VPNs in France: Lawful for Users, Blocking Orders for Providers

Using a VPN in France is lawful. None of the three relevant codes (Intellectual Property, Sports, or Post and Electronic Communications) names VPN use as an offence, and the government's France Num portal confirms it is legal as long as the purpose is lawful. What changed is the provider side: Paris judges have repeatedly ordered VPN companies to block pirate sports sites. Sharing protected works remains an offence regardless of the route. This page is not legal advice.

The User's Position Under French Law

Article L336-3 of the Intellectual Property Code puts one duty on whoever pays the internet bill: ensure the connection is not used to copy or share protected works without permission. A VPN neither removes nor adds to that duty. Company remote access, encryption on hotel Wi-Fi, reaching accounts back home: all lawful everyday uses.

From HADOPI to ARCOM: How the Warnings Work

ARCOM replaced HADOPI on 1 January 2022 and runs the "graduated response," aimed at peer-to-peer sharing, not streaming. Sworn agents for rights holders report an IP address, the operator identifies the subscriber, and ARCOM sends a first warning; a repeat within six months brings a second warning by letter against signature; new breaches within the year bring a notification letter, fifteen days to respond, then a possible referral to the prosecutor. The ARCOM page details each stage. The 2025 annual review counts 79,188 first warnings, 36% fewer than in 2024, and 1,338 files sent to the courts; peer-to-peer piracy still concerns 2% of internet users, per ARCOM.

The CJEU ruled on 30 April 2024 that identity data and IP addresses may be kept for minor offences only if stored separately, with court or independent-body approval for a third match of the same subscriber. On 30 April 2026 the Conseil d'État, on a case by La Quadrature du Net and others, found the decree of 5 March 2010 incompatible with EU law and ordered it revised. Until then, ARCOM may identify subscribers for minor offences only where data were kept separately, may still do so for counterfeiting, and may cross-match only for the first two warnings.

Court Orders Against VPN Providers, 2025 to 2026

Late July 2025 brought a third Canal+ win, over Formula 1.

The No-Log Defence and the Court's Answer

In the beIN case the providers argued that VPNs are not intermediaries under EU law, that blocking cannot stop at France's borders, that it is costly, and that no-log policies forbid observing user activity. The court found no quantified, verifiable technical evidence for those claims and no proof that compliance would require storing data after connection attempts; the order covers French territory and contracts signed there. The full text of the 18 July 2025 decision is on the Cour de cassation's database.

Blocking During the Match

Law No. 2026-725 of 3 August 2026 rewrote Article L333-10: where an order provides for it, rights holders send identification data through an automated system under ARCOM's control, and named parties must block without delay during live broadcasts. A party ignoring an order risks a fine of up to €75,000 or 1% of worldwide turnover, doubled to €150,000 or 2% if repeated within five years.

Penalty Ceilings in the Three Codes

The table lists only the provisions discussed on this page, not every French penalty.

What Operators Keep Under Data Retention Rules

Article L34-1 of the Post and Electronic Communications Code obliges operators to keep civil identity data for five years after a contract ends, other account and payment data for one year, and technical data identifying a connection's source or device for one year. Traffic and location data survive only under a prime-ministerial decree tied to a serious national-security threat. Content of messages is excluded. Anyone offering the public a connection, even free (a café, a hotel), carries the same duties. The article does not mention VPNs.

Where the "VPN Ban" Headlines Come From

In early February 2026, on Franceinfo, minister Anne Le Hénanff said "VPNs are the next topic on my list" after the Assembly voted 116 to 23 to ban social media for under-15s. In August 2026 the Constitutional Council (decision 2026-911 DC) struck down that ban as a disproportionate restriction with no privacy safeguards, since every adult would have had to prove their age. No text in force restricts VPN use.

FAQ

Can ARCOM warn me while a VPN is on?

ARCOM's letters go to the subscriber whom the internet operator matches to the reported IP address, and sharing protected works stays an offence whatever the route.

Why do some pirate football sites fail in France?

The provider or resolver may simply be executing a Paris court order.

Can a tourist use a VPN in France?

Freely: no permit, registration or declaration exists.

France VPN Law in Brief

A VPN is legal in France and the law never names it as an offence; the blocking orders bind providers, not users. For services with French locations, see the VPNRadarLab ranking.