Is a VPN legal in Saudi Arabia? Having or using a VPN in Saudi Arabia is not a crime in itself, and companies use them every day. But since December 2022, Article 24 of the Telecommunications and Information Technology Act prohibits bypassing the Kingdom’s internet filter by any means, with administrative fines of up to SAR 25 million. And if a VPN is used to commit an offence, the Anti-Cyber Crime Law punishes that offence. The “SR 1 million VPN fine” you may have seen on social media is not in any Saudi law.
This guide is based on the official texts of both laws on the Bureau of Experts portal, checked on 10 October 2026. It explains what is allowed, what is prohibited and what the penalties really are. It is legal information, not legal advice, and we do not recommend using any tool to reach blocked content.
VPN in Saudi Arabia: The Short Answer
| Question | Answer |
|---|---|
| Is a VPN app banned? | No law bans VPN apps by name |
| Can I use a company VPN for work? | Yes, it is normal business practice |
| Can I use a VPN to open blocked websites or blocked calling features? | No. Bypassing the internet filter is prohibited (Telecom Act, Art. 24) |
| Penalty for bypassing the filter | Administrative fine up to SAR 25 million, set by a CST committee in proportion to the violation |
| Penalty if the VPN is used for a cybercrime | The Anti-Cyber Crime Law penalty for that crime (table below) |
| Is there a SR 1 million VPN fine? | No. It is a social-media myth from December 2023 |
Follow Saudi Life Guide for Iqama, visa and job updates
New rules, fees and news as soon as we publish them. Join 95,500+ followers on Facebook.
What the Telecommunications and IT Act Says About Bypassing the Filter
The Telecommunications and Information Technology Act (Royal Decree M/106, issued 1 June 2022, in force from December 2022) gives the Communications, Space and Technology Commission (CST) the power to filter internet content with the competent authorities. Article 24(2) then says:
“It is prohibited to bypass or swindle internet filtering or to provide the means to do so. In addition, the Commission shall set the regulating controls and requirements.”
(Arabic: يحظر تجاوز ترشيح الإنترنت أو تسهيل التحايل عليه أو توفير الوسائل المساعدة على ذلك)
- Penalty (Articles 26 and 27): one or more of a fine of up to SAR 25 million, suspension of the service, and other measures, in proportion to the size, nature, effect and repetition of the violation.
- Who decides: a CST violations committee, with an appeal to the Administrative Court within 30 days (Article 28).
- Individuals: the wording covers any person. In practice, CST’s published enforcement has targeted operators and businesses; we found no published case of an individual being fined for using a VPN. That does not make bypassing the filter allowed.
What the Anti-Cyber Crime Law Says
The Anti-Cyber Crime Law (Royal Decree M/17, 2007) does not mention VPNs, proxies or blocked websites. It punishes the act, whatever tool is used. These are the maximum penalties (prison and/or fine):
| Article | Offence (summary) | Maximum prison | Maximum fine |
|---|---|---|---|
| 3 | Intercepting data; unauthorized access to threaten or blackmail; unauthorized access to or defacing a website; camera-phone privacy invasion; defamation | 1 year | SAR 500,000 |
| 4 | Fraud using a false identity; illegal access to bank or credit data | 3 years | SAR 2,000,000 |
| 5 | Unauthorized access to delete, leak or alter data; disrupting networks or services | 4 years | SAR 3,000,000 |
| 6 | Content against public order, religious values, public morals or privacy; pornography, gambling, human or drug trafficking sites | 5 years | SAR 3,000,000 |
| 7 | Terrorist sites; access to data threatening state security or the national economy | 10 years | SAR 5,000,000 |
- Aggravation (Article 8): at least half the maximum for organised gangs, public officials, crimes involving minors or repeat offenders.
- Helping or attempting (Articles 9 and 10): inciting or assisting can carry the full penalty; an attempt up to half.
- Confiscation (Article 13): devices and software used can be confiscated.
Some lawyers argue that visiting a blocked site falls under Article 3(3) (“unauthorized access to a web site”); cybercrime experts say that clause is about hacking. No published court ruling settles the point, which is why the clearer rule for VPN users is the Telecom Act’s ban on bypassing the filter.
