VPNs in 2026: What Governments Actually Want and What Encryption Actually Does

This post covers a fast-moving mix of law and technology. Every claim is sourced in the list at the end so you can check it yourself. Details are accurate as of publication. Laws and proposals in this space move quickly, so follow the linked sources for the current status.

For years the pitch for a VPN was simple: encrypt your traffic, hide your IP, stop your ISP from watching everything you do. That pitch made sense in a world where most of the internet ran over plain HTTP. It makes less sense today. Modern browsers force HTTPS with TLS 1.2 or TLS 1.3 by default, so the content of your traffic is already encrypted before a VPN ever touches it. So what is a VPN actually doing for you in 2026, and why are multiple governments suddenly interested in taking it away or forcing it to keep logs?

Two things are happening at once. Lawmakers are going after VPNs from the outside, through age verification laws and data retention rules. And the technical reason people started using VPNs in the first place, hiding what site you’re connecting to, is being solved by a completely different piece of engineering called Encrypted Client Hello. Both threads matter, and neither gets much attention on its own.

This post covers what’s legally happened so far, what’s only been proposed, what the actual TLS handshake reveals about you right now, and how ECH, Windows and Linux all fit into the picture.

If you want the groundwork on how encryption in transit works before diving in, see Encryption in Transit: TLS, HTTPS, SSH and VPN.

Part 1: What governments are doing

The one law that’s actually in effect: Utah

Utah is the only US state where a VPN-targeting law has actually taken effect, not just been introduced. Senate Bill 73, the Online Age Verification Amendments, was signed by Governor Spencer Cox on March 19, 2026 and went into effect May 6, 2026. It doesn’t ban VPNs outright. Instead it holds adult content sites liable for Utah visitors even if those visitors used a VPN to spoof their location, which forces platforms to either block VPN traffic entirely or add identity verification on top of it.

Aylo, the parent company of Pornhub, sued over the law, and Utah agreed not to enforce it until September 3, 2026 while the case plays out.

Michigan’s bill: still just a proposal

House Bill 4938, the “Anticorruption of Public Morals Act,” was introduced September 11, 2025 by Rep. Josh Schriver and five other Republican representatives. It’s the most aggressive VPN proposal on the table anywhere in the US. The bill targets “circumvention tools” and requires internet service providers to actively monitor and block them, and reporting on the bill notes that sweeps in VPNs, proxy servers and encrypted tunneling. Individuals distributing prohibited material face up to 20 years in prison and a $100,000 fine. Commercial entities and ISPs that fail to block face civil penalties up to $500,000 per violation.

It has not moved out of the Judiciary Committee and there is no indication it has enough support to pass.

Wisconsin: the VPN provision was already killed

This one is worth including for the opposite reason. Wisconsin’s Senate Bill 130 and Assembly Bill 105 originally required any site hosting age-restricted content to block every user connecting through a VPN, no exceptions. It passed the State Assembly in early 2026 and looked headed for passage. Then, after an open letter from the EFF calling it “a spectacularly bad idea” and a wave of public pressure, State Senator Van Wanggaard introduced an amendment on February 19, 2026 that struck the VPN blocking language entirely and added explicit language protecting VPN companies from liability. Both chambers approved the amended bill and it went to the governor without the VPN provision.

This is the clearest real example so far of public pushback actually changing a bill before it became law, and it’s a useful contrast against Utah, where the same kind of provision did make it into force.

The EU: age verification app, and a VPN comment that set off a firestorm

In late April 2026 the European Commission announced an EU-wide age verification app, expected to roll out to pilot countries by the end of 2026. At an April 29 press conference, Commission Executive Vice-President Henna Virkkunen was asked how the system would stop minors from bypassing it with a VPN. Her answer, “it’s an important part of the next steps also to look at that it shouldn’t be circumvented,” was enough to set off weeks of backlash from cryptographers and privacy groups, including Belgian cryptographer Bart Preneel.

It’s worth being precise here: this is not an enacted VPN restriction. Euronews and other outlets have since run fact checks noting the comment does not represent official EU policy, and the document that started the controversy, a European Parliamentary Research Service briefing, is a research paper for members of parliament, not a proposed law. But the direction of travel matters, and it’s already showing up in a separate, more concrete track: a leaked EU Council document reported by Netzpolitik in November 2025 shows a majority of member states have agreed on the outline of a new mandatory data retention framework, which would require logging of connection metadata by online services including VPN providers. A formal legislative proposal is expected at the end of the first half of 2026.

Germany has its own draft bill requiring ISPs to log IP addresses and connection timestamps for 90 days, still awaiting a Bundestag vote as of mid-2026.

