"Unnecessary and disproportionate" – Experts slam 2-month VPN ban enforced in India

• Doda, a district in India's Jammu and Kashmir region, issued a 2-month VPN ban over national security concerns
• The ban was enforced on May 2, 2025, with some VPN users reportedly detained after that date
• Experts are warning against the attack on people's digital rights, while questioning the legality of the ban

Doda, a district in India's Jammu and Kashmir region, enforced a 2-month VPN ban on May 2, 2025, over national security concerns.

Authorities issued the ban under Section 163 of the new BNSS law (the equivalent of the Indian Penal Code), citing individuals and groups misusing virtual private network (VPN) tools "to circumvent lawful cyber restrictions and access prohibited applications," the order reads.

Digital rights and legal experts have so far strongly criticized this decision. They warn against the attack on people's digital rights and security, while questioning its legality.

Is Doda's VPN ban legal?

The Doda's VPN ban aims to "curtail the use of VPNs in the interest of public safety," and it's extended to all individuals, institutions, internet service providers, and cyber cafes operating in the district.

This means that all residents are barred from using one of the best VPN services or similar tools for two months, to avoid being liable for legal action.

Repercussions for allegedly using VPNs seem to have already begun. In a report published on May 18, Indian publication The Wire reported allegations that an unspecified number of Doda residents under "technical surveillance" have already been arrested as found to be using VPNs.

Two days before, Doda's authorities had already confirmed to have "detained several individuals across the district for violating the directive."

This is why many experts have been raising concerns about how the ban can impact people's rights, like free speech, free access to information, and privacy.

Talking to TechRadar, Senior Policy Counsel and Encryption Policy Lead at Access Now, Namrata Maheshwari, explains that the right to the internet and the right to privacy are protected fundamental rights under the Indian Constitution.

Maheshwari also pointed out how the Indian government has already implemented "an onerous mandate" for VPN providers when it enforced a new data retention law in 2022.

A host of online services are now required to store users' data for up to five years and share it with authorities on request, in fact, something that led to an exodus of major VPN companies from the country.

Yet, "VPNs are not illegal," said Maheshwari, adding that a blanket ban on all VPNs for two months is "unnecessary and disproportionate."

"People have a fundamental right to information and freedom of expression, and restrictions on these rights ought to be legal, necessary, and proportionate – a standard this ban does not meet," she added.

The ban isn't affecting only individual users, though, but also businesses and institutions that regularly use these services for security purposes.

According to Maheshwari, the ban could then end up increasing vulnerabilities in the country's cyberspace, ultimately weakening security as opposed to strengthening it.

She said, "Even in an emergency, preventative measures cannot be this vague and overreaching, particularly where less intrusive means are available."

You might also like

• India ordered X to block 8,000 accounts – here's what we know so far
• Proton Mail hit with blocking order in India
• VPNs are disappearing from India's app stores – and a 2022 law may be the culprit