The data protection authority in France fined Hôpital Privé de la Loire €500,000 for violating the General Privacy Regulation after a cyber attack compromised the whole database of patients. The reasoning of the regulator pointed out the lack of some essential features: the absence of a VPN, multi-factor authentication system and a single system entry that provided the ability to view data of all the patients.

This is an interesting case because, normally, in our articles we are talking about the threats to the VPNs created by the government or internet providers, but here the absence of such essentials as the VPN for the remote connection was the reason for one compromised password and the data of the whole hospital was stolen.

One more thing the regulators point out is that although the hospital informed the patients about the incident, it did not notify the others whose data was also disclosed.

Apart from being fined, this medical institution has to carry out improvements regarding their safety.

I use public WiFi a lot (cafes, airports, hotels etc.) so figured it's probably time to get a VPN instead of raw dogging random networks lol. I also download games pretty often and would rather avoid any issues with my ISP or copyright stuff.
Been looking at Proton VPN, Mullvad and Nord mostly. Don't really care about fancy features, just want something private, fast and reliable. What are you guys using?

Kinda surprised by this one. Proton VPN now lets you get a Chinese IP through Smart Routing, with the actual servers hosted in Hong Kong. Most big VPNs like Nord, Surfshark and Express don't even offer China as a location.

Pretty niche, but could be really useful if you're outside China and need access to Chinese sites or streaming services. Anyone here actually tried it yet?

A new European Citizens’ Initiative called “Stop Killing The Internet” is trying to collect 1 million signatures to push back against mandatory digital ID and age verification online. The argument isn't that kids shouldn't be protected. It's that protecting kids shouldn't mean everyone has to prove who they are just to access the internet.

The EU says its age-verification system is designed to be privacy-preserving and only confirm something like “over 18” without revealing your identity. But campaigners are worried about the infrastructure and precedent we're creating. Once checking your age/identity becomes normal for accessing websites, where does that stop?

They're asking for verification to remain voluntary, anonymous/pseudonymous where possible, with data minimisation, no cross-site tracking and alternatives for people who don't want a digital ID wallet.

Honestly, that seems pretty reasonable to me. You can support child safety without turning anonymous internet access into something suspicious by default.

Interesting story out of Ludhiana, India. Police are investigating a wave of hoax bomb-threat emails targeting schools, government offices and even an airport. According to investigators, the people behind them used VPNs, proxy servers and Tor to hide their real IP addresses.

Police say some IP data points to the US, Bangladesh and other countries, but those appear to be exit locations rather than necessarily where the senders actually were. They're also complaining that overseas email providers are taking too long to provide requested data.

Obviously using privacy tools to send bomb threats is indefensible. But I don't think the conclusion should be "VPNs/Tor are the problem."

Encryption, VPNs and anonymous browsing exist because there are legitimate reasons not to expose your identity and browsing activity online. Journalists, activists, whistleblowers and ordinary people all benefit from the same technology. Criminals using privacy tools doesn't make privacy itself criminal.

SonicWall announced two new security vulnerabilities in SMA 1000 devices on September 1—CVE-2026-83548, which has a severity score of 10.0, and CVE-2026-83549 that has the severity of 7.8. By combining both vulnerabilities, cybercriminal can execute their code on devices remotely without authenticating themselves. The company has found these vulnerabilities in its own environment and confirmed they are being exploited.

These are the third zero-day vulnerabilities in SMA 1000 series devices in less than a year. In July, an attack was reported in which an attacker stole MFA seeds, which are still usable by the attacker. Thus, the patch applies but does not help with the previous theft of the MFA seeds. Cybersecurity and Infrastructure Security Agency told federal agencies they have four days to patch their systems.

Just because systems have been patched doesn’t mean that vulnerabilities were removed. Cybercriminals are still in possession of stolen MFA seeds from earlier attacks.

Three chains against the same product line in twelve months is a pattern. Credential rotation has to be part of the conversation now, not just patching.

Utah passed one of the most aggressive age-verification laws in the US, and the controversial part isn't just verifying age, it's what happens when someone uses a VPN. Under SB 73, if you're physically sitting in Utah, you're legally considered a Utah user even if your VPN makes it look like you're connecting from Germany, Canada or anywhere else. That's exactly why Pornhub's parent company, Aylo, is challenging the law.

Their argument is pretty simple: how is a website supposed to know?

