VPN service legal risk
As of 2026-07-10, this research found no enacted general EU or Swedish prohibition on ordinary VPN possession or use. It would be a mistake, however, to treat “VPNs are legal today” as the whole business analysis.
The nearer risks are provider classification, data-retention obligations for qualifying operators, app-store and payment dependency, marketing claims, abuse response, and country-specific operating conditions.
Present reality
A VPN is a legitimate network-security and confidentiality tool. It can protect traffic on hostile local networks and limit some ISP or local-network observation.
It does not make a person anonymous. It does not secure an infected device, a logged-in website account, a browser fingerprint, a recipient, an unlocked endpoint, or a targeted investigative power.
A provider can choose a lower-risk position centred on secure access, public-Wi-Fi protection, remote-work security, and bounded network privacy. Marketing a product for evading a particular legal duty or court order can increase legal and distribution exposure and supply evidence about knowledge or purpose. That is a risk distinction, not proof that every geographic workaround, terms-of-service breach, or age-gate bypass is itself unlawful.
Swedish provider classification
For a Swedish service, the decisive question is functional classification under LEK, the Electronic Communications Act. PTS notification duties cover specified public internet-access, interpersonal-communications, and signal-transmission services.
Do not state that every VPN automatically falls under LEK, NIS2-related requirements, or data retention. The answer is fact-specific: a conventional VPN may differ from a publicly available messaging, email, relay, or access service.
Before launch, obtain Swedish telecom counsel or written PTS guidance on:
- service classification and notification
- data-retention obligations and exemptions
- disclosure and lawful-request handling
- cybersecurity and incident-reporting coverage
- cross-border infrastructure and subcontractors
PTS’s current data-retention guidance shows that obligations can be substantial for qualifying providers. PTS data retention preserves the current PTS guidance. It is therefore premature to advertise “no logs” before the classification and retention position is documented.
Future-policy outlook
A general VPN ban is not the live base case. More plausible pressure points are:
- age assurance and platform-access requirements
- blocking or enforcement against specified unlawful activity
- app-store distribution requirements
- bank, payment, and advertising restrictions
- telecom-security, data-retention, and lawful-request obligations for providers
Policy can change. A business model built around contested circumvention therefore needs a named risk appetite, jurisdiction-specific legal analysis, and fallback distribution and payment channels. A provider positioned as a general privacy service can instead optimise for lower regulatory exposure, while giving customers clear notice if the threat model changes.
Age-verification circumvention services distinguishes a neutral security and privacy service from a product purpose-built or marketed to defeat a legal gate. That distinction is likely to matter more than whether both products use similar tunneling technology.
Engineering implication
Use mature protocols such as WireGuard, not a custom tunnel protocol. The hard privacy work is not only encryption:
- split billing from access credentials
- minimize metrics and document what remains
- separate DNS from account identity where feasible
- design abuse handling without persistent behavioral tracking
- maintain an honest legal-request policy
- make app permissions, telemetry, and retention understandable
- do not promise that a multi-hop design defeats a powerful correlating actor
Obscura trust 2-party relays and QUIC and Unlinked subscription architecture are useful design inspirations. They are not evidence that a two-person startup should operate a global relay network as its first product.
Business conclusion
Do not start with a generic VPN. Begin with threat-modeling, secure-device setup, partner selection, and privacy operations.
If customers later prove a specific network-privacy need, use a formal partner relationship or a narrowly classified, legally reviewed service. The product’s trust advantage must be provable, not a claim based on “offshore” servers or a marketing slogan.