Jurisdiction matters: Five Eyes, Nine Eyes, and data-retention laws
How to evaluate a VPN like a security professional: policies, jurisdictions, audits, and honest speed tests.
Why jurisdiction isn't just legal trivia
When a VPN provider says "we don't log," they're making a promise. Whether they can keep that promise depends partly on where they operate. A company based in a country with mandatory data retention laws faces a completely different legal reality than one in a jurisdiction that protects privacy by default.
Jurisdiction determines which court orders they must obey, which intelligence agencies can demand data, and what happens if they refuse. It's not paranoia—it's the legal framework that governs every byte of data passing through their servers.
This chapter walks through the actual intelligence-sharing agreements that matter, the data retention laws that force logging even when companies don't want to, and how to evaluate whether a VPN's location creates real risk for your specific threat model.
The Five Eyes intelligence alliance
Five Eyes (FVEY) is an intelligence-sharing agreement between the United States, United Kingdom, Canada, Australia, and New Zealand. It originated during World War II and became permanent during the Cold War. These countries share signals intelligence—intercepted communications, metadata, and surveillance data—with minimal restrictions between them.
The Snowden documents confirmed what privacy advocates suspected: Five Eyes members don't just share finished intelligence reports. They share raw intercepts, develop joint surveillance programs, and coordinate pressure on technology companies. One member can collect data on another member's citizens to circumvent domestic surveillance restrictions, then share it back.
For VPN users, this matters because:
A court order in one Five Eyes country can effectively reach into all five. If UK authorities want data from a Canadian VPN provider, they can request it through established legal channels that are faster and less restrictive than standard international requests.
Gag orders travel with the data. National Security Letters in the US and similar mechanisms in other FVEY countries can prevent companies from disclosing that they've been compelled to provide information or install monitoring capabilities.
Exit nodes in FVEY countries are surveillance points. Even if your VPN provider is based elsewhere, routing through servers in Five Eyes countries means your traffic exits into networks where mass surveillance infrastructure is confirmed to exist.
Does this mean avoid all FVEY-based VPNs? Not automatically. ExpressVPN operated from the British Virgin Islands specifically to avoid US jurisdiction, while Mullvad operates from Sweden (outside FVEY) and has famously resisted Swedish government requests. Location is one factor among several.
Nine Eyes and Fourteen Eyes: the expanded alliances
Nine Eyes adds Denmark, France, Netherlands, and Norway to the Five Eyes agreement. Fourteen Eyes adds Germany, Belgium, Italy, Spain, and Sweden.
The intelligence sharing becomes less automatic as you move outward. Fourteen Eyes countries cooperate on specific operations but don't have the same standing agreements to share raw intercepts that Five Eyes members enjoy.
Practical impact: A VPN based in France faces different pressures than one in the US, but both operate within intelligence-sharing frameworks. The question isn't whether to avoid these jurisdictions entirely—half the world's VPN infrastructure would disappear—but whether the provider has successfully resisted government requests and whether their logging practices can withstand legal pressure.
Sweden is a Fourteen Eyes member, yet Mullvad has operated there since 2009 with a clear record: they've stated publicly that they've received court orders and had nothing to provide because they don't log. Sweden's data protection laws and Mullvad's technical setup matter more than the intelligence agreement.
Meanwhile, some VPNs based outside all of these alliances operate in countries with worse privacy protections. Jurisdiction is about the complete legal environment, not just membership in one alliance.
Data retention laws: when logging becomes mandatory
Intelligence alliances are one threat vector. Data retention mandates are another, often more concrete one.
The EU's Data Retention Directive (2006-2014) required telecommunications providers to store connection metadata for 6-24 months. The directive was eventually struck down by the European Court of Justice, but individual EU countries implemented their own versions.
Examples that matter for VPN selection:
Germany requires telecommunications providers to store connection data for 10 weeks. Courts have debated whether VPNs qualify as telecommunications providers, creating legal uncertainty. Some German VPN providers argue they're not covered; others relocated to avoid the question.
France maintains data retention requirements for connection data—who connected to whom, when, and for how long—though not content. French providers must implement technical means to comply with lawful interception requests.
The Netherlands had mandatory data retention until its Constitutional Court struck it down in 2015, but providers can still be compelled to retain data in specific investigations.
Australia requires service providers to retain metadata for two years under its Telecommunications Act. This explicitly includes VPN services that offer connections to the public.
The UK's Investigatory Powers Act (2016) requires providers to maintain the capability to remove "electronic protection" (encryption) when served with a technical capability notice. They can also be required to retain relevant communications data.
