Meet Mark at a coffee table in Shanghai
Mark moved to Shanghai from Lyon in 2024 to lead a design office. On his first morning, he opened his laptop and tried to load a cloud-storage app that his clients rely on. It would not load. Minutes later, his Chinese colleague warned: if Mark tries to use an unapproved VPN, he may break the law. Mark’s IT manager in Paris had already told him to install one before the trip. The result is confusion.
This article explains China’s rules on VPNs for foreigners, the written penalties for using unapproved connections, and the options that businesses and individuals actually have. It is general information, not legal advice.
China’s national internet border: what you are plugging into
China never adopted a single Great Firewall law. The core legal framework is a set of rules led by the Interim Provisions on International Networking of Computer Information Networks (1996) and its implementation measures. The key principle: all cross-border online connections must go through international gateway channels approved by the state.
That means if you are a foreigner in Beijing or Chengdu, your device’s overseas packets are supposed to travel through the licensed networks of China’s three big telecom operators. If you are using a commercial VPN service to bypass that route, you are using an other channel, which is formally contrary to the rules.
VPN software is not illegal by itself. Chinese companies, banks, universities and foreign-funded firms use VPN protocols within approved networks all the time. The legal issue starts when the connection route is not approved.
What happens if you use an unapproved VPN? Penalties in black and white
Under the interim provisions, public security authorities can issue a warning, order the removal of the illegal connection and impose a fine of up to RMB 15,000. If you received income through the violation, that income can be confiscated. Local enforcement may also seize the relevant equipment. In most cases, this is administrative law; it doesn’t trigger China’s criminal code.
But criminal status matters if you are on the supply side. Selling, reselling or providing unauthorised VPN services can be prosecuted under the offer of tools for illegally accessing or controlling computer systems clause, carrying prison time. That clause targets providers and operators, not a foreign architect who simply installs an app.
Foreigners are not exempt from these administrative rules. A public security record created by a VPN-related fine can even complicate visa renewal or permanent residence applications.
Do random foreigners get targeted? Where scrutiny really happens
The short answer: very few expats get randomly checked for a VPN app in regular life. Enforcement is mostly aimed at commercial VPN operators, resellers and those who build large tunnels. Still, you are more exposed in specific situations.
- Border and airport checks. Customs and border officers may inspect phones or laptops when suspicion exists. A clearly visible VPN app can create an awkward administrative issue.
- Company network audits. Chinese authorities periodically audit corporate networks. If you are the person who installed a personal VPN on the office router, the company may be implicated and receive a disciplinary finding.
- Incidental investigation. If you are involved in any legal case, e.g. a data incident or commercial dispute, forensic tools may reveal VPN activity, and the finding can add a fine to other problems.
You can be unlucky in a random, rare check; but most violations are discovered through other events.
Legal route for companies: IPLC and licensed international access
If your real motivation is work-related access to global platforms, there is a lawful infrastructure solution.
Companies in China can apply for an International Private Leased Circuit (IPLC) from China Telecom, China Unicom, China Mobile or a licensed provider. An IPLC is a dedicated, physical line that connects your Chinese office directly to international networks or to your company’s overseas headquarters. It is approved by the Chinese government, so staff can use corporate email, public clouds, R&D tools and video calls with no firewall restrictions.
Set-up involves corporate registration documents, a service agreement and usually a fee of thousands of RMB per month, depending on bandwidth. For a representative office, architecture studio or technology centre, an IPLC is the most straightforward, fully legal way to stay globally connected.
Alternatively, companies may use a licensed local ICT service provider that offers a dedicated internet access or SD-WAN product under an official value-added telecom licence. The provider handles all compliance with the state.
Employees should ask their IT department about these corporate channels before they think about private apps.
If you are an individual without a corporate network
Not everyone has an employer to lean on. Students, freelancers and short-term visitors face a more limited set of choices.
- Use China-friendly services where possible. Many international products have licensed local versions or China collaborations. For example, LinkedIn and Amazon Web Services have Chinese variants; Microsoft and Apple offer services through China-based data centres.
- Ask your university or research institute about a dedicated academic connection. Some institutions maintain lawful international access lines for faculty and scholars. Use that instead of personal VPN.
- Treat free VPN apps like security liabilities. Unknown apps regularly carry malware or collect personal data. Adding legal risk on top of cyber risk is not a good trade.
- If you still decide to use a tool, be aware of the risk but that’s not formal advice.
What about short-term trips or business travel?
Short-term visitors often rely on hotel Wi-Fi, mobile roaming or a company-issued laptop. These are not always approved. For a five-day trade fair, many international visitors simply accept that some services will not work. Better planning includes downloading documents before arrival, using corporate mail accounts that are hosted in China, or asking your local partner to share files through WeChat or Aliyun CDN.
The bottom line
China’s rules are not designed to catch every tourist who glances at Instagram. But for foreigners working or living in China, a warning or small fine can complicate visa and residence applications. The rational route is to secure legal access through an employer or an institutional network, and to think of compliance not just as avoiding prosecution but as keeping your record clean.
If you need more certainty, talk to a Chinese lawyer who specialises in cybersecurity or telecommunications law, rather than a message board thread.
This article is general information and not legal advice. Laws and enforcement practices change.
Start the discussion at forum.chinacomes.com