Are VPNs Legal in China? Chinese Legal Experts Weigh in
Travellers and expats often have questions of whether using VPNs is illegal in China. We asked Chinese legal experts for their opinions.
The use of VPNs in China falls in a legal grey area, which has caused much confusion for travellers and foreign expats in the country. Anqi Wang, a Chinese lawyer specializing in Internet and Contract Law practicing in Beijing, explains in-depth the legal status of VPNs in China.
- Anqi Wang, Juris Master from University of International Business and Economics, Bachelor of Law and Bachelor of Economics from Nankai University. Currently practicing in the capital markets team of DeHeng Law Offices, Beijing.
with additional commentary by
- Wen Chao, lawyer at Qidu Legal Company, Law at Sichuan University.
Summary: Are VPNs legal in China?
- Use of unauthorized VPNs is illegal in China. But despite an estimated 31% VPN usage rate in China, there are only two recorded cases of individual punishment.
- Although VPN use is illegal, it is not a criminal offense. The maximum penalty is a 15,000 RMB fine and confiscation of illegal gains.
- Unauthorized selling of VPNs is a crime and can result in fines and imprisonment.
I. Using VPNs
Due to legal restrictions many foreign websites and social media such as Google, Instagram, Facebook, Twitter, YouTube, etc. cannot be accessed in China. Foreign expats and Chinese citizens wanting to bypass the so-called “Great Firewall of China” require the use of a VPN service (virtual private network).
The VPN has become one of the most important mobile apps of those living in China. According to a 2017 study by GlobalWebIndex, an estimated 31% of all Chinese internet users use VPNs.
But is it legal to use VPNs in China? In this article we will examine existing legal cases, and regulations regarding the use of VPNs in China.
No. 1: Zhu Yungfeng, Guangdong
Zhu Yunfeng from Guangdong is one of the many people in China that use a VPN. In 2018, he installed a proxy app called “Lantern” on his mobile phone and connected to his home broadband network via mobile phone. From August to December 2018, his mobile phone and computer were both able to “jump over the wall” (a Chinese colloquialism for circumventing internet censorship). Zhu used Lantern VPN as many as 487 times in a single week.
It was reported on December 28, 2018, that the public security bureau (PSB) of Nanxiong City, Guangdong Province warned and fined Zhu RMB 1,000 for his suspected illegal action of “establishing and using an illegal channel for international network connectivity”.
A copy of the administrative penalty notice issued by Guangzhou PSB to Zhu was published and circulated online. According to the copy, the facts of Zhu’s illegal actions are as follows:
- Zhu installed on his mobile phone an APP called Lantern Pro;
- Zhu used the said mobile phone to surf the Internet via his broadband connection, with the APP switched on. The times of total such uses in the latest week was 487.
This seemingly ordinary administrative punishment immediately caused a big uproar on the Internet, because this was the first reported penalty case related to personal use of a VPN.
No. 2: Huang, Chongqing
On January 4, 2019, a notice to the family of the summoned person with the official seal of the PSB of Rong Chang District, Chongqing showed that Chongqing netizen surnamed Huang was suspected of “establishing and using illegal channels for international networking” and was summoned to the Public Security Bureau for investigation and questioning his similar illegal activity.
The facts based on which Chongqing PSB summoned Huang as of this writing are not publicly available yet. An informed netizen said that Huang had not been fined yet, but only summoned.
The two cases signalled a new trend of increasing oversight by public security organs on unlawful international internet connection, which is commonly referred to as “internet surfing by climbing over the wall”.
Such punishments have legal grounds.
According to the provisions of Articles 6 and 14 of the Tentative Rules on the Administration of Computer Information Network International Network Connectivity (hereinafter the “Tentative Rules”):
When a direct international connection is made with a computer information network, an international gateway channel provided by the state public telecommunication networks of the Ministry of Post and Telecommunications (ultimately merged into the Ministry of Industry and Information Technology, MIIT) must be used. No entity or individual shall establish or use other channels to make international connections without authorization. For those who violated the Articles, public security organs may suspend their network connectivity, issue a warning, and impose a fine up to RMB 15,000. Any illegal gains shall also be confiscated.
The Tentative Rules were issued by the State Council on February 1, 1996, and later amended on May 20, 1997. The Informationization Leading Group of the State Council on February 23 of 1998 issued certain implementation rules to the Tentative Rules (“Implementation Rules”) and the Ministry of Information and Industry (later restructured and merged into MIIT) on June 26, 2002 issued the International Telecommunication Exchange Point Bureau Administrative Rules (“Administrative Rules”).
- Both the Tentative Rules and the Implementation Rules clearly state that “No entity or individual shall establish or use any other channels for international network connectivity”.
