Dutch Law and VPNs: Legal Tunnels, Wiv 2017 Powers and BREIN Torrent Claims

Yes. Dutch law contains no provision forbidding a VPN, and nobody gets fined for the tunnel itself. What the law assesses is what travels through it: pirated files, fraud, other offences. This is general information, not legal advice.

What Dutch Law Says to a VPN User

Courts judge conduct, and encryption around it changes nothing.

Nine Eyes and What It Means for Dutch Traffic

The Netherlands appears, alongside Denmark, France and Norway, as one of four countries widening the Five Eyes core to nine. That grouping is known from leaked documents and press reporting, not a published treaty, and Dutch law never uses the term. What the law governs is the handover itself: under Articles 88 and 89 of Wiv 2017, the AIVD and MIVD may work with a foreign service only after weighing five criteria, including that partner's respect for human rights and its level of data protection, and raw data leaves the country only with separate ministerial permission. The glossary on the 5, 9 and 14 Eyes covers the alliance rings in depth.

Wiv 2017 and the 2018 Referendum

What the act allows

The Intelligence and Security Services Act 2017, nicknamed the "sleepwet" (dragnet law), took effect on 1 May 2018 after adoption by the House of Representatives on 14 February 2017 and the Senate on 11 July 2017. Article 48 permits bulk interception of any telecommunication, including undoing encryption; encrypted data may be kept for up to three years for decryption work, with possible extensions. Article 45 allows hacking a device with written ministerial permission, and Article 57 can oblige anyone who knows the encryption to help decrypt it, though not to build in a weakness.

The referendum and what changed

On 21 March 2018 the advisory referendum produced a valid but non-binding no: 49.44 % against, 46.53 % for, 4.03 % blank, with turnout of 51.54 % against a 30 % threshold. The government responded on 6 April 2018 by keeping the 1 May 2018 start date with six adjustments, including faster weighing of foreign partners and yearly review of cable data instead of automatic three-year storage. Cable interception of purely domestic traffic was declared "virtually ruled out" for the coming years, except for cyber defence; a bill codifying part of this passed the Senate on 15 June 2021.

Data Retention Since the 2015 Ruling

Providers once stored traffic and location data for twelve months (telephony) and six months (internet) under the 2009 retention act. After the EU court declared the underlying directive invalid on 8 April 2014, Privacy First and others won summary proceedings before the District Court of The Hague on 11 March 2015: the intrusion went beyond what was strictly necessary, and access to stored data lacked prior independent review. The article still stands in the Telecommunications Act but is not applied, and under Article 11.5 providers must delete or anonymise traffic data once delivery and billing no longer need it.

BREIN and Torrent Claims

Downloading from an illegal source has been unlawful since the ACI Adam ruling of 10 April 2014, and BREIN targets the sources: uploaders, site operators and sellers. Its 2025 report lists 58 settlements (26 "knock and talk" home visits), 3 major uploaders stopped, and over 500 domains blocked on average under civil court orders. For uploaders and site owners identified in BREIN's 2022 annual report, settlements ranged from several thousand to ten thousand euros and more. One uploader who believed he was hidden behind two VPNs was identified and visited by a bailiff anyway. BREIN also wanted providers to forward warnings to frequent BitTorrent uploaders; Ziggo refused, and in early 2022 a preliminary relief judge ruled that would require a licence from the data protection authority. A distributor's plan to demand about €150 per download from 377 identified IP addresses failed at every level between February 2019 and the Supreme Court's dismissal on 25 June 2021: a subscriber is not necessarily the downloader, and the sum looked like a fine. That refusal did not make downloading lawful.

FAQ

Can I be fined for using a VPN in the Netherlands?

No, no Dutch rule attaches a penalty to the connection itself.

Can BREIN identify a torrent user who uses a VPN?

It identified at least one uploader who thought two VPNs protected him.

Do Dutch providers keep browsing logs?

No general retention duty applies since 2015; traffic data goes once billing is done.

Is the Netherlands also in Fourteen Eyes?

Yes, the wider ring of fourteen contains all nine countries.

What to Take Away

Using a VPN in the Netherlands is lawful. It changes nothing about the legality of pirated files, and bulk interception under Wiv 2017 can catch tunnel traffic too. Where a provider is based matters to some readers; the list of VPN providers registered in the Netherlands covers that separately.