- The house of cards for VPN providers is crumbling.
The Indian government just announced a new policy
that requires VPN companies to keep very detailed logs
of user data and store it for a minimum of five years.
Its standard practice in the VPN industry
that companies do not keep logs
in order to protect customers' traffic.
With such a big step from a powerful government,
is VPN privacy coming to an end?
No, I don't think so, and here's why.
This new restriction applies
to VPN servers that are geographically located
in the country of India.
It requires these servers to log user data
and keep it for a minimum of five years.
The whole purpose of a VPN is to stay anonymous online.
This is accomplished through masking your IP address
and not keeping any logs or records of your browsing data.
So if a website doesn't know your true IP address
when you visit it and when there's no record
of what websites you visited
and what you did when you were online,
your browsing is effectively anonymous.
With this new law in India,
VPN servers inside the country have to log things
like your name, your IP address,
and what websites you're visiting,
making the point of using a VPN effectively useless.
This new requirement came
from the computer emergency response team
known as CERT-In.
The directive outlines that VPN providers,
data centers, and VPS providers,
so really any server that's located in India
is required to track things such as customer name,
IP address, physical address, and phone number.
All this data has to be validated as well
and proven to be accurate,
and they have to track things like browsing history on VPNs
and any patterns that could lead
to malicious or illegal activity.
And if you think VPN providers
are just gonna kick back and say,
"Ah, we don't keep any logs.
We have nothing to report to the Indian government."
I'd think again.
I bet you they're actually gonna be concerned about this
and need to comply or pull their servers out of India.
And that's because the penalty for non-compliance
can be up to 100,000 rupees or about $1,300 US,
or up to a year of imprisonment,
or possibly a combination of both.
So what does this mean in practicality?
Well, if you're using a VPN with servers in many countries,
simply don't connect to a VPN server in India.
And if you think this is a non-issue,
if you live outside of India, you're largely correct.
Simply avoiding servers based in India
is all you need to do.
But I think the bigger concern here is the fact
that a powerful world government
is imposing this type of regulation,
which we've never seen before, on VPNs.
If India is willing to do it,
who else might be willing to do it,
and what's gonna happen to the VPN industry at large?
And if you are living in India,
well, don't connect to a VPN server in India.
This is gonna bring some inconveniences.
The ping is gonna be worse.
You're probably gonna have a slower loading experience
on VPNs based outside of your country,
and you're gonna be browsing non-localized websites,
but it's the price you have to pay to get privacy
through a VPN with the new regulations.
VPN companies are going to have to make a choice
and they're gonna have to make it fast.
Do they cave and put the infrastructure
in place to start keeping logs on servers in India
or do they pull their infrastructure out of India entirely?
They might be tempted to stick around
because of India's market size and revenue opportunity.
According to the government,
VPN companies have two months to start complying
with the new law in collecting user data.
NordVPN has already made a statement
that they may remove their servers from India
if no other options are left.
Other major VPN providers like ExpressVPN,
ProtonVPN, and Surfshark have all made statements
saying they're committed to their no logs policy
and they'll make any infrastructure adjustments necessary
to make sure they're not keeping logs of any user data.
With that being said,
a lot of these statements were vague and hardly reassuring.
Only time will tell if companies will cave
and put infrastructure in place to start logging user data
or pull their servers out of India altogether.
If you're tired of the constant drama with VPN companies,
one solution is to make your own VPN.
Just make sure you pick a server
that's not located in India.
You can even get your own VPS to host OpenVPN
starting at around $5 a month from various providers
like DigitalOcean, Vultr, and Linode.
You can pick from a lot of different locations
and countries, and get your VPN geographically located
exactly where you want it.
These providers offer One Click Installers
and documentation to easily get your DIY VPN set up.
Once it is ready to go, you can easily connect it
to Mac, Windows, iOS, and Android manually
and the network configuration settings
of your operating system.
Or if you do want a solution that's a bit more
like a commercial VPN where you open a program
and click a button to connect,
you can use the OpenVPN client,
it's free and it's available on Mac, Windows
iOS, and Android.
Running your own VPN obviously takes a lot more time
and knowledge than just subscribing to a VPN provider.
You have to ask the question of
if running your own VPN is worth it for you,
and there are a lot of upsides.
For one, you can get started
for around $5 a month billed monthly
in a world where VPN providers want you
to put down a big chunk of change
for a one to three-year account up front.
Being able to pay $5 a month,
month to month is very attractive.
You also remain in control of the server
your browsing data runs through.
You can choose exactly which VPS provider you're gonna use,
where the server's gonna be geographically located,
and you can be the one to make sure
that server is not keeping any logs of your browsing data.
However, there are also some downsides to running a DIY VPN.
First, you're responsible for all the maintenance
and uptime associated with your VPN.
Yes, picking a good cloud provider will ensure
that your server has reliable uptime,
but uptime isn't everything.
Just because your server's up
doesn't mean it's performing properly
and you're bound to run into issues
and hiccups with OpenVPN
that have to be worked out
and you are the support person.
There is no live chat you can go to and just say,
"My VPN's not working.
Please make it work."
Second, you're gonna be stuck with the static IP address.
This could be a pro or a con, depending on your needs.
The upside would be
that the static IP address is never changing.
So you can whitelist it on server firewalls
and you can make sure you're not constantly
getting bombarded from prompts
when you log into your bank or email address,
asking you to verify that you are really you.
But the flip side of this is that all the traffic
coming from that one IP address is you.
Typically, with a commercial VPN provider,
there might be hundreds of people
browsing under the same IP address.
So it just masks who is doing what.
There's all this data from a single IP address,
and you don't know if it was Johnny, or Sally, or Jim
who was doing the browsing to a particular website.
Everything is obfuscated.
And also, if you get one IP address banned
on a big commercial provider, no problem.
Just disconnect, connect to a different server.
Boom, your IP address is changed.
With this setup, assuming you only had one VPS,
you have one static IP address
and that IP address never changes.
And finally, you aren't able to quickly switch
between multiple server locations.
Unless you run multiple DIY VPNs,
you're stuck to the one geographic location
where your single VPN server is hosted.
You can cluster multiple VPS servers together
within OpenVPN to create your own VPN network,
but this is gonna drive cost up significantly.
So as you can see, there are a lot of drawbacks
to running your own VPN,
but there's also a lot of drawbacks
to using a commercial VPN.
With all of this in mind,
I have to ask the question,
is using a VPN even worth it?
The landscape of VPN services seems to be rapidly changing.
Is it time to stop using VPNs altogether?
That's the question I'm answering in this video.
(upbeat music)