- Implementation Rules state that an international exchange channel is the physical channel used for international network connectivity.
- The Administrative Rules state that the international telecommunication exchange point is the point connecting domestic telecommunication channels and international telecommunication channels.
On January 17, 2017, the MIIT issued the “Circular on Clearing Up and Regulating the Internet Access Service Market” (MIIT Letter  No. 32, hereinafter referred to as “VPN Circular“). In accordance with the requirements of the Notice, MIIT decided to carry out clean-up work on the Internet access service market nationwide from then until March 31, 2018.
The Notice clarified that enterprises may not build or lease special lines (including VPN) to carry out cross-border business activities without the approval of the telecommunication authorities. In fact, the regulatory issues of VPN have long been highlighted, and the Ministry has gradually begun to manage the telecommunication activities using VPNs. On November 24, 2016, the “Notice on Regulating the Business Activities in the Cloud Services Market” issued by the MIIT (Public Consultation Draft) has mentioned that cloud service providers (also known as IRCS) should build cloud service platforms in China. When the server is connected to the overseas network, it should be connected through the Internet international service entrance and exit approved by MIIT. It is not allowed to build or use other channels for international networking through private lines, VPNs, etc.
According to Feng ZHANG, spokesperson and chief engineer of MIIT, this VPN specification targets the activity of leasing international lines or VPNs and conducting cross-border telecommunication business operations without the approval of the telecommunication administration of enterprises or individuals who have no international communication business qualifications. For example, providing IP telephony, cross-border data transmission services, and the like. Foreign trade enterprises and multinational enterprises may lease from the telecommunication business operators which establish international communications gateway exchanges according to the law when they need cross-border networking through special lines for reasons like office use. The relevant provisions of the Notice will not affect their normal operation.
Lantern Pro is a VPN client, and Zhu’s act of using the app obviously does not constitute “establishing” a telecommunication channel. Whether the use of the APP constitutes “using” illegal channels depends on the operational structure and process of the app. If the app actually utilizes international telecommunication channels other than those established by the state public telecommunication network, using the app may constitute using illegal telecommunication channels for international network connectivity.
Judging from the above two cases, not only VPN sellers and technical service providers are liable for violation of law, but the mere use of “wall-climbing” apps (VPNs and proxies included) might also lead to administrative penalties.
Currently, most “wall-climbing” apps use VPN connections for circumvention purpose, and therefore the possibility cannot be ruled out that such apps utilize telecommunication channels other than those legally established. If VPN users utilized illegal telecommunication channels, the users would face a risk of being penalized for “using illegal telecommunication channels for international network connectivity”.
In light of the foregoing, it is legally advisable for those who are in need of VPN services to utilize services provided by legally qualified and approved telecommunication service providers, such as the international leased private circuit (IPLC) and relevant VPN services provided by China Telecom, China Unicom or China Mobile. It is worth noting, however, that the costs of IPLC and relevant VPN services provided by these three telecommunication companies are relatively high and generally aimed at large enterprises.
Chinese netizens were overwhelmingly critical of the punishment in the Zhu Yunfeng case. They believed that the legal provisions cited by the public security bureau had been abolished and many were circumventing the GFW but had never been punished before. Some netizens speculated that Zhu might have used a VPN to engage in some sensitive activities, so he was given administrative punishment.
For the tens of millions of Internet users who use VPNs in China, the measures taken by the authorities are selective enforcement . It mainly depends on how much influence the act of climbing over the wall has on the country and how sensitive the government feels. See here.
What foreigners should know about the legality of VPNs in China
Unauthorized VPN use is illegal in China. But many people still use VPNs in China and only two people have ever been punished for it.
The reason for weak enforcement of this law may be as follows: Legally, those regulations are formulated in order to improve the administration of international connections to computer information networks and to guarantee the healthy development of the exchange of international computer information. As is known, doing research, socializing with foreign friends, visiting Google, Facebook and Twitter and similar normal uses won’t substantially cause harm to society. In practice, the old saying goes, the law cannot be enforced when everyone is an offender. If the government enforces the law strictly, the cost will be too high. Those who have looked at or posted on websites with illegal contents like terror videos are given priority.
Although VPN use is illegal, it is not a criminal offense. The maximum penalty is a 15,000 RMB fine and confiscation of illegal gains. Breaking any law, regulation or rule is illegal while committing a crime requires that one violates the criminal law. Normal use of VPNs won’t constitute a crime, but selling VPNs may. Using a VPN in China may be similar to making a copy of a book. It is not legal because the author’s copyright is infringed. But it is too universal and too minor to enforce the law.
