India Plans New Legal Framework to Tighten Oversight of VPN Providers

India's central government is reportedly working on a new legal framework to tighten regulation of virtual private network (VPN) providers. The proposed framework could mandate that VPN companies establish a physical presence within India and appoint compliance officers and local personnel to liaise with government authorities. This move comes amid concerns that VPNs are increasingly used to bypass restrictions on applications, accounts, and online content blocked in India.

According to reports, the proposed framework is also expected to include penalties for non-compliance, potentially including jail time for local employees of VPN firms. The aim is to ensure VPN providers cooperate with authorities to block access to content prohibited in India. Officials argue that VPNs weaken the effectiveness of geo-blocking orders by allowing users to route internet traffic through servers located outside the country.

The proposed legislation is likely to be modeled on obligations imposed on large social media intermediaries under India's Information Technology (IT) Rules, 2021. The 2022 directions issued by the Indian Computer Emergency Response Team (CERT-In), which required VPN providers to collect and retain user data for five years, have proven ineffective, with many global VPN providers refusing to comply, often by removing their servers from India.

The government's initiative follows a significant expansion of content-blocking orders in India. Thousands of such orders were issued last year and in the current year. A surge in VPN usage during the temporary blocking of Telegram last month highlighted users' reliance on such services to circumvent government-imposed restrictions. Downloads of leading VPN apps rose sharply following these restrictions, indicating a need for stricter regulation.