Russia requires all internet services to store user data for one year and content for six months, and to provide decryption keys on demand. No serious privacy-focused VPN operates servers under Russian jurisdiction anymore—they either pulled out or never entered.
These laws change. At time of writing, you can check the current status by reviewing the provider's transparency reports and their official statements about which jurisdictions they operate infrastructure in versus where they're legally incorporated.
Jurisdiction vs. server locations
A VPN company's legal jurisdiction (where it's incorporated) is different from where it operates servers.
Legal jurisdiction determines:
- Which court orders the company must obey
- Which data retention laws apply to the company's records
- Which government can compel the company to modify its software
- Where traffic enters and exits the VPN tunnel
- Which country can physically seize a server
- Where your encrypted traffic passes through
Good VPN providers use RAM-only servers (diskless servers that can't persist data) in high-risk jurisdictions and keep sensitive infrastructure—authentication servers, payment processing—in privacy-friendly locations.
What to check:
Where is the company incorporated? Look for the legal entity name in their terms of service and privacy policy.
Where are their core infrastructure servers? Authentication systems and logging infrastructure (if any) matter more than exit nodes.
Do they use RAM-only servers? Providers like ExpressVPN and Mullvad use this across their network. Others deploy them selectively in high-risk countries.
Have they published details about which jurisdictions host which infrastructure? Transparency here is a good sign.
Privacy-friendly jurisdictions: what makes them different
Some countries offer structural advantages for privacy services:
Switzerland has strong constitutional privacy protections and is outside the EU and all intelligence-sharing agreements. It's not a privacy paradise—Swiss authorities can and do cooperate with foreign investigations—but the legal threshold is higher. ProtonVPN operates from Switzerland and has outlined the legal process required to compel them to monitor a specific user (they must receive a Swiss court order for a criminal investigation, and can only log forward from that point—no retroactive data exists to hand over).
Panama has no data retention requirements and no agreements to share intelligence with Five Eyes nations. It's not a lawless haven—it has mutual legal assistance treaties—but the barrier to obtaining data is meaningfully higher than in countries with standing agreements.
British Virgin Islands is self-governing with its own legal system, outside of UK and EU jurisdiction despite historical British ties. ExpressVPN operated here before being acquired by Kape Technologies.
Romania is in the EU but has relatively strong privacy protections and no mandatory data retention laws after its Constitutional Court struck them down in 2014. CyberGhost operates from Romania.
Iceland has strong constitutional privacy protections and data protection laws that predate GDPR.
Honest assessment: These jurisdictions make it harder for intelligence agencies to demand data quietly, but they're not magical shields. A company operating in Switzerland can still be compromised through other means—malicious employees, software vulnerabilities, or business acquisitions that change the corporate structure.
Red flag jurisdictions
Some countries create irreconcilable conflicts between privacy promises and legal requirements:
China requires VPN providers to obtain government licenses, maintain logs, and provide backdoor access. No legitimate privacy VPN operates there.
Russia's surveillance requirements (SORM-3 infrastructure) and data localization laws make privacy guarantees impossible. VPNs claiming Russian servers either use virtual locations or aren't serious about privacy.
United States has multiple surveillance frameworks: NSA programs revealed in Snowden documents, National Security Letters with gag orders, FISA court orders. US-based VPNs can be compelled to log and forbidden from disclosing it. That said, US providers can fight in court and transparency is possible—it's just harder.
UAE, Turkey, Saudi Arabia, Iran actively block and restrict VPN use. Operating there requires either government cooperation (destroying privacy) or constant technical workarounds.
How to evaluate jurisdiction for your threat model
Start with your actual risks, not hypothetical ones.
Casual privacy seekers avoiding ISP tracking and securing public WiFi don't need to worry much about Five Eyes. Focus on the company's logging policy and whether they've been independently audited. A US-based VPN with a verified no-logs policy is fine for this use case.
Journalists, activists, and high-risk users should avoid Five Eyes jurisdictions when possible and pay close attention to:
- Where authentication servers are located
- Whether the company has successfully resisted government requests (look for transparency reports documenting this)
- Whether they accept anonymous payment methods
- Server seizures (have any occurred, what data was obtained)
Corporate users often have compliance requirements that override privacy concerns. GDPR compliance might actually favor EU-based providers despite data retention concerns.
What transparency reports actually tell you
When evaluating jurisdiction, look for transparency reports that document:
Requests received: How many government/law enforcement requests, from which countries, for how many users?
