Using a VPN is not illegal in the UAE. No law bans the technology, and the telecom regulator has confirmed that companies, institutions, and banks may use it. Only one thing is criminal: using a VPN to commit a crime or to conceal one, which carries temporary imprisonment and a fine of AED 500,000 to AED 2,000,000 under Article 10 of Federal Decree-Law No. 34 of 2021.
That distinction is where the persistent misinformation sits. The UAE has some of the strictest cybercrime laws in the region, but the prohibition is narrower than the headlines suggest, and it turns entirely on intent rather than on the software.
Where the line falls: encrypting your traffic, reaching your employer’s network, and protecting a banking session on public Wi-Fi are all lawful. Using a VPN to open blocked content or to place WhatsApp and FaceTime calls breaches the telecom rules. Using one to commit or hide an offense is the criminal act under Article 10 of the cybercrime law.
This guide sets out the legal framework governing VPN use across the Emirates: the exact wording and penalty of Article 10 of Federal Decree-Law No. 34 of 2021, the TDRA regulatory position, which uses are permitted and which are not, the full penalty scale for related cybercrime offenses, and practical guidance for residents, businesses, and visitors.
Is a VPN Illegal in the UAE?
No. There is no UAE law that prohibits owning, installing, or using VPN software. The Telecommunications and Digital Government Regulatory Authority (TDRA) addressed this directly in an official statement issued on 31 July 2016, confirming that no regulations prevent companies, institutions, and banks from using VPN technology to reach their internal networks over the internet. The same statement made clear that users remain accountable if the technology is misused.
That position still holds. The law targets specific conduct carried out through a VPN, not the VPN itself. The distinction is intent. Encrypting your traffic on hotel Wi-Fi is lawful. Masking your IP address in order to commit an offense, or to stop an offense being traced, is a serious crime. A common example is gambling with an unlicensed operator, which remains an offense for the player wherever the site is hosted, and using a VPN to reach that site compounds rather than solves the problem.
Federal Decree-Law No. 34 of 2021: What Article 10 Actually Says
Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes replaced Federal Law No. 5 of 2012 and came into force on 2 January 2022. It governs digital conduct across all seven emirates. It does not mention VPNs by name. The provision that reaches VPN use is Article 10, which reads in the official English text:
“Whoever circumvents an IP Address through the use of an IP address of others or any other means with the intention of committing or to preventing detection of a crime shall be punished with temporary imprisonment and/or a fine of not less than (AED 500,000) five hundred thousand dirhams or more than (AED 2,000,000) two million dirhams.”
Article 10, Federal Decree-Law No. 34 of 2021, headed “Circumventing the Information Network with the Intention of Committing a Crime”
Two elements of that wording matter more than the fine. First, the offense requires intention: the circumvention must be carried out with the purpose of committing a crime or preventing its detection. Ordinary privacy or security use does not meet that test. Second, the penalty is temporary imprisonment and/or a fine, meaning a court may impose either or both. The concealment is punished in its own right, separately from whatever underlying offense it was meant to hide.
TDRA Rules on Blocked Content and VoIP
Alongside the cybercrime law, the TDRA’s Regulatory Policy on Internet Access Management defines the categories of content that UAE internet service providers must block. Its annex covers material that helps users reach prohibited content, and it names proxy servers and VPN services whose main purpose is reaching blocked material. Etisalat and du implement that blocking at network level.
The practical line is therefore: a VPN used for security, privacy, or business connectivity is permitted, while a VPN used mainly to defeat content blocks falls on the wrong side of the policy.
Voice and Video Calling
The most common question concerns calling apps. Consumer Voice over Internet Protocol calling through WhatsApp, FaceTime, Skype, and Viber remains restricted on UAE networks as of 2026, and there has been no official announcement reversing it. Messaging, photo sharing, voice notes, and file transfer all work normally. Only the voice and video calling features are affected. We cover this in depth in our guide to whether WhatsApp is banned in Dubai.
