VPN Jurisdictions Explained: Five Eyes, Fourteen Eyes, and Data Retention

VPN jurisdiction is the legal environment that can affect a VPN company, its operations and the information it handles. It influences which authorities can demand records, which retention or assistance duties may apply, and what safeguards or challenges are available. The company’s country of incorporation is an important starting point, but it is only one part of that environment.

A provider can be incorporated in one country, owned by a group in another, employ staff elsewhere and rent servers across dozens of jurisdictions. Payment processors, analytics services and support platforms introduce further legal relationships. A single flag beside the brand name cannot describe all those connections.

Jurisdiction is different from your apparent location

Choosing an exit server changes the public IP address websites see. It does not automatically change the company that holds your account, the location of its support records or the law governing your conduct. Our explanation of how VPNs work shows which parts of the connection move through the gateway.

Your own location also matters. A provider based abroad cannot grant permission to disregard local restrictions. Check VPN legality by country separately from the provider’s privacy jurisdiction.

Five Eyes is an intelligence partnership involving Australia, Canada, New Zealand, the United Kingdom and the United States. Australia’s National Intelligence Community describes the partnership as its longest-standing intelligence collaboration, with roots in wartime UK–US signals-intelligence cooperation.

For a VPN user, the relevant concern is that intelligence cooperation can extend information sharing across national borders. But membership alone does not prove that a particular VPN collects browsing records or routinely supplies account data to intelligence agencies.

What membership does not tell you

These countries retain separate legal systems. Their rules on access, retention, interception, secrecy and remedies are not interchangeable. A review that treats them as one VPN law omits the facts that determine a provider’s exposure.

“Avoid Five Eyes” can be a screening preference for some users. It is not a complete security assessment. A service outside the partnership that stores detailed connection histories can expose more useful retrospective information than a service that minimizes those records, depending on the applicable process and infrastructure.

Nine Eyes and Fourteen Eyes describe broader intelligence-sharing groupings commonly discussed alongside Five Eyes. The European Parliament’s resolution on surveillance and fundamental rights identifies the expanded membership in its explanatory notes. These labels describe intelligence arrangements, rather than a uniform consumer-VPN retention statute.

The full Fourteen Eyes list is Australia, Belgium, Canada, Denmark, France, Germany, Italy, the Netherlands, New Zealand, Norway, Spain, Sweden, the United Kingdom and the United States. Five Eyes and Nine Eyes are included in that list; adding 5, 9 and 14 together would count the same countries repeatedly.

Public labels have limits

Public membership lists do not disclose every operational agreement, dataset or sharing condition. Cooperation outside these groupings can also exist. The absence of a country from the list does not establish that its agencies never exchange information with foreign partners.

Nor does Fourteen Eyes membership mean every agency has unrestricted access to every VPN server in every member country. Legal authority, the records available and the technical means of obtaining them still matter. Treat the list as context for further questions, not a map of guaranteed access.

Intelligence sharing concerns cooperation between agencies. Retention concerns how long information is kept. Legal access concerns an authority’s power to obtain information or require assistance. Those activities can interact, but none is a substitute for explaining the others.

Existing records and future collection need separate analysis

A provider that has not retained a particular historical mapping cannot simply reconstruct it from nothing. However, that does not mean it has no account records, cannot be investigated or is immune from every future order. The powers available and the ability to challenge them depend on applicable law.

Similarly, a request to preserve existing records should not automatically be described as a demand to log everyone’s browsing. Read what is being preserved, whom it concerns and for how long. Broad claims hide the distinctions that make a real privacy assessment possible.

“Data retention” is too broad to evaluate without identifying the information. An account email, a payment receipt and a source-IP-to-exit-IP mapping have different uses and consequences. A provider can avoid browsing-history records while retaining information needed to run accounts and handle payments.

Metadata can be identifying

A shared exit address alone may correspond to many users. Add precise timestamps, source addresses and port mappings, and the information may become much more useful for attribution. Whether that mapping exists is an architectural and logging question, not something the country flag can answer.

Our guide to VPN logging policies explains how to read these distinctions. Look for specific exclusions, retention periods and exceptions rather than accepting “we respect privacy” as a description of what is collected.

Encryption and retention are separate protections

The tunnel protects traffic between your device and the gateway. HTTPS can also protect application content between your browser and a website. Neither automatically prevents the VPN operator from holding account or connection information. Read VPN encryption explained alongside the provider’s data policy.

A useful legal summary identifies the covered entity, covered service, data categories, trigger, period and access safeguards. A retention rule for an internet access provider does not automatically apply in exactly the same way to every consumer VPN, corporate gateway or messaging app.

United Kingdom: notice-based retention

The UK’s Notices Regime Code of Practice explains retention notices under the Investigatory Powers Act. It states that retained data under that regime may be kept for a maximum of 12 months, with the notice specifying a necessary and proportionate period. A notice can concern existing data or require its generation.

That is not a universal statement that every UK VPN stores all browsing history for one year. Assess whether the provider is covered, which notice applies and which information it concerns. The figure also does not describe every other retention basis or intelligence collection power.

European Union: safeguards and data categories matter

The Court of Justice’s explanation of its judgment in Case C-470/21 says general retention of source IP addresses can be permitted for combating criminal offences subject to conditions that prevent precise conclusions about private life. It discusses strict separation of retained data categories and safeguards governing access.

This is a specific IP-address judgment, not permission for unrestricted collection of every user’s communications. Equally, it defeats the slogan that EU law categorically prohibits every form of retention. Assess national implementation, the service and the data involved.

Proposals are not automatically current obligations

Check whether a measure is a consultation, adopted law, implementing ordinance or rule already in force. A provider relocation announcement or critical news article can identify a concern without proving that a proposed obligation applies today. Read the effective date and any transition or classification requirements.

A VPN’s jurisdiction can involve several entities. The service company may contract with you, a parent may control its governance, and another company may provide infrastructure or process payments. Identify those relationships before drawing conclusions from the address on the homepage.

A virtual server flag may represent an IP location

A service may advertise a virtual country location while hosting the machine elsewhere. That arrangement can improve availability or avoid local infrastructure, but it needs clear disclosure. Do not infer physical processing location solely from the country selected in the app.

Review VPN server types when comparing virtual, rented, owned and RAM-based infrastructure. The relevant questions include who controls administration, how software is deployed and what data leaves the gateway for other systems.

A parent-company address requires investigation

Ownership can affect governance and legal exposure, but a parent in one country does not automatically prove every user record is stored there. Ask which entity holds the records and which companies have access or control. Avoid both dismissing ownership and treating it as a complete technical diagram.

There is no defensible universal ranking of the best VPN jurisdictions for privacy without defining the user’s concern and the provider being assessed. A country may offer useful privacy safeguards while still permitting lawful orders, cross-border assistance or service-specific obligations.

The table below identifies questions to ask about locations often promoted in VPN marketing. It does not certify that every provider in a country has the same duties or give any country a numerical privacy score.

Switzerland: classify the service before making a claim

The Swiss surveillance service’s official explanation of cooperation duties describes the inclusion of derived communications services within the relevant framework. It also explains that different providers can face different duties or exemptions. This supports checking service classification rather than assuming a Swiss address removes all cooperation obligations.

For an individual provider, examine the current operative rules and its explanation of which category covers it. Distinguish an announced revision from an obligation already applicable. A reputation for privacy does not replace that analysis.

Panama, the BVI and Iceland: inspect the actual provider

Being outside the cited alliance lists can satisfy one preference, but it does not establish zero retention or immunity from legal assistance. A British Overseas Territory should not simply be treated as identical to the UK’s domestic legal system; nor should its constitutional relationship be ignored. Verify local rules, the contracting entity and its operational dependencies.

Inside an alliance: evidence can still matter

A provider in a listed country may publish detailed logging exclusions, restrict identifiers and commission meaningful independent assessments. Those facts deserve inspection. Conversely, an offshore address cannot compensate for opaque ownership, extensive telemetry or unclear source-IP retention.

A no-logs policy is strongest when it identifies excluded data precisely, explains necessary account records and matches the architecture. It is weaker when “logs” is undefined or exceptions appear elsewhere in the terms. Inspect the app, website, support system and gateway policies together.

Read an audit’s scope and date

A security review of a mobile app does not necessarily verify production gateway retention. A no-logs assessment may cover selected systems and a defined period. Check the assessor, methods, systems examined, exceptions and whether the report is available beyond a press release.

An audit offers evidence within its scope; it cannot guarantee every future deployment, corporate change or legal outcome. A recent report that addresses the relevant systems is more useful than a badge with no accessible explanation.

Transparency reports answer a narrower question

Reports can describe requests received, records disclosed and requests challenged. Their definitions matter: criminal requests, civil demands and national-security processes may be treated differently. Some requests may be subject to disclosure limits. A low reported count does not establish that no authority has ever approached the provider.

RAM-only servers and historical legal cases

RAM-based operation can reduce durable data on a gateway, but information can still be sent to remote logging or analytics systems. Likewise, a server seizure or court case can provide evidence about particular circumstances without proving all current operations behave the same way.

