Is a VPN Legal in the US? Federal Law, State Bills and What Stays Illegal

Yes. Using a VPN is legal in the United States at the federal level, and no state bill targeting VPN connections has become law. What matters to prosecutors and copyright owners is the activity carried through the tunnel, not the encryption itself. This overview is general information, not legal advice.

No Federal Statute Covers the Tunnel Itself

Congress has never passed a law prohibiting anyone from buying, installing or running a VPN. The law looks at the act performed through the connection.

Hacking, Copyright and Torrent Notices Stay Illegal Through a VPN

The Computer Fraud and Abuse Act makes unauthorized access to a computer, or exceeding the access a person was granted, a federal offence, and routing that access through a VPN changes nothing. In Van Buren v. United States (3 June 2021) the Supreme Court held that "exceeds authorized access" means entering off-limits parts of a system, not misusing data the user was allowed to reach. A person who suffers damage or loss can bring a civil claim under § 1030(g), but it must be filed within two years of the act or of discovering the harm.

Copyright is where most people actually get letters. A BitTorrent client exposes the IP address of every peer in the swarm, so rights holders send notices to whoever holds those addresses, and the provider forwards them to the account holder. With a VPN, the address shown in the swarm is the VPN provider's, so the notice goes there instead, but the download itself is still infringement. Under the DMCA safe harbour, a provider keeps its protection from copyright damages only if it adopts and enforces a repeat-infringer termination policy, and a copyright owner can obtain a § 512(h) subpoena from a federal court clerk to identify an alleged infringer. Statutory damages under § 504(c) run from $750 to $30,000 per work, up to $150,000 when the infringement was willful.

VPN Bills in Congress and the States

None of the three is law. The RESTRICT Act targeted technology from foreign adversaries, and its penalties (civil up to $250,000 or twice the transaction value, criminal up to $1,000,000 and 20 years for willful violations of orders under the Act) apply to violating such orders, not to using a VPN. The Wisconsin clause died before the veto, and Michigan's draft has been idle in committee since its referral.

Why US Providers Keep Logs Only by Choice

No federal statute requires an internet or VPN provider to retain connection logs. Under 18 U.S.C. § 2703(f), a government entity can ask a provider to preserve records it already holds for 90 days, renewable for another 90, pending a court order. Preservation cannot create a duty to log, so a service that keeps no connection records has little to hand over under a subpoena or warrant.

Streaming Catalogues and State-Line Betting

Netflix's terms of use tie content access primarily to the country where the account was established, and the company may restrict or terminate accounts that break them. That is a contract consequence, not a criminal charge. Betting is stricter: since Murphy v. NCAA (14 May 2018) let each state authorize sports wagering, licensed operators verify that the player is physically inside a permitted state, and a VPN exit elsewhere fails that check.

FAQ

Is a VPN illegal in any US state?

No. Wisconsin and Michigan debated bills touching VPNs, and neither became law.

Can the FBI track a VPN?

It can compel the VPN provider with legal process to release whatever records exist. A no-logs service has little to give.

Will I get in trouble just for using a VPN?

No. Charges follow conduct such as unauthorized access or fraud, never the tunnel itself.

Is using a VPN to watch Netflix or bet a crime?

For streaming, the risk is account restriction under the terms of use. For betting, a licensed operator's location check rejects players who are not physically inside a permitted state, and the account itself can be put at risk.

What US VPN Users Can Take From This

Buying and running a VPN is lawful everywhere in the country. It does not legalize hacking or copyright infringement: a download stays infringing even when the notice reaches the VPN provider instead of the home ISP. VPN limits have so far been proposed only inside state age-verification bills, and none of them has passed.