Global count

India’s CERT-In rule, strictly enforced starting April 2026, requires VPN providers operating in India to log real names, contact information, IP addresses and usage data for five years. One industry tracker puts the number of countries with active VPN data retention mandates at 47 as of 2026, up from 23 in 2020, with 18 more considering similar rules. Treat that specific count as one source’s estimate rather than a settled figure, but the direction is consistent across every source we found.

The US federal picture: less settled than it looks online

Two federal-level claims circulate a lot around this topic, and both need a correction.

FADPA (H.R. 791), the Foreign Anti-Digital Piracy Act, introduced by Rep. Zoe Lofgren in January 2025, would let copyright holders get court orders forcing ISPs to block foreign piracy sites. It gets cited as a threat to VPNs, but the bill text says the opposite: it explicitly excludes “service providers that exclusively provide virtual private network (VPN) services” from the definition of broadband providers subject to blocking orders. If anything, this bill is evidence that Congress felt the need to carve VPNs out by name. The real criticism from digital rights groups is about DNS-level overblocking of legitimate sites, not VPN traffic.

The RESTRICT Act (S. 686) is the other one, and it’s mostly outdated at this point. That bill was introduced in the 118th Congress in 2023, aimed at TikTok and foreign-owned technology, and died without a vote at the end of that Congress. The widely shared claim that it would fine VPN users $250,000 traces back to a viral post, not the bill text. The bill does carry a civil penalty of up to $250,000 and a criminal penalty of up to $1 million and 20 years, but those apply to violating a federal mitigation order or ban, not to using a VPN, and PolitiFact confirmed the bill’s own language never mentions VPNs. There’s a bill with the same short name in the current Congress, but it’s unrelated legislation about AI chip exports to China.

The one federal thread that is current and unresolved is FISA Section 702. In late March 2026, a group of senators including Ron Wyden sent a letter to the Director of National Intelligence asking whether VPN users get classified as “foreign” under Section 702 and Executive Order 12333, since routing your traffic through a VPN server can make an American’s connection look like it originates overseas. That’s a real, open question raised during the 2026 reauthorization fight, not a settled outcome.

One thing none of this touches is existing law. Using a VPN to pirate copyrighted material or commit a crime is still fully prosecutable under the DMCA and ordinary criminal statutes. A VPN never granted immunity from that, and nothing above changes it.

Part 2: What a VPN actually hides today, and what it doesn’t

Here’s the part most articles skip. With HTTPS and TLS 1.2 or TLS 1.3 doing the heavy lifting, the content of your traffic is encrypted whether you use a VPN or not. What isn’t encrypted, in a standard TLS handshake, is the Server Name Indication field, the part of the ClientHello message that says which hostname you’re connecting to. Anyone running Wireshark on the same network segment, your ISP, a coffee shop’s router or a corporate firewall, can read the SNI in plain text and know exactly which site you visited, even though they can’t read what you did there.

Secure DNS doesn’t fix this. DNS over HTTPS and DNS over TLS encrypt the lookup that turns a domain name into an IP address, but they do nothing about the SNI field in the TLS handshake that happens afterward. You can have DoH turned on, your DNS traffic fully encrypted, and still have the hostname of every site you visit sitting in plain text on the wire.

A VPN closes this gap, but only in one direction. Once your traffic is inside the tunnel, the TLS handshake and its SNI field happen between you and the destination site through that tunnel, so your ISP only sees encrypted VPN traffic and has no visibility into the SNI at all. But the VPN provider itself is now the one relaying that handshake, and it can see the same SNI your ISP used to see. You haven’t eliminated the exposure, you’ve moved who has to be trusted with it, from your ISP to whichever VPN company you picked. That’s a real reason to care who your provider is, not just whether they have a kill switch.

Part 3: Encrypted Client Hello closes the SNI gap for real

Encrypted Client Hello, ECH, is the standard meant to fix this properly, by encrypting the SNI and most of the rest of the ClientHello message instead of leaving it exposed. The formal spec, RFC 9849, was published March 3, 2026, closing out an effort that started as ESNI back in 2018.

Where things stand as of 2026:

Firefox has had ECH on by default since version 119.
Chrome and Edge are rolling it out, with Edge exposing a policy flag but generally following server-side availability.
OpenSSL 4.0, expected spring 2026, added ECH support, and NGINX 1.29.4 shipped native ECH support in early 2026.
Cloudflare already enables ECH for every domain on its network, which covers a large share of the web.

Two important limits, and this is where most explainers get sloppy:

ECH needs DNS over HTTPS or DNS over TLS to work. The encryption keys for ECH are delivered through a DNS record. If your DNS queries go out in plain text, an attacker can strip the ECH configuration before it reaches you and force a fallback to a plain, unencrypted SNI. Encrypted DNS isn’t optional here, it’s a requirement.
ECH hides the hostname, not your IP address. A VPN and ECH solve two different problems. ECH stops a network observer from seeing which site behind a given IP or CDN you’re visiting. It does nothing to hide your own IP from the site you’re visiting, or to encrypt anything beyond the handshake. A VPN still does the IP-hiding and full-tunnel job that ECH was never designed to do.