Our discussion of VPN privacy myths helps interpret these claims. Prefer several consistent forms of evidence over a single dramatic story or “military-grade” marketing phrase.

The first two charts describe membership counts in the commonly cited groupings. The final chart demonstrates a retention policy using invented records. None measures surveillance intensity, the probability of an investigation or a provider’s privacy quality.

Useful figures with defined scope

The deletion example explains why architecture matters: limiting historical records can limit what is available later. It does not address real-time observation, records held by other parties or lawful prospective collection. Those require separate assessment.

Start by identifying who you want to prevent from observing which information. Ordinary browsing privacy, confidential client work and protection of a sensitive source require different decisions. A country shortlist is most useful after that question is clear.

Local observers and websites see different things

A VPN can reduce an access network’s visibility into destinations carried through the tunnel, while the VPN provider becomes a party you must trust. Websites can still recognize accounts, cookies and browser characteristics. Jurisdiction selection does not remove those identifiers.

Read what VPNs do not protect and VPNs and browser fingerprints before treating a foreign server as anonymity.

Additional hops do not erase legal exposure

Multi-hop VPN routing can distribute parts of a connection across gateways, depending on the design. If one operator controls both hops, that operator’s visibility and systems remain relevant. More countries in the route do not automatically mean less legal or technical exposure.

For source protection or other high-consequence work, combine appropriate communications tools with secure devices, careful account choices and advice matched to the situation. A consumer VPN jurisdiction claim cannot substitute for that broader process.

Use this checklist to make provider comparisons concrete. Record where each answer comes from and when it was checked. Reassess material ownership changes, policy updates, infrastructure changes and significant legal developments.

1. Identify the contracting entity. Read the terms and privacy notice for its legal name, address and role. Separate the brand from the service company.
2. Map ownership and infrastructure. Check parent companies, affiliates, physical server locations and disclosed virtual locations.
3. List the data categories. Look for source addresses, timestamps, exit mappings, DNS activity, account details and diagnostic exceptions.
4. Check record lifetimes. Ask about deletion, backups, support attachments, analytics and records held by payment processors.
5. Assess applicable legal duties. Identify whether the service falls within a covered category, whether retention is notice-based and what safeguards apply.
6. Read independent evidence. Verify audit scope and date, transparency-report definitions and the circumstances of any cited legal case.
7. Verify technical operation. Test IP and DNS behavior, application routing and connection-drop protection.
8. Match the choice to your use. Balance privacy evidence, local legality, work authorization, device support and reliability.

Our VPN testing guide, DNS leak guide and kill-switch explanation cover technical checks. Those checks verify routing behavior; they cannot prove a provider’s internal logging policy.

Questions worth asking a provider

Ask whether it stores source-IP-to-session mappings, whether diagnostic collection can be disabled and whether the audit covers the production systems that handle your traffic. Ask which entity supplies your service and whether its current legal explanation distinguishes existing obligations from proposed changes. Clear, specific answers make jurisdiction claims reviewable.

Assuming outside Fourteen Eyes means outside all cooperation

Countries can cooperate through other channels. Local investigations and orders do not require membership in the cited grouping. A nonmember location should prompt questions about the relevant legal framework rather than end the assessment.

Treating no mandatory retention as no available data

A provider may retain information voluntarily for billing, support, abuse handling or analytics. An absence of a particular general retention duty does not establish that the provider has no records to disclose. Check its actual policy and systems.

Confusing privacy rights with immunity from orders

Privacy protections can require lawful grounds, safeguards and remedies without prohibiting all investigation. Likewise, a governing-law clause in service terms does not necessarily exclude every other authority’s reach.

Comparing providers with invented country scores

A chart that awards Switzerland a perfect score or assigns a fixed risk to every Five Eyes provider creates false precision unless its method and evidence justify the claim. Compare defined facts instead: records retained, legal scope, infrastructure controls and independent findings.

Ignoring the privacy cost of the product itself

A provider’s website trackers, diagnostics or monetization can undermine a favourable country story. Our guide to free VPN safety discusses why the business model deserves attention alongside jurisdiction.

VPN jurisdictions, Five Eyes, Fourteen Eyes and data retention belong in a careful privacy assessment, but they answer different questions. Alliance lists describe cooperation. Laws define powers and duties. Provider policies and architecture determine what information exists and how it is handled.

Choose a service with a clear operating entity, precise collection limits, useful independent evidence and technical controls that match your needs. Review country-specific rules without assuming an offshore address or a privacy reputation resolves every issue. The best jurisdiction for your decision is one supported by the provider’s actual legal and operational position.