Some may recommend people to not use VPN apps and instead lease a special line from China Unicom. However, leasing a special line is only open to organizations, not individuals. And when you apply for one, you have to clearly states your purpose. These special internet lines are usually only for business and cross-border trade and the like. Note the fee will be fairly expensive for individuals.
At present, the fee charged by the three major operators for accessing the external network is about ¥20,000 per year for 2mbps, about 50,000 per year for 10mbps bandwidth, and the cost of 500mbps is about 1.4 million per year — well beyond the means of the average internet user.
II. Selling VPNs
It is illegal to operate and sell VPNs and related software for profit without authorization. Sellers of VPNs in China have been reportedly punished – and much harsher than simple users of VPNs.
No. 1: Dai, Shanghai.
In October 2018, Shanghai Baoshan District People’s Court publicly opened a court to pronounce on the case that the defendant, surnamed Dai, was suspected of providing codes and tools for intrusion and illegal control of computer information system. He was sentenced to three years in prison for selling VPN, suspended for three years, and fined RMB 10,000.
No.2: Deng, Dongguan.
Deng set up a VPN software (called “Flying over SS” and “Shadow Cloud”) on his computer, enabling users to access websites such as Google that are not accessible to domestic IP addresses. A website was set up to provide and sell the software for others to use, and the illegal profit was RMB 13,957.57. Afterwards, the First People’s Court of Dongguan City of Guangdong Province sentenced Deng to nine months in prison and fined for violating the provisions of Article 285, paragraph 3 of the Criminal Law. Deng and his legal defense had no objection. No appeal has been filed and the judgment has entered into force.
There are some relevant regulations on the qualification of operating VPN business.
The VPN service belongs to a part of the telecommunication service. A telecommunication business needs the qualifications allowed by the state. These regulations are initially distributed in Article 2 of the Measures for the Administration of the International Network of Internet Access and Entrance Channels of Computer Information Network (out of effect) and the Article 6 of the Tentative Rules. At present, most of the regulations on telecommunication services have been integrated into the Telecommunication Regulations of the People’s Republic of China. Articles 7, 9, and 13 of the Telecommunication Regulations stipulate the licensing system, examination and approval system, and conditions to be met for the operation of telecommunication services.
According to the B13 clause of Chapter B of the Classification Catalogue of Telecommunication Services of MIIT, the domestic internet virtual private network service (IP-VPN) belongs to the value-added telecommunication service among the telecommunication services. In 2017, MIIT’s Notice further clarified that no entity or individual may operate the VPN business without permission, and the scope of use is limited to the internal use of the renter, and may not be privately connected to access the network data outside the domain.
In summary, in accordance with the relevant regulations, engaging in Internet value-added information services requires not only basic telecommunication business license but also value-added telecommunication business license, that is, providing VPN-type network proxy services, which actually need the administrative approval of the relevant departments. Without the qualification and the approval, no entity or individual is allowed to carry out this business at will.
China Post and Telecommunications General Administration was the original owner of the relevant business qualifications of “Telecom Business License”, “Value-added Telecom Business License” and “Cross-region Value-added Telecom Business License”. It was split into China Telecom, China Mobile, and China Unicom later. After implementing the “three networks in one”, all three companies can independently operate the telecommunication business, which meansthat currently, no other organizations or individuals have the qualification to operate related telecommunication services except the three major operators. This shows that the operation of telecommunication business is a national franchise, and the operation of VPN business is a national restricted business.
The author believes that although these two cases were closed with the charge of providing codes and tools for intrusion and illegal control of computer information system, some of the legal issues remain to be discussed.
The author believes that the unauthorized operation of VPN business should be characterized as the crime stipulated in Article 225 of the Criminal Law. Since the VPN-type service belongs to the value-added telecommunication service in the telecommunication service, the operation of the service should duly be subject to the relevant laws and regulations governing the telecommunication market. The operation of VPN business without authorization violates the relevant provisions of the Telecommunication Regulations. It is one of the types of privately setting up international telecommunication gateways. Therefore, the sale of VPN software for many times to make profit is a serious circumstance in the illegal operation of telecommunication business. Under current laws and regulations, this behavior is more suitable for illegal business operation than the crime identified in this case.
It is clear that the offering of an unlicensed VPN in China is illegal.
On July 29th, 2017, Apple, in an official statement, announced it was removing VPN apps from its App Store in China in accordance with the MIIT Notice on unauthorized networks:
Earlier this year China’s MIIT announced that all developers offering VPNs must obtain a license from the government. We have been required to remove some VPN apps in China that do not meet the new regulations. These apps remain available in all other markets where they do business.