554,507 domains, 5.8% of the 9.2 million OONI checked, sat on one of 7,441 IP addresses blocked in Spain for football between January 1 and June 1, 2026. Many of those addresses are shared by thousands of unrelated websites. No Spanish statute even mentions VPNs.

VPNs are legal in South Korea, no law bans or restricts them. Yet the KCSC, an administrative body, ordered 220,403 websites or pages blocked in 2023 alone, without a court order. Since February 2019, ISPs enforce the blocks by filtering the SNI field of encrypted connections.

F1 TV Pro checks your IP against its list of licensed countries, so it can refuse you abroad even though you have paid. Watching Austin from a hotel this Sunday? A VPN server in your home country restores your usual location. A subscription is required either way.

Using a VPN is legal in 5 of the 6 Gulf states: Kuwait, Saudi Arabia, the UAE, Qatar and Bahrain. The UAE's 500,000 to 2 million dirham fine is for using a false IP address to commit a crime, not for VPN use. The exception: Oman, where unauthorized VPN use is prohibited.

One detail the headlines skip: Florida's HB3 applies to account holders a platform "knows or has reason to believe" are located in Florida. Location is an input to the age check. The duties and the fines, up to $50,000 per violation, fall on platforms, not users.

Is Switzerland a privacy haven? Half true. Telecom operators must keep communications metadata for six months. But Swiss courts ruled in 2021 that Threema and Proton Mail are not telecom operators, and no ruling has placed VPN providers in that category.

VPN use is legal in Singapore. No statute mentions it, no licence is required, and we found no case of anyone prosecuted for using one. Singapore's own tech agency GovTech publishes a plain-language explainer on when to use a VPN.

Tanzania is the only African country where you must declare your VPN to the regulator. On 13 October 2023 the TCRA ordered all VPN users to declare their usage, IP addresses included, by 30 October 2023. Not a ban, but an undeclared VPN risks regulatory action.

Who actually makes VPN providers block sites? Three countries: France by court order, Spain by precautionary court measure, Italy by regulator rules. Everywhere else, orders stop at ISPs, DNS resolvers or search engines. Every obligation lands on a company, none on the user.

The PHP patch is out, but the hard part lands on tired people: 48% of security professionals feel exhausted trying to stay current on threats (ISC2), and about a third of PHP sites run version 7 or 5, end-of-life branches. PHP 7.3 and older get no fix from the PHP project.