request for the records it holds can be made, and the honest question is what records exist to be handed over. A provider's privacy policy should tell you exactly what it keeps and for how long; a policy that is vague on that point is telling you something. Culvert VPN does not log the sites you visit, your DNS queries or the contents of your traffic, its servers see only an opaque connection id, and it keeps the client's IP address for up to 30 days for abuse handling, all set out in the privacy policy.
Culvert VPN is an ordinary Android app distributed through Google Play, with its terms at /terms and its data handling at /privacy, and is free to install from Google Play.
Questions people also ask
Can I get in trouble just for having a VPN app installed?
In most countries, no; the app is ordinary software and is distributed through Google Play like any other. Where a country regulates VPN use, the rules are about which services may be used or how, so check before you travel.
Is it legal to use a VPN at work or at school?
Legality and permission are different questions. The law rarely forbids it, but a network's own acceptable-use policy can, and breaking that policy can cost you access or your job even though it is not a crime.
Does a VPN provider have to follow the law?
Yes, in every country it operates in, which is why a provider's terms and privacy policy tell you what it will do when a lawful request arrives. Culvert VPN's are at /terms and /privacy.