Part 4: Why the operating system matters more than people think

Here’s a case that landed this year and makes the “your OS matters more than your VPN” argument better than any general claim could. In July 2026, a federal complaint against an alleged member of the Scattered Spider hacking group, Peter Stokes, revealed that Microsoft has been assigning Windows installations a persistent Global Device Identifier, or GDID, since before this case made it public. GDID gets created the moment you sign into a Windows machine with a Microsoft account, survives regular Windows updates, and has no user-facing opt-out. In the Stokes case, investigators used GDID records to link the same Windows installation across different IP addresses, VPN connections, proxy servers and three countries.

The important detail for this post: GDID isn’t part of your network traffic at all. It operates at the layer where Windows talks to Microsoft’s cloud services, entirely outside whatever tunnel a VPN builds. A VPN never had a chance to hide it, because it was never in the path a VPN protects. Windscribe, a VPN company, released an open-source script called deGDID in response, though running it breaks some Microsoft cloud services and doesn’t reliably prevent a new GDID from being minted once you sign back into the same account.

This connects directly to a separate, ongoing fight: Microsoft has been progressively closing the workarounds that let people set up Windows 11 with a local account instead of a Microsoft account. The OOBE\BYPASSNRO command and the ms-cxh:localonly trick both got broken over a series of updates starting in late 2025, and each closure pushes more Windows Home users toward a cloud-tied account by default. If you want to keep a machine off a Microsoft account, see Why You Should Ditch the Microsoft Account, and for the related key-escrow problem see BitLocker and Microsoft Accounts.

Apple’s model ties a machine to an Apple ID and iCloud in a comparable way for anyone using iCloud sync, Photos or Find My. Neither company frames this as tracking, both frame it as account continuity and device recovery, but the practical effect for someone who wants a machine that isn’t tied to their identity is the same either way.

Linux deserves a caveat here rather than a blanket claim. Most mainstream distributions don’t ship a persistent device identifier tied to a mandatory cloud account, because there’s no equivalent forced account in the first place. But “Linux” isn’t one thing, and it isn’t automatically private by default. Ubuntu has shipped opt-out telemetry and, in past versions, Amazon search integration in its default install. The privacy advantage of Linux comes from being able to see and strip that stuff out, not from some inherent property of the kernel.

Part 5: For admins, cleaning up old ciphers still matters

TLS 1.0 and TLS 1.1 were formally deprecated by RFC 8996 and have been unsupported by every major browser since January 2020, but plenty of Windows Server boxes still have them enabled because nobody went back and turned them off. The settings live buried in the registry under SCHANNEL, and hand-editing them is a good way to break something.

IIS Crypto, a free tool from Nartac Software, exists specifically for this. It gives you a GUI over protocols, cipher suites, hashes and key exchange algorithms, supports Server 2012 through 2025, and has a one-click Best Practices template that enables TLS 1.2 and 1.3 while disabling SSLv2, SSLv3, TLS 1.0, TLS 1.1 and known-weak ciphers like RC4 and 3DES. Worth a caution for less technical readers: on older environments running legacy line-of-business software, disabling TLS 1.0 can break things, so a traffic audit before hitting Best Practices is worth the ten minutes it takes.

Where this leaves the reader

A VPN in 2026 isn’t doing the same job it did ten years ago. Your traffic content was already encrypted before it left your browser. What a VPN actually buys you now is IP concealment and, if you trust the provider, one less party who gets to see which sites you visit. ECH is closing that second gap without a VPN at all, but it needs encrypted DNS to work and it still won’t hide your IP. And none of it matters if the operating system underneath is tagging you at a layer no VPN ever reaches, which is exactly what the GDID case showed in the clearest terms anyone’s gotten yet.

Meanwhile, the legislative pressure is real, uneven and moving in inconsistent directions depending on which government you’re looking at. Utah enforced something. Wisconsin walked something back. The EU hasn’t passed anything yet but has said enough out loud to worry the people who understand the tech. None of that is a reason to panic, but it’s a reason to know exactly what a VPN is and isn’t doing for you, so you can make the call yourself instead of taking a marketing page’s word for it.

Sources

Utah SB 73

Michigan HB 4938

Wisconsin SB 130 / AB 105

EU age verification and data retention

Global count

US federal

How the TLS handshake and ECH work

Operating system identifiers (GDID) and Microsoft accounts

For admins: old ciphers and TLS deprecation

Related reading: