Using a VPN is legal in all 50 US states and under federal law. There is no statute that prohibits consumer VPN use. The legality of a VPN does not change the legality of activity you do through it — illegal stuff stays illegal. This page explains the actual legal landscape, who regulates what, and where the edges are.
Federal law
There is no federal statute that bans, restricts, or licenses consumer VPN use in the United States. The Computer Fraud and Abuse Act (CFAA), the Electronic Communications Privacy Act (ECPA), and other relevant federal laws do not treat VPN usage as an offense in itself.
What IS regulated at the federal level:
- The activity you do through the VPN. Federal crimes like wire fraud, distribution of CSAM, unauthorized access to computer systems, and copyright infringement remain illegal regardless of whether you use a VPN to do them.
- VPN providers as data custodians. US-based VPN providers are subject to subpoenas, court orders, search warrants, and National Security Letters (NSLs). They cannot legally lie to law enforcement about what they store.
- Truthful advertising. The FTC has jurisdiction over false claims by VPN providers ("no logs" while logging, exaggerated encryption claims, etc.).
None of this restricts the user's right to use a VPN. It governs the providers and the underlying activity.
State law
No US state criminalizes VPN use. Some states have privacy laws that apply to VPN providers operating in their jurisdiction:
- California (CCPA, CPRA): consumer privacy rights apply to VPN providers handling California residents' data. Users can request access to and deletion of their data.
- Virginia, Colorado, Connecticut, Utah, and others: have their own privacy frameworks, mostly modeled on CCPA. Same application to VPN providers.
- Illinois (BIPA): biometric privacy law; relevant if a VPN provider collected biometric identifiers (most don't).
These laws empower users; they don't restrict use.
What "using a VPN is legal" actually means
The distinction worth making clear: legality of the tool is separate from legality of the activity. Compare:
| Activity | Legal status | Does VPN change it? |
|---|---|---|
| Browsing Wikipedia through a VPN | Legal | No (still legal) |
| Using public WiFi safely through a VPN | Legal | No (still legal) |
| Encrypting your work-from-home traffic with a VPN | Legal | No (still legal) |
| Downloading copyrighted content through a VPN | Illegal (DMCA) | No (still illegal) |
| Unauthorized access to a computer system through a VPN | Illegal (CFAA) | No (still illegal) |
| Fraud through a VPN | Illegal (wire fraud) | No (still illegal) |
A VPN is a network-privacy tool. It encrypts your traffic and hides your IP. It does not change the legal status of anything you do.
FCC / FTC jurisdiction
FCC (Federal Communications Commission)
The FCC primarily regulates broadband providers, telecom carriers, and spectrum. VPN providers themselves are not classified as common carriers and aren't subject to direct FCC oversight. The FCC's role in VPN matters is mostly indirect — through rules about what ISPs can do with user data, which incentivizes VPN adoption.
The 2017 repeal of FCC broadband-privacy rules (which would have restricted ISP data sale) is widely credited with a spike in consumer VPN adoption.
FTC (Federal Trade Commission)
The FTC has consumer-protection jurisdiction and has occasionally pursued enforcement actions against VPN providers for:
- False "no-logs" claims when logs were actually kept.
- Misrepresenting encryption strength or technology.
- Hidden subscription or autorenewal practices.
- Selling user data while claiming privacy.
The FTC's role is provider-side, not user-side. It doesn't restrict VPN use; it enforces honesty by VPN companies.
Government use and policy
Federal agencies, the military, and large enterprises routinely use VPNs for legitimate security purposes. NIST publishes detailed guidance on enterprise VPN architecture (SP 800-113, SP 800-77). CISA recommends VPN-equivalent technologies for remote workers. The federal government's own use is a strong signal of VPN legitimacy.
Could this change?
Federal proposals over the years that touched VPNs (EARN IT Act, various lawful-access bills, encryption-mandate legislation) have either failed or stalled. The political coalition opposing VPN restrictions includes:
- Civil liberties groups (EFF, ACLU).
- The technology industry (which uses VPNs for enterprise security).
- Security professionals and researchers.
- First Amendment scholars.
A full ban faces significant constitutional friction. More plausible future restrictions would be at the encryption or lawful-access layer, not at the "you can't use a VPN" layer.
Practical takeaways
- Using ClownVPN, ProtonVPN, Mullvad, or any consumer VPN in the US is legal. It always has been.
- If you do something illegal through a VPN, you've still done something illegal. The VPN may make detection harder but doesn't provide legal immunity.
- If you're concerned about a specific situation (legal employment, immigration status, civil dispute, etc.), talk to a qualified attorney. We can't give legal advice.
- If you're a privacy-conscious individual just looking to use a VPN for the normal stuff (public WiFi, ISP privacy, encryption-while-traveling), you're well within standard, legal use.