Data provided: What information was actually handed over? If the answer is "none because we don't have any," that validates their no-logs policy.
Challenges filed: Did they fight requests in court? Fighting and losing is more credible than silently complying.
Server seizures: Have authorities seized servers? What data did they obtain? Mullvad famously had servers seized in 2023 and authorities found nothing useful because of diskless servers and no logging.
No transparency report? That's information too. Companies legally forbidden from disclosing requests (National Security Letters in the US) can't publish full reports, but they can publish "warrant canaries" that disappear when silenced. Even that's better than nothing.
Warrant canaries and their limitations
A warrant canary is a regularly updated statement that the company has not received secret government requests. If the statement disappears or isn't updated, users can infer (but aren't explicitly told) that a gag order exists.
Reality check: Warrant canaries are legally untested in most jurisdictions. Courts might still consider their removal a violation of a gag order. They're a creative workaround, not a guaranteed solution.
Some VPNs publish them. Most don't. Their absence doesn't prove anything except the company hasn't adopted that specific practice.
The "no logs" policy is only as good as the jurisdiction allows
Every VPN claims "no logs" or "zero logs." Jurisdiction determines whether they can maintain that policy when pressured.
A VPN incorporated in Australia, where data retention is mandatory, either complies (and shouldn't claim "no logs") or operates in legal gray area. A VPN in Panama can more credibly maintain zero logging because no law compels them to do otherwise.
The test: Has the policy been validated by external events? Court cases where they had no logs to provide? Independent audits of their systems? Transparency reports showing they've received requests and had nothing to give?
Mullvad passed this test when Swedish authorities seized servers and found nothing. ExpressVPN's servers were seized in Turkey in 2017 (attempting to investigate a political assassination) and contained no user data because of RAM-only architecture. These real-world validations matter more than marketing claims.
Practical evaluation checklist
When researching a VPN's jurisdiction:
Company incorporation: Where is the legal entity registered? Check their terms of service and privacy policy for the legal entity name and address.
Infrastructure location: Where are authentication, payment, and logging systems hosted? These matter more than exit server locations.
Legal framework: What data retention laws, surveillance mandates, and intelligence-sharing agreements apply?
Track record: Has the company published transparency reports? Successfully resisted government requests? Had servers seized with validated results?
Technical protections: Do they use RAM-only servers? How is user data (if any) encrypted and compartmentalized?
Corporate structure: Who owns the company? Recent acquisitions can change the legal landscape entirely—when Kape Technologies (a company with a complicated history) acquired ExpressVPN in 2021, it didn't change ExpressVPN's legal jurisdiction, but it changed who controls the company.
Audit reports: Independent security audits of their no-logs claims? Infrastructure reviews? These should be recent (within 12-18 months) and conducted by reputable firms.
When jurisdiction matters less than you think
For many users, the VPN's jurisdiction is less important than:
Logging policy: A VPN in a privacy-friendly jurisdiction that logs everything is worse than one in the US that verifiably logs nothing.
Security architecture: RAM-only servers, diskless infrastructure, and proper encryption matter more than legal jurisdiction for protecting against server seizures.
Business practices: Payment methods (do they accept cryptocurrency or cash?), account creation requirements (can you sign up anonymously?), and app permissions often create more privacy leaks than jurisdiction.
Protocol and encryption: Using outdated protocols like PPTP or weak encryption undermines privacy regardless of where the company is based. Modern implementations like WireGuard with proper key management matter more for most threat models.
Jurisdiction is one factor in a complete evaluation. Companies in "perfect" jurisdictions can still fail on execution, while companies in challenging jurisdictions can engineer their way around limitations.
Key takeaways
- Five Eyes countries share intelligence with minimal restrictions; Nine and Fourteen Eyes have looser cooperation, but all create legal frameworks that can pressure VPN providers
- Data retention laws in countries like Australia, UK, and some EU nations can force logging regardless of company policy—check whether the VPN's jurisdiction has mandatory retention
- A VPN's legal incorporation matters more than where they operate exit servers; look for privacy-friendly headquarters (Switzerland, Panama, BVI) with technical protections (RAM-only servers) in riskier locations
- Transparency reports showing government requests and empty results validate no-logs claims better than marketing materials ever can
- Match jurisdiction concerns to your actual threat model—casual privacy users have different needs than journalists in authoritarian countries, and obsessing over Five Eyes while ignoring logging policies misses the point
- Independent audits, real-world server seizures with nothing found, and documented resistance to government requests matter more than jurisdiction alone