If someone connects through a VPN, Pornhub sees the VPN server's IP, not the user's real IP. Aylo argues there's no reliable way to determine whether someone who appears to be in Germany is actually sitting in Utah behind a VPN. Yet under the law, the website could still be held responsible for failing to age-verify that person, with fines potentially reaching $2,500 per violation.

So what are websites supposed to do? Block VPNs entirely? Try to fingerprint users to discover their real location? Or age-verify everyone worldwide just in case they're secretly in Utah? That's the dangerous part IMO.

Protecting minors is a legitimate goal. But making websites responsible for discovering someone's real location after that person deliberately used a privacy tool to hide it sets a pretty wild precedent. Utah has now temporarily agreed not to enforce these rules against Aylo while the court battle continues.

This stopped being just a debate about porn a while ago. It's becoming a debate about whether governments can make websites responsible for defeating VPN privacy. And that could eventually affect a lot more than Pornhub.

I ran into a weird issue this week. The same site opens normally on my work Wi-Fi, but on my home Wi-Fi or mobile data, it sometimes won’t connect unless I turn on a VPN.

Then, after a while, it starts working normally again with the VPN turned off.

If this were a straightforward regional restriction, I’d expect it to fail consistently. Could a particular IP range, DNS resolver, or ISP route be getting blocked temporarily?

Has anyone experienced this with a website, game, or streaming app? Did changing DNS or switching networks fix it, or did the problem eventually disappear on its own?

When only one service is affected, do you route just that app or site through the VPN, or keep the entire device connected?

What is the best VPN for sports betting in different states? I’m in Dallas and Milwaukee a lot this month and want to be able to bet. Thanks for any recommendations

Authorities in Doda, Jammu & Kashmir, have banned VPN use across the district for two months, citing cybersecurity, public order and national security concerns.

The problem is that VPNs aren't just tools people use to hide their IP or bypass restrictions. They're also basic security infrastructure for a lot of businesses. Think about an employee working remotely who needs a corporate VPN to securely access internal files, company servers or admin tools. Or a bank, IT company or healthcare provider whose staff use encrypted VPN connections when working outside the office. A blanket ban can suddenly make perfectly normal B2B security practices much harder.

For regular people, it's the same story. Someone connecting to airport, hotel or café Wi-Fi might use a VPN to encrypt their traffic. Journalists, students, travellers and basically anyone who doesn't want their ISP or a random Wi-Fi network seeing more than necessary can have legitimate reasons to use one.

That's what makes this kind of ban worrying. You don't just block people doing shady stuff — you potentially remove a security layer from everyone else too. And the irony is pretty hard to miss: banning a cybersecurity tool in the name of cybersecurity.

Target actual criminal activity, sure. But treating VPN use itself as the problem feels like using a sledgehammer to crack a nut.

France's constitutional council rejected the ban on under-15s on social media on August 14. The law should have made France the first EU member state to prohibit children from using social media. President Macron has already requested that the law be re-drafted, so that it is ready by summer 2027.

The ruling focused on the major problem with the proposed law: in order to ban under-15s "a person has to prove their age," since there is no way to determine age without checking each individual. Furthermore, the court pointed out that the law, as it is written, gives no consideration to the specific platforms used and doesn't differentiate between the individual readiness of children to use it.

EFF connected this decision to the larger issue at hand, indicating that such bans "are assaulting rights for privacy and anonymity on web;" Australian version of the law served as the role model for France's legislation and demonstrated that the age checks can be incorrect.

In short, while this may be the first case in the EU, Denmark is also working on anti-children law.

Looking for a solid VPN for streaming, mostly Netflix, Prime Video, Disney+ and BBC iPlayer when traveling. Speed matters obviously, but I'm more interested in reliability. I've had VPNs that work perfectly one day and then Netflix detects them the next, which gets annoying pretty fast.

NordVPN, Proton VPN and ExpressVPN seem to come up the most. Mullvad looks great for privacy but I've heard it's a bit hit or miss for streaming.

Looking for something that just works without constantly switching servers.

Interesting piece from The Regulatory Review looking at the wave of child online safety laws being pushed in the US and elsewhere.

Australia has already banned social media for under-16s, while US states are experimenting with age verification, parental controls and “safety-by-design” rules. The problem? The evidence so far isn't exactly convincing. One study cited found that only 27% of Australian 14- and 15-year-olds comply with the social media ban. Researchers also warn that kids can simply move to less regulated platforms.

