These VPNs still work in China, Iran, and Russia. These ones got people arrested.
Short answer
A VPN that does not work in a restricted environment is a usability problem. A VPN that hands user data to the authorities of that environment is a safety problem. Consumer reviews rarely distinguish between the two. That distinction has real consequences.
How countries block VPN protocols
China, Iran, Russia, and a growing number of other states use deep packet inspection to identify and block VPN traffic at the infrastructure level. Standard protocols like OpenVPN and WireGuard have characteristic traffic patterns that DPI systems are trained to recognise. When those patterns appear, the connection is blocked.
The response from VPN providers has been obfuscation: making VPN traffic look like ordinary HTTPS, which cannot be blocked without blocking all secure web browsing. Proton’s Stealth protocol and Shadowsocks-based approaches are built for this. Their effectiveness is not static. The only reliable test is a real connection in the environment, not a review written elsewhere six months ago.
The VPNs that have maintained connections under active blocking
Proton VPN with Stealth protocol has been tested in corporate networks in the Gulf, hotel Wi-Fi in East Asia, and environments with active government-level blocking. Stealth has maintained connections in those conditions more consistently than standard protocols and more consistently than most competitors at this price point. It does not work everywhere, every time. The honest claim is that it performs better than the alternatives under the conditions where it has been tested. The full standalone review sits in our Proton VPN review for 2026.
Mullvad with DAITA and multi-hop routing provides different protections, primarily resistance to traffic analysis rather than protocol-level obfuscation. In environments where blocking is primarily by protocol identification, Mullvad’s architecture provides less obfuscation capability than Proton’s Stealth. In environments where traffic analysis is the main surveillance method, DAITA is a meaningful protection. The full standalone review sits in our Mullvad VPN review for 2026.
The VPNs that provided user data to authorities
IPVanish handed user data to US law enforcement in 2016, directly contradicting their no-logs policy as marketed at the time. The data led to a user’s arrest. The company has since changed ownership and updated logging policies. The documented case remains.
PureVPN provided user data to the FBI in 2017, including connection timestamps that placed a suspect at specific locations at specific times. PureVPN had marketed itself as a no-logs VPN. Their transparency report describing this as consistent with their privacy commitments was widely criticised.
The pattern in both cases: a no-logs marketing claim that turned out to be inaccurate under real legal pressure. The lesson is not that these specific providers are uniquely dishonest. It is that marketing claims about logging are not evidence of actual logging practices. The only meaningful evidence is what happens when a real request is received.
Why jurisdiction matters more than marketing
A US or UK-based VPN provider is subject to compelled disclosure laws that include non-disclosure orders. The provider receives a legal request and is prohibited from telling users. The provider complies. The user never knows.
Swiss jurisdiction requires a formal Swiss legal process before any disclosure to foreign authorities. Proton has published every government request it has received. Swedish jurisdiction is within the EU but has a strong track record, including the 2023 police visit to Mullvad’s servers that found no user data.
The threat-model split between the two providers, in detail, sits in Proton versus Mullvad in 2026. The choice is operational, not preference.
What to test before you depend on it
No review can guarantee performance in your specific destination at the time you arrive. Test the tool, with the specific protocol you intend to use, from a safe network before you travel. Connect from home. Verify the connection is working. Check your external IP through a service like ipleak.net. Do this three days before you leave, not on the flight.
And no VPN, however well-tested, fixes the failure modes documented in why a VPN will not save you once this has already happened. The audit covers the network. Everything else, including the device itself, is upstream of the tunnel.
Frequently asked questions
Which VPN works in China in 2026?
Proton VPN with Stealth protocol has maintained connections in environments with active VPN blocking more consistently than most consumer alternatives. Mullvad with multi-hop provides a different form of protection but less protocol-level obfuscation. Both should be tested before travel. The blocking landscape changes continuously.
Has any VPN been caught logging and handing over user data?
Yes. IPVanish in 2016. PureVPN in 2017. Both had marketed themselves as no-logs VPNs. The documented cases that stand in contrast, Proton and Mullvad, involve legal requests where no data was provided because no data existed.
Is using a VPN illegal in China, Iran, or Russia?
The status varies. China criminalises unauthorised VPNs but enforcement is selective and primarily targets distribution, not consumption. Iran and Russia have alternated between tolerating and prosecuting VPN use depending on political timing. The practical risk is rarely the VPN itself. It is what the VPN protects, in a context where the activity behind the tunnel is what authorities care about. Test the legal posture for your specific destination before you depend on a VPN there.
What should I do if my VPN gets blocked while travelling?
Switch protocols first. Stealth or Shadowsocks-based options often work where standard WireGuard does not. If all protocols are blocked, that is a signal the network is hostile, not just that the VPN is broken. Move off that network if you can. If you cannot, treat anything you do on it as visible to the network operator until proven otherwise.
Proton Unlimited is the tool we recommend for encrypted email, VPN and secure storage. It’s what we’d use ourselves.
There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.
