Is VPN Legal in Saudi Arabia? What the Law Prohibits

Saudi legislation contains no mention of VPN software: neither the Telecommunications and Information Technology Act of 2022 nor the cybercrime law of 2007 uses the term. The telecom statute forbids, in Article 24(2), evading internet filtering or supplying the means for it. The older law judges conduct committed with a computer, whatever the app. Installing a client is no listed offence; what you do with it decides the outcome. Not legal advice.

What Article 24 of the 2022 Telecom Act Prohibits

Royal Decree M/106 of 1 June 2022 (2/11/1443 AH) took effect in December 2022, replacing the 2001 act and giving filtering power to CST, the regulator. Article 24 on the CST website lets it, after coordinating with other authorities, filter content and restrict access to internet services. Paragraph two reads: "It is prohibited to bypass or swindle internet filtering or to provide the means to do so." Supplying tools falls under this too.

Articles 26 and 27 set the sanctions: administrative fines up to 25 million riyals, service suspension, licence bans and platform blocking, chosen by a three-member CST committee in proportion to the breach. No prison term exists here. The committee's decision is appealable to the administrative court within 30 days; the Arabic text prevails.

Where the Anti-Cyber Crime Law of 2007 Applies

The official translation on WIPO Lex shows a 16-article statute that punishes acts, not the app: unlawful access, interception and online defamation (Article 3), fraud and illegal entry into bank or credit data (Article 4), material touching public order, religious values, morals or private life (Article 6), and state-security content (Article 7). A tunnel excuses none of it. Article 13 permits seizing the equipment and software used in an offence.

Penalties in the Two Texts

The One-Million-Riyal Figure

The million-riyal "VPN fine" shared on social media sits in neither statute. The ceilings actually written are 500,000, 2 million, 3 million and 5 million riyals (cybercrime) and 25 million (telecom).

Company VPNs, Hotel Wi-Fi and Banking

A work tunnel, a hotel Wi-Fi tunnel or a bank login from abroad does not need to unblock anything. Nothing gets opened, so Article 24 does not apply to them.

Internet Calls from 2007 to Now

Reports after mid-2024 are anecdotal. Opening a blocked calling feature through a tunnel is still evading the filter.

How the Rule Shows Up in Reliable Reports

Freedom House notes that users in the Kingdom regularly rely on circumvention tools, while Tor's site and those of major VPN brands stay blocked, so install the app before arrival. Its recorded prison terms concern social media posts. The US State Department notes that the government blocks hundreds of sites. Neither of these two reports describes anyone punished for using a VPN as such.

What the 200-Service List Tells You

Three of the 200 services listed claim to work in Saudi Arabia; that is a provider's claim, since VPNRadarLab runs no blocking or legality tests. The 4,024 reviews from Saudi Arabia (App Store Saudi storefront and Trustpilot) reveal which apps people there use, nothing about legality. For picking a service, see the travel page.

FAQ

Can a tourist be fined just for having a VPN app?

Owning it breaks no written rule; running the tunnel past the filter is what Article 24 addresses.

Is a company VPN allowed?

Reaching an employer's systems sits outside the filtering rule unless the tunnel carries blocked material.

Can I use a VPN for WhatsApp calls in Saudi Arabia?

As of June 2024, WhatsApp voice and video calls, not the messaging app itself, were still unavailable, so unlocking them through a tunnel means defeating the filter, which Article 24 prohibits.

Is visiting a blocked site with a VPN a crime?

It breaches the telecom act, handled administratively. What you access is judged under the cybercrime statute.

Saudi VPN Law in Brief

No Saudi law text names VPN tools. The 2022 act bans evading the filter or helping others evade it, with committee-set fines up to SAR 25 million. The 2007 statute punishes conduct whatever the app. Work tunnels and Wi-Fi encryption sit outside the filter rule; blocked content and calling are where it bites.