VPN jurisdiction: Czech Republic, Switzerland, Sweden, Panama, and what each can compel.

Blog · 17 October 2026 · 10 min

Not legal advice. This is how we read the law for our own service; your situation may differ. Last reviewed 17 October 2026.

Every VPN sells its jurisdiction. "Swiss privacy." "Fourteen Eyes free." "No data retention laws." Most of it is marketing by omission. The useful question is narrower: in each country, what can a state actually compel a VPN provider to do, under what procedure, and what has it done so far? We compare the country we chose with the three most often cited by competitors. We are not neutral, so we have tried to be careful instead, and we mark what we do not know.

Five powers that matter

• Retention: a standing duty to keep records about users before any suspicion exists.
• Interception: a duty to provide live access to traffic or to build an interface for it.
• Preservation: an order to freeze data you already hold, for a specific case, usually with a gag.
• Production: an order to hand over what you hold.
• Seizure: physical taking of hardware.

Every state has production and seizure in some form. The differences are in the first three, and in who is bound.

Czech Republic

Covered in detail in a separate post. Short version: the Constitutional Court annulled blanket retention and open‑ended police access in 2011 and upheld a narrower six‑month regime in 2019. Retention and interception duties bind providers of electronic communications services. In our assessment a VPN is an information‑society service and a mere conduit, not such a provider; that is our reading, not settled case law. Preservation orders (§ 7b of the Code of Criminal Procedure, up to 90 days, with confidentiality) and production orders can reach anyone who holds data. From 18 August 2026 EU authorities can also send orders directly under the e‑Evidence Regulation. EU consumer law and GDPR apply in full.

Switzerland

Swiss surveillance law is the BÜPF (Federal Act on the Surveillance of Post and Telecommunications) with its ordinance, the VÜPF. Telecommunications service providers must retain metadata for six months and support interception; a lighter category, "providers of derived communication services", has lesser duties unless the authorities classify them as having "extended" obligations. In 2021 the Federal Administrative Court ruled in a case brought by Proton that an e‑mail provider is not a telecommunications service provider for these purposes, which is why Swiss e‑mail and VPN companies say they are outside the retention duty. In 2025 the Federal Council put a revision of the VÜPF out for consultation that would extend identification and retention‑type duties to more derived service providers above certain size thresholds; it drew strong opposition from Proton, Threema and others. To our knowledge the outcome is still under discussion at the time of writing; do not take anyone's word, including ours, on what the final text says. Switzerland is not in the EU: GDPR does not apply directly (Swiss data protection law does), EU consumer rights do not apply, and EU orders go through mutual legal assistance.

Sweden

Sweden is in the EU and bound by the same CJEU case law as the Czech Republic. Its retention rules sit in the Electronic Communications Act and bind providers of electronic communications services; after Tele2 Sverige (a Swedish case) the regime was narrowed and re‑enacted. VPN providers argue, as we do, that they are not such providers, and to our knowledge Swedish authorities have not treated them as such; Mullvad's public position is that no Swedish law obliges it to log. Sweden also has a signals‑intelligence law (the FRA law) allowing the defence intelligence agency to collect cross‑border cable traffic, which is a reason some providers avoid routing through Sweden; it targets the carriers, not the VPN, and the same kind of uplink capability exists in most states in some form. EU consumer law and GDPR apply.

Panama

Panama has no data retention law that we know of that would apply to a VPN provider, and that is the entire argument for it. The other side: no GDPR, no EU consumer protection, no court you could realistically reach as a European customer, and a legal system most customers cannot read. A production order or a seizure still exists there as everywhere; what changes is your ability to verify how it is used. A company registered in Panama with servers rented elsewhere is also governed, for those servers, by the law of wherever they stand.

The table

¹ Depends on the VPN not being classified as a provider of electronic communications services. No court has ruled on a VPN as such in any of these countries, to our knowledge. ² As described above; verify the current state of the VÜPF revision before relying on it.

What the table does not show

Three things decide more than the jurisdiction column.

What exists to be compelled. A production order against a provider that keeps nothing about activity returns nothing about activity, in any country. A preservation order cannot preserve what was never written. That is why we spend our effort on diskless nodes and on keeping the data list short rather than on picking a flag.

Where the servers are. Hardware is governed by the law of the room it stands in, whatever the company's registration says. A Panamanian company with Dutch servers answers to Dutch seizure. Our servers are in the Czech Republic and we say so.

Whether you can check. A jurisdiction where you can read the statute, look up the company in a public register, and sue in a court that will hear you is worth more than one with a better slogan. For Europeans that points to the EU, and inside the EU to a country whose constitutional court has a record on this exact question. That is our bias, and we have tried to show the evidence for it rather than just assert it.