Using a VPN to defeat those restrictions is a violation of the telecommunications framework. Licensing sits under Federal Law by Decree No. 3 of 2003 on the Organization of the Telecommunications Sector, as amended, which remains in force and is the instrument establishing the TDRA. The licensed route is to use an approved application instead.
| Service | Calling status in the UAE | Notes |
|---|---|---|
| Blocked | Messaging, media, and voice notes work; voice and video calls do not | |
| FaceTime | Blocked or inconsistent | Availability has varied by device and network; not dependable |
| Skype (personal) | Blocked | Consumer calling blocked on local networks |
| BOTIM | Permitted | TDRA licensed; calling features generally need an operator plan |
| C’Me, HiU Messenger, Voico, GoChat | Permitted | TDRA licensed consumer calling apps offered through e& and du |
| Microsoft Teams, Zoom, Cisco Webex | Permitted | Business conferencing; meetings and calls work without a VPN |
The licensed app list changes. Check current TDRA guidance or your operator before relying on any single service. If your priority is a local number and data rather than calling, our UAE eSIM guide and mobile plan comparison cover the licensed options.
What You Can Legally Do With a VPN
Business and Corporate Use
Connecting remote staff to a corporate network, securing traffic between international offices, protecting commercial data in transit, and reaching internal systems are all permitted. The TDRA’s 2016 statement addressed this category directly. Banks, insurers, investment firms, and professional services companies run VPN infrastructure as standard practice, and multinationals link their UAE offices to global networks the same way.
Organizations handling personal data should read this alongside the UAE Personal Data Protection Law, which sets separate obligations around securing personal information.
Personal Privacy and Security
Individuals may lawfully use a VPN to encrypt traffic on public Wi-Fi, protect personal information from interception, secure online banking sessions, and connect to an employer’s systems while traveling. None of this engages Article 10, because none of it involves the intention to commit or conceal an offense.
What Crosses the Line
Three categories of conduct create real exposure.
Reaching blocked content. Using a VPN to open sites in a prohibited category, including gambling platforms, pornography, and material blocked on national security or public morality grounds, breaches the Internet Access Management policy.
Defeating calling restrictions. Using a VPN to place WhatsApp, FaceTime, or Skype calls breaches the telecommunications framework. Enforcement against individual users has not been a visible priority, but the prohibition exists and the risk is real.
Committing or hiding a crime. This is the Article 10 offense and the one that carries the AED 500,000 to AED 2,000,000 penalty. It covers hacking, fraud, identity theft, distributing illegal material, financial crime, and online speech offenses where the VPN is used to obscure the source.
Penalties Under the Cybercrime Law
The figures below are taken from the official English text of Federal Decree-Law No. 34 of 2021. Several widely circulated summaries understate the maximums, because the higher-tier offenses in Articles 4, 5, 7, and 8 reach AED 3,000,000 rather than the AED 500,000 often quoted.
| Offense | Fine | Imprisonment | Provision |
|---|---|---|---|
| Circumventing an IP address to commit or conceal a crime | AED 500,000 to 2,000,000 | Temporary imprisonment, and/or the fine | Article 10 |
| Hacking a website, system, network, or device | AED 100,000 to 300,000 | Imprisonment, and/or the fine | Article 2(1) |
| Hacking that causes damage or data loss | AED 150,000 to 500,000 | At least 6 months | Article 2(2) |
| Hacking a government entity’s systems | AED 200,000 to 500,000 | Temporary imprisonment, and the fine | Article 3(1) |
| Government hacking causing damage, or via cyberattack | AED 250,000 to 1,500,000 | At least 5 years | Article 3(2) |
| Willfully harming or disrupting an information system | AED 500,000 to 3,000,000 | At least 1 year | Article 4(1) |
| Harm to a banking, media, health, or scientific entity | AED 500,000 to 3,000,000 | Temporary imprisonment, and the fine | Article 4(2) |
| Infringement of personal electronic data | AED 20,000 to 100,000 | At least 6 months | Article 6(1) |
Foreign nationals convicted of cybercrime offenses frequently face deportation on top of the sentence. Equipment used in an offense may be seized. Civil liability to anyone harmed runs separately from the criminal penalty.
Practical Guidance
For Businesses
Document why your organization uses a VPN and keep a written security policy. That documentation establishes legitimate purpose if the question ever arises. Choose enterprise-grade software with centralized management and access controls, restrict VPN access to authorized staff, retain usage logs for audit, and make clear in writing that the corporate VPN is for authorized business activity only.
For Individuals
Use a reputable paid provider rather than a free service. Free VPNs frequently log and resell activity, carry security weaknesses, and in some documented cases have shipped malware. If you are choosing one, our comparison of VPNs that work in Dubai covers what to look for. Keep your use to security and privacy, and do not treat a VPN as a circumvention tool.
