The Government of India initiated a fresh push to tighten regulatory oversight on Virtual Private Network (VPN) service providers on July 3, 2026, aimed at curbing the widespread circumvention of local content-blocking orders. Facing compliance resistance from global digital intermediaries, the Ministry of Electronics and Information Technology (MeitY) is finalizing an expansive legal framework that will mandate foreign VPN operators to establish a physical presence in the country. The policy shift, defended by the Centre before the Karnataka High Court, addresses growing official concerns that anonymous browsing tools are effectively neutralizing government bans on prohibited applications, prediction markets, and online betting platforms.
The proposed statutory updates represent a strategic departure from the 2022 directives issued by the Indian Computer Emergency Response Team (CERT-In). While the previous mandate required data centers and VPN entities to log and retain customer data for five years, it largely faltered as prominent global providers—including Proton VPN and NordVPN—chose to remove their physical hardware from Indian jurisdiction rather than compromise their user anonymity models.
By continuing to route domestic user traffic through external virtual servers, these platforms effectively bypassed local enforcement. To neutralize this structural loophole, the new framework borrows elements from India’s Information Technology Rules, 2021. The updated policy requires companies to fulfill specific structural conditions:
Government data highlights a sharp escalation in digital enforcement, with online content-blocking orders doubling from roughly 12,000 in 2024 to over 24,000 in 2025. Authorities argue that because VPN networks alter IP architectures, they actively defeat the sovereign objective of these public safety and national security blocks. Conversely, privacy advocates and digital rights groups maintain that forcing localized oversight risks undermining legitimate data privacy frameworks and user anonymity. Legal arguments remain ongoing in court as the government seeks a finalized mechanism to balance national security protocols with digital privacy standards.