The “SR 1 Million VPN Fine”: Where It Came From
In December 2023 a post on X by a news-aggregator account (not the Ajel newspaper) claimed that using a VPN in Saudi Arabia is punished with a SR 1 million fine and a year in prison. The post cited no law, and neither law has a SR 1 million maximum. Cybercrime expert Dr Huzam Al-Subaie told Al Arabiya at the time that no text in the law criminalises using VPN programs. The figure keeps circulating in WhatsApp groups and on some expat websites, but it has no legal basis.
Legitimate VPN Uses in Saudi Arabia
- Company remote access: connecting to your employer’s systems, email and internal tools through the company VPN. Organisations in the government and critical sectors must follow the National Cybersecurity Authority’s controls for secure remote access.
- Security on public Wi-Fi: protecting your connection in cafés, hotels and airports, as long as you are not using it to reach blocked content.
- Banking and personal data: keeping logins private on shared networks.
Avoid free or unknown “unblocker” apps. As early as 2017 the regulator warned that such apps can expose your personal data. Use only reputable software, and for work data only the tools your employer provides.
Calls and Apps: What Works Officially
- Since September 2017 the regulator has allowed calls on apps that meet regulatory requirements, naming FaceTime, Skype, Snapchat, Line, Telegram and Tango.
- WhatsApp voice and video calls were officially suspended in 2019. Many users report they have worked since February 2025, but no official announcement has been made either way.
- Microsoft Teams and Zoom calls work in practice for business and study. CST does not publish an official list of blocked apps.
Using a VPN to unlock a blocked calling feature is still bypassing the filter, so stick to services that work normally on Saudi networks.
Internet Freedom and Filtering in Saudi Arabia
Freedom House’s Freedom on the Net 2025 report scores Saudi Arabia 25 out of 100 (“Not Free”), the same as in 2024. It notes that the websites of Tor and major VPN providers are blocked, while many users still use VPNs. Prosecutions reported in recent years have concerned online content, not the use of a VPN as such.
Practical Guidance for Expats
- Use a VPN only for legitimate purposes: work access and security on public networks.
- Do not use any tool to reach blocked websites, blocked calling features or prohibited content.
- If you think a site is blocked by mistake, request a review through CST’s website filtering service instead of bypassing it.
- Report online fraud, blackmail or harassment through the Kollona Amn app, and fraud SMS to CST on 330330.
- Remember that content offences are judged on the content: what you post, send or store matters more than the app you use.
Problems come from what people post and share, not from a work VPN on a laptop. For more on staying on the right side of local rules, see our guides to Saudi traffic rules and the upgraded Kollona Amn app.
Frequently Asked Questions
Is using a VPN illegal in Saudi Arabia?
No Saudi law bans VPN apps by name, and companies use VPNs every day. What the law prohibits is using any tool, including a VPN, to bypass the internet filter (Article 24 of the Telecommunications and Information Technology Act 2022) or to commit an offence under the Anti-Cyber Crime Law.
What is the penalty for using a VPN in Saudi Arabia?
Bypassing the internet filter is an administrative violation under the Telecommunications and IT Act, with fines up to SAR 25 million set in proportion to the violation by a CST committee. If a VPN is used to commit a cybercrime, the Anti-Cyber Crime Law penalty for that crime applies, for example up to 1 year and SAR 500,000 under Article 3, or up to 5 years and SAR 3 million for prohibited content under Article 6.
Is there a SR 1 million fine for using a VPN in Saudi Arabia?
No law sets a SR 1 million fine for VPN use. The figure comes from a viral post on X in December 2023 by a news-aggregator account that cited no law, and cybercrime experts rebutted it at the time.
Can I use a VPN for work in Saudi Arabia?
Yes. Company VPNs for remote access to work systems are normal business practice. Follow your employer’s IT and data policy, and do not use a work VPN to reach blocked content, which is still bypassing the filter.
Are WhatsApp calls allowed in Saudi Arabia?
Calls on apps that meet regulatory requirements, such as FaceTime and Skype, have been allowed since 2017. WhatsApp calls were officially suspended in 2019; many users report they have worked since February 2025, but there has been no official announcement.
How do I ask for a website to be unblocked in Saudi Arabia?
The Communications, Space and Technology Commission (CST) runs a website filtering service where individuals can request that a site be blocked or unblocked. Use the official request instead of a bypass tool.