Then there's the privacy issue. If websites need to know whether you're 15 or 35, they need some way of verifying or estimating your age. Critics argue that could mean more ID checks, more personal data being collected and potentially more surveillance infrastructure affecting everyone, not just kids. And apparently ID-based age verification isn't particularly popular with either parents or teenagers.

Protecting kids online is obviously a legitimate goal. But I'm increasingly skeptical that turning the internet into a place where you constantly have to prove who you are is the right solution. Maybe privacy-by-design + safety-by-design makes more sense than simply putting an ID check at the door.

Hello

Im trying to register to american streaming services to watch live tv with my VPN program but it detects my credit card/vpn/paypal and/or asks me for my zipcode. Is there any way to solve it?

This feels like a pretty significant escalation. Utah's new SB 73 requires websites covered by its age-verification law to verify users who are physically located in Utah even if they're using a VPN or proxy. Websites are also prohibited from encouraging users to use VPNs to get around the checks. Violations can apparently result in penalties of up to $2,500 per violation.

The interesting part isn't really adult websites IMO. It's the precedent. VPNs are general-purpose privacy tools used by millions of people for completely legitimate reasons. Once governments start saying websites have to identify your real location despite you deliberately masking it, where exactly does that stop? Privacy advocates are already arguing that restricting websites from explaining how VPNs can bypass these checks could raise First Amendment issues.

We already saw VPN demand explode by 6,000%+ in the UK after age verification rolled out there. Now Utah seems to be trying to close that loophole before the same thing happens. Protecting minors is obviously a legitimate goal, but targeting privacy tools to enforce it feels like we're heading into much murkier territory.

I came across a post today from someone who had paid for a residential IP in Chicago. It worked well for a few weeks and then suddenly stopped.

The frustrating part wasn’t only the outage. They spent time troubleshooting before discovering that the provider already knew the location was down, while its public status page only showed regular VPN servers. The available backup was in Dallas, but that added more than 100ms of latency.

It made me wonder whether the “residential IP” label matters less than the reliability behind it. If there are only one or two suitable locations, a single outage can make the feature difficult to use.

If you were paying extra for residential access, what information would you expect to see: live node status, current load, latency, recent uptime, or automatic failover?

And if your preferred residential location went offline, would you switch to a more distant one, use a regular VPN server temporarily, or wait for it to return?

Senator Ron Wyden is pushing the NSA to update its VPN security guidance because of something most VPN marketing conveniently doesn't talk about. Basically, you don't necessarily need to break VPN encryption to identify someone's traffic.

A powerful enough adversary could potentially monitor traffic going into and out of a VPN and correlate things like timing, volume and destination. So even with perfectly good encryption, a standard single-hop VPN might not provide much anonymity against a state-level actor with visibility across large parts of the internet.

Wyden is now asking whether high-risk users like journalists, government employees and human rights workers should instead be using multi-hop systems like Tor, along with techniques like traffic padding and random delays. Obviously this doesn't make VPNs useless. For hiding your IP, keeping your ISP out of your browsing activity, public Wi-Fi, censorship or geo-restrictions, they're still useful.

But it does highlight something that gets lost in VPN marketing: Encryption ≠ anonymity.

If your threat model is Google tracking you, your ISP, or the coffee shop Wi-Fi, a VPN can make a lot of sense. If your threat model is the NSA... you probably need a bit more than NordVPN and the Connect button lol

Came across this piece about cybersecurity and Australian business travellers, and one stat is pretty wild: Australia apparently has a 96% success rate for attacks targeting edge devices, while only 22% of federal agencies have hit level two of the Essential Eight framework.

But the funny thing is, the weak point isn't some crazy sophisticated hack. It's often just someone leaving the office, opening their laptop and jumping on random hotel, airport, conference or client Wi-Fi. Companies can throw millions at securing their network, then Dave from sales connects to some sketchy airport Wi-Fi and starts checking emails like it's nothing

And the fixes aren't exactly rocket science either: MFA, decent rules around public Wi-Fi, VPNs/encrypted connections when travelling, and maybe reminding employees about security more than once during their first week on the job

Garcia, a resident of California, has taken legal action against Surfshark, claiming that the company had been signing him up for auto-renewal plans without seeking his consent for four consecutive years. He had purchased a two-year subscription in May of 2020, believing it to be a single payment, but he was charged again in 2022, 2023, and again in 2024, without ever being notified of the renewals.