For Tourists and Short-Term Visitors
The same law applies to visitors as to residents. Tourist status is not a defense. Encrypting your connection on hotel Wi-Fi is lawful; using that same connection to place WhatsApp calls is not. Hotel networks generally apply the same restrictions as any other local network. Some visitors use travel eSIMs that route traffic outside the UAE, which works technically but sits in an unsettled area with respect to the telecommunications rules. Our overview of safety and legal basics for visitors covers the wider picture.
Common Misconceptions
“All VPN use is illegal here.” False. The regulator has confirmed the opposite, and no provision bans the technology.
“VPN use cannot be detected.” False. Operators and authorities can identify VPN traffic patterns even without seeing the contents, and network-level analysis is routine.
“A VPN makes activity untraceable, so it is effectively safe.” False and dangerous. Providers may retain logs, and a VPN offers no legal immunity. Article 10 exists precisely to punish the attempt at concealment.
Frequently Asked Questions
Is it illegal to use a VPN in the UAE?
No. Using a VPN is legal in the UAE for legitimate purposes such as corporate network access, remote work, and personal privacy. It becomes a criminal offense only when the VPN is used with the intention of committing a crime or preventing its detection, which is punishable under Article 10 of Federal Decree-Law No. 34 of 2021 by temporary imprisonment and a fine of AED 500,000 to AED 2,000,000.
Can I use a VPN for remote work in Dubai?
Yes. Accessing your employer’s corporate network or secure business systems through a VPN is permitted. The TDRA confirmed in 2016 that companies, institutions, and banks may use VPN technology for internal network access. Keep your use limited to authorized business purposes, and ask your employer to document the arrangement where possible.
What happens if I use a VPN to make WhatsApp calls?
It breaches the telecommunications framework, which restricts consumer VoIP calling to licensed providers. Enforcement against individual users has not been visibly prioritized, but the prohibition is real and the safer route is a licensed app such as BOTIM, C’Me, HiU Messenger, or Voico, or a business platform such as Microsoft Teams or Zoom.
Are free VPNs legal in the UAE?
Free VPNs are not separately prohibited, and using one for a legitimate purpose is lawful. They are still a poor choice: many log and monetize user activity, connection quality is unreliable, and some have been linked to malware. A paid service from an established provider is the better option on both security and privacy grounds.
Can UAE authorities detect VPN use?
Yes. Internet service providers and authorities can identify VPN traffic patterns at network level even where the contents are encrypted, and law enforcement can pursue logs from providers during an investigation. Assuming that VPN use is invisible, and therefore safe, is incorrect.
Is using a VPN to watch another country’s Netflix library illegal?
This sits in an unsettled area. The Internet Access Management policy targets circumvention of blocked content, and a geo-restricted streaming library is restricted for licensing reasons rather than blocked by the regulator. Enforcement against a viewer watching entertainment is not a realistic prospect, but the practice does breach the streaming service’s own terms.
Do the same VPN rules apply in every emirate?
Yes. Federal Decree-Law No. 34 of 2021 applies throughout the UAE and TDRA regulation covers telecommunications in all seven emirates. There is no emirate-level variation in VPN legality, so the position is identical in Dubai, Abu Dhabi, Sharjah, and elsewhere.
What is the fine for VPN misuse in the UAE?
Where a VPN is used to commit or conceal a crime, Article 10 sets a fine of not less than AED 500,000 and not more than AED 2,000,000, together with or in place of temporary imprisonment. Related cybercrime offenses carry their own penalties, reaching AED 3,000,000 for willfully harming an information system under Article 4.
Official Sources
- Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, UAE Legislation portal. Article 10 is the provision governing IP circumvention; Articles 2 to 8 carry the related offenses cited above.
- Telecommunications and Digital Government Regulatory Authority (TDRA), the regulator responsible for the Internet Access Management policy and for licensing VoIP services.
- Federal Law by Decree No. 3 of 2003 on the Organization of the Telecommunications Sector, as amended, the instrument establishing the TDRA and the telecommunications licensing regime.
- Cyber safety and digital security, the UAE Government official portal.
This guide explains the law as published at the time of writing in August 2026. Penalties, licensed application lists, and enforcement practice can change. Nothing here is legal advice. For a specific situation, particularly one involving a business deployment or an active investigation, consult a UAE-qualified lawyer or contact the TDRA directly.
