Is a VPN legal in Saudi Arabia? What the law punishes, and what it does not
Heard that using a VPN in Saudi Arabia can land you in prison or cost you half a million riyals? We read the law itself to see what it actually punishes, and where the experts still disagree.
On this page
Saudi Arabia's Anti-Cyber Crime Law does not mention VPNs, and no article punishes running one. It punishes specific acts. The closest to this question is "unlawful access to a website" in Article 3, punishable by up to one year in prison and/or a fine of up to SAR 500,000. So the practical question is not "may I use a VPN?" but "what am I using it for?".
What the Anti-Cyber Crime Law says
Royal Decree No. M/17 of 26 March 2007 (8 Rabi' I 1428H), still in force. Neither "VPN" nor "bypassing blocks" appears in it. The articles closest to the question, with each one's maximum penalty:
Intercepting data sent over the network without legal grounds. Unlawful access to threaten or blackmail a person. "Unlawful access to a website", or access to change its design, destroy or alter it, or take over its address. Defamation through technology.
Producing, preparing, sending or storing over the network material that violates public order, religious values, public morals or privacy. Amended in 1436H to allow a summary of the judgment to be published at the convicted person's expense.
If the crime is committed by an organised gang, by abusing a public position, by luring minors, or with previous convictions for similar crimes.
For attempting any of these crimes, even if it is not completed.
Where the "VPN fine" story came from
In December 2023, posts about a penalty for VPN users in Saudi Arabia spread on X. On 4 December, Al Arabiya and Sabq published clarifications from experts:
Said that Saudi law contains "so far" no text criminalising VPN apps, that Article 3 targets unlawful access to systems for spying, eavesdropping or sabotage, that legal texts are not stretched by analogy, and that a trustworthy VPN protects a device and is not unlawful access. (Sabq) (Al Arabiya)
Told Al Arabiya that unlawful access through these apps is a cybercrime under the same article, and that the penalty grows with the harm, for instance where national security is involved. (Al Arabiya)
Experts in both reports warned that some VPN apps themselves damage their users' data privacy.
When is using a VPN fine, and when is it an offence?
- Protecting your connection on public Wi-Fi in cafés, airports and hotels.
- Connecting to your company's network from home or while travelling.
- Keeping your activity private from the local network you use.
- Unlawful access to a website or system, or intercepting data on the network (Article 3).
- Threats, blackmail or defamation through technology (Article 3).
- Producing, sending or storing content that violates public order, religious values or public morals (Article 6).
The app your whole connection passes through knows a lot about you, and some free VPN apps earn money from user data or ads. Choose one with an independently audited no-logs policy: owners and auditors are in who owns which VPN and our reviews.
Sources
Official text published by the Bureau of Experts at the Council of Ministers, original Arabic and official translation: WIPO Lex
This page is general information drawn from the law text and official pages, not legal advice. Rules change, so check the official text or ask a licensed lawyer about your own case. Last checked: 2 November 2026.
VPNs and Saudi law: frequently asked questions
Short answers to what readers ask most. Question not here? Write to us.
No Saudi law bans VPNs by name. The Anti-Cyber Crime Law punishes specific acts, such as unlawful access to a website, whether or not a VPN is involved. Using a VPN to protect your privacy or reach your company's network is not one of them.
No. Nothing in the Anti-Cyber Crime Law forbids installing or running a VPN. What can be punished is what you do with it.
Running a VPN carries no penalty in itself. If it is used for an act in Article 3, such as unlawful access to a website, the penalty is up to one year in prison and/or a fine of up to SAR 500,000. Content that violates public order or religious values (Article 6) carries up to five years and SAR 3 million.
The law does not say so explicitly, and Saudi experts disagree on whether it counts as "unlawful access". Sites are usually blocked because of their content, so the safest course is to avoid them. For your own case, ask a licensed lawyer.
Yes. Connecting to your company's network from home or while travelling is a legitimate use that the law's penalties do not describe.
The best VPNs this month
Our full ranking with scores and prices, kept up to date.
See the full ranking