India VPN Regulation: Law vs. Practice in Network Enforcement

India has no blanket legal prohibition on VPN use. Yet VPN blocking occurs in practice through intermediate enforcement mechanisms. Understanding the gap between statutory law and operational reality requires looking at both the regulatory text and observed network techniques.

The legal foundation for internet regulation in India rests primarily on three statutes. The Information Technology Act, 2000 (ITA) establishes the framework for intermediary liability and empowers the government to direct content removal or service restriction. Section 69 of the ITA specifically permits the government to "intercept, monitor or decrypt" electronic communications in the interests of national security, sovereignty, or public order. Section 79 grants safe harbor to intermediaries that comply with government directions and demonstrate "due diligence."

The Bharatiya Nyaya Sanhita (BNS), enacted in 2023 and effective from July 2024, replaced portions of the Indian Penal Code and includes provisions on unlawful online conduct and state surveillance powers. These laws do not explicitly criminalize VPN possession or use by ordinary citizens. However, they create legal pathways for blocking access to services and imposing obligations on internet service providers (ISPs) to cooperate with enforcement requests.

Government agencies, particularly the Ministry of Electronics and Information Technology (MEITY) and the Department of Telecommunications, issue blocking directions under these powers. These directions are issued on request from law enforcement agencies such as the Central Bureau of Investigation (CBI) or state police. The blocking orders are not routinely published in full; citizens and researchers learn of them through media reports or inferred network behavior.

In practice, blocking manifests through specific technical mechanisms. DNS filtering is the most common: ISPs receive orders to prevent domain name resolution for known VPN service endpoints. When a user queries for a VPN provider's domain, the ISP's recursive resolver returns a null response or redirects to a local block page. This approach is inexpensive to implement at scale and affects most consumer traffic.

IP-based blocking complements DNS filtering. ISPs maintain updated lists of VPN service IP addresses and drop packets destined for those addresses or return TCP reset packets. This method is more resource-intensive but catches users who configure clients with hardcoded IP addresses or use alternative DNS resolvers.

More sophisticated blocking also occurs. According to public analysis by the Open Observatory of Network Interference (OONI), some Indian ISPs conduct Server Name Indication (SNI) inspection—examining the TLS ClientHello message sent during HTTPS handshake to identify the destination domain before the connection is established. When traffic is destined for a known VPN endpoint, the connection is terminated. This requires deep packet inspection (DPI) infrastructure but defeats many basic evasion techniques.

Observed enforcement patterns suggest selective rather than universal blocking. Documented blocking events have been episodic, often coinciding with political sensitivity or security incidents. During the 2019 Kashmir internet shutdown, blocking was sweeping but temporary. More recent blocking has targeted specific services rather than VPN technology broadly. According to Access Now's KeepItOn project data, India has not implemented nationwide VPN prohibition comparable to China or Iran.

Penalties for circumventing government blocking orders exist in statutory form but are rarely prosecuted against ordinary users. Section 69 of the ITA stipulates imprisonment up to seven years and fines for unauthorized access to protected systems. However, public cases involving ordinary citizens prosecuted for VPN use are not well documented in open reporting. Penalties appear primarily directed at those providing circumvention services commercially or assisting with unauthorized surveillance evasion, though even these prosecutions are uncommon.

The distinction between legal prohibition and operational blocking matters. A user in India technically violates no criminal statute by installing VPN software. However, if that user routes traffic through a blocked VPN service, they may trigger ISP-level packet dropping or DNS redirection. No legal notice precedes this technical blocking; it is operational enforcement without transparent legal mechanism.

Circumvention technologies function at different network layers. Generic open-source protocols like WireGuard and OpenVPN work effectively when the underlying IP addresses are not on ISP blocklists. Obfuscation tools like obfs4 or V2Ray can mask VPN traffic as HTTPS or other permitted protocols, defeating SNI inspection if the underlying endpoint is not blacklisted. For DNS filtering specifically, DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to non-ISP resolvers bypasses ISP-level DNS manipulation. When SNI inspection is present, encrypted SNI (ECH) would theoretically prevent inspection, though widespread deployment remains limited.

Tor and its pluggable transports (Snowflake, WebTunnel) represent different threat models, providing anonymity rather than mere encryption, and can route through volunteer-operated bridges to circumvent IP-blocking. Each approach trades off latency, complexity, and sustainability against blocking technique.

India's regulatory posture remains unsettled. The absence of explicit VPN criminalization contrasts with operational blocking, and enforcement has not reached the intensity of jurisdictions with comprehensive national filtering. This creates a zone of operational uncertainty where the legal status is ambiguous but technical blocking is real.