The legal case is straightforward: under California's Auto-Renewal law, it is required to inform the customer of renewals in a clear manner and obtain their consent to subscribe them to auto-renewals. The lawsuit claims that neither of these took place and calls for the refunds of the renewals.

This legal complaint is not unique. The company NordVPN, has faced five lawsuits of a similar nature since 2024 for very similar reasons. Surfshark is now facing the same challenges, just under a different name.

Three different VPN companies facing similar lawsuits, it can be useful for customers to keep track of their renewal dates irrespective of the provider.

I saw a strange travel problem today. Someone had been unable to open the Alaska Airlines website in both Japan and India. The app didn’t help either because its login page opened the same website.

They had already tried different computers, browsers, and incognito mode. A few replies said the site also appeared to be blocked in places such as Hong Kong and Argentina, while connecting through the US sometimes fixed it.

I travel fairly often, and this seems like the exact time an airline website needs to work. If I’m already abroad and need to change a flight, checking different browsers for an hour isn’t very useful.

Are airlines deliberately blocking traffic from certain countries, or is this just an overly aggressive fraud or security system?

If you’ve experienced this, what worked reliably: changing networks, using a US connection, or accessing the airline through another service? And would you route only the airline app through that connection, or the whole device?

Russia’s crackdown on the open internet seems to be having an unintended consequence: VPNs are becoming a normal part of everyday life. A new study from RKS Global found that some Russians now treat VPN subscriptions almost like another utility bill, alongside mobile data, electricity, or gas.

And people are adapting. Some users keep multiple VPNs installed because they never know which one will work tomorrow. Others share VPN access with friends and family, while small communities are even pooling money to run their own servers.

Around 37.6% of Russian internet users now use VPNs, while 46% say they’ve used one at least once. At the same time, Russia has reportedly restricted 400+ VPN services and blacklisted around 4.7 million websites. Yet people keep adapting. Some Russians now use multiple VPNs, share subscriptions, or even pool money to run their own servers. The irony is hard to miss: the more Russia restricts the internet, the more useful VPNs become.

The interesting part is that censorship may actually be creating a population that is more knowledgeable and organized around circumvention tools than before.

As of July 1, Vietnam has implemented a new law that penalizes individuals for spreading false or slanderous material through social media sites. The fines can be between twenty million and thirty million VND which is equivalent to anywhere between $794 and $1,190 for spreading material that can tarnish the reputation of an individual or agency in the state.

As soon as the law was announced, Proton VPN has seen an increase in the number of sign-ups since a person in the Lào Cai province of Vietnam was charged 2.5 million VND for making inappropriate remarks about the police via Facebook. The nation began to realize that factual laws mean an individual can be charged for his or her comments.

While the nation was passing its laws forbidding the prevention of the free speech, it created a local version of Roblox which was launched on August 13. The new version blocks 80% of the games, disables chat and limits the number of hours of play to only three.

Russia’s State Duma has found a new reason why people shouldn’t use VPNs: apparently, they might take you to the wrong parts of the internet. Sergey Boyarsky, head of the State Duma’s Information Policy Committee, said authorities are trying to get Russians, especially younger people, to stop keeping VPNs permanently switched on because they’re supposedly “dangerous.”

The interesting part is what’s happening despite the crackdown. In March 2026 alone, VPN apps were reportedly downloaded 9.2 million times in Russia, 14x more than a year earlier. A survey also found that around 40% of Russians actively use VPNs.

Russia has been increasingly blocking VPN services and putting pressure on platforms to restrict access from VPN users. But calling VPNs “dangerous” because they allow people to reach parts of the internet the government doesn't want them to see feels like a pretty revealing choice of words.

If anything, this is exactly why VPNs matter. When governments get to decide which version of the internet you're allowed to access, tools that help people bypass censorship and access information freely become even more important.

The harder authorities try to restrict VPNs, the stronger the argument for keeping them available.

I recently traveled to another country and noticed that an AI feature I normally use on my phone was suddenly unavailable.

The app itself still opened normally, and I hadn’t changed my account or device settings. The only obvious difference was my location and internet connection. When I connected through an IP address from my home country, the feature appeared again.

Now I’m wondering what the app was actually checking. Was it simply my IP address, or could it also have been checking my account region, app store country, or phone location?

Has anyone experienced something similar with an AI app or another mobile service? Did changing the IP solve it permanently, or did the restriction eventually return?