VPN and the Czech courts: what the Constitutional Court struck down in 2011 and what applies today.
Not legal advice. This is how we read the law for our own service; your situation may differ. Last reviewed 19 October 2026.
“The Czech Constitutional Court abolished data retention” appears on plenty of VPN pages. It is half true. In 2011 the Constitutional Court struck down blanket retention of traffic data and open-ended police access to it; a narrower regime followed in 2012 and survived review in 2019. Here are the rulings, the EU cases around them, and the question that matters to a VPN operator: whom the duty binds today, and why we read it as not binding a VPN.
22 March 2011: Pl. ÚS 24/10
Section 97(3) and (4) of the Electronic Communications Act (No. 127/2005 Coll.), transposing the EU Data Retention Directive (2006/24/EC), required operators to keep traffic and location data on every communication of every user for at least six months; Decree No. 485/2005 Coll. set the details. On a petition by a group of deputies, the Court annulled both provisions and the decree. It did not hold retention impermissible as such, but that the interference must be precisely defined: who may obtain the data, for what purpose, under what conditions, for how long, and how the person concerned learns of it. Recording everyone without suspicion under open rules was disproportionate. The Court also signalled doubts about § 88a of the Code of Criminal Procedure, the police access provision, which was not part of the petition.
20 December 2011: Pl. ÚS 24/11
The second ruling annulled § 88a, which allowed traffic data to be requested in practically any criminal case, with no seriousness threshold and no requirement that other means be insufficient. The annulment took effect on 30 September 2012.
From 1 October 2012: a narrower regime
Act No. 273/2012 Coll. reintroduced retention: six months, then deletion, no content (categories in Decree No. 357/2012 Coll.). The new § 88a requires a court order and applies to intentional crimes punishable by at least three years and to listed offences typically committed online, only where other means are insufficient.
14 May 2019: Pl. ÚS 45/17
Another group of deputies challenged the new regime. The Court dismissed the petition: with prior court authorisation, a seriousness threshold and subsidiarity, retention as such was not unconstitutional. It measured the law against the Czech constitution and did not settle its compatibility with EU law.
The EU layer
Digital Rights Ireland (C‑293/12 and C‑594/12, 2014) invalidated the Directive. Tele2 Sverige / Watson (C‑203/15 and C‑698/15, 2016) held general and indiscriminate retention to fight crime precluded and required prior review of access by a court or independent body. La Quadrature du Net (C‑511/18, C‑512/18 and C‑520/18, 2020) allowed general retention only against a serious threat to national security, for a limited time, plus targeted retention and retention of IP addresses assigned to the source of a connection. SpaceNet (2022) and La Quadrature du Net II (2024) refined this. Many commentators regard the Czech six-month blanket regime as hard to reconcile with EU law; as of this review we know of no change in force.
Who is bound, and why we think a VPN is not
Section 97(3) binds providers of public communications networks and publicly available electronic communications services: your ISP, your mobile operator. A VPN carries packets, so the question is fair. Our answer rests on three points.
- We do not give you internet access. Your operator does, and retains data for that connection.
- We are an information-society service (Act No. 480/2004 Coll.) and a “mere conduit” under Article 4 of the Digital Services Act (Regulation (EU) 2022/2065), formerly the e-Commerce Directive and § 3 of Act No. 480/2004 Coll.: we transmit what the user sends without initiating it, choosing the recipient or modifying it.
- The CJEU asks who is responsible for conveying signals. Web-mail is not an electronic communications service (Gmail, C‑193/18); SkypeOut is (C‑142/18), because Skype contracted with operators to carry calls into the phone network.
The counter-argument, which we will not hide: we rent our server with its connectivity, so we do pay for transmission to and from it. No court has ruled on a VPN as such, to our knowledge, so this is our reading, not settled law. We have not notified the Czech Telecommunication Office as an electronic communications business; if an authority or court took a different view, we would say so publicly. And the data such a duty covers (who connected when, from which address) does not arise on our nodes.
What can still be ordered
Preservation of data we already hold (§ 7b of the Code of Criminal Procedure, up to 90 days, with confidentiality), cooperation (§ 8), production orders, seizure, and since 18 August 2026 direct orders under the e-Evidence Regulation (EU) 2023/1543. All reach only what exists: account ID, expiry, device public keys, payment record, aggregate load. More in data retention in the Czech Republic and what a VPN server seizure yields.
Still open
Whether a VPN is an electronic communications service, whether the Czech regime survives EU law, and how e-Evidence orders will be used.
In 2011 the Court said the state may not watch everyone without rules; in 2019, that with rules and judicial control it may. Retention exists and binds carriers; requests that reach us are counted in the transparency report.