Pakistan's telecom authority doesn't seem willing to let go of its quest to regulate the use of VPNs across the country.
After last year's failure to ban unregistered VPN services for good, the Pakistan Telecommunication Authority (PTA) shared a new framework on December 19, 2024, introducing a new licensing category for VPN providers. Companies now need to apply for a permit to operate within the country and avoid potential blocks.
The new directive will essentially require VPN providers to collect and share users' information usage with authorities upon request – de facto going against the strict no-log VPN policies of many companies on the market. So, what's at stake for Pakistan's VPN users in 2025?
A new chapter in Pakistan's VPN crackdown
Pakistan's VPN crackdown has been a developing matter throughout 2024. The push to regulate their usage began when the best VPN apps became a crucial tool for people living or visiting the country to maintain access to the free internet.
A long list of social media apps remain blocked at the time of writing, in fact. These include X (which has been restricted since February last year), Facebook, Instagram, WhatsApp, and even Bluesky.
After trying to clamp down on VPN usage by directly disrupting the services – internet watchdog NetBlocks first reported VPN restrictions seven days after X had been blocked – PTA shared plans to regulate the use of VPNs as a way to curb misuse back in August.
"Unregistered VPNs" became then the target. Over the following months, authorities would deem these services a "security risk" for Pakistan as they can be used to access "sensitive data," with Pakistan's top religious body even arguing that using a VPN may go "against Islamic law."
Pakistani businesses and freelancers were given a deadline of November 30, 2024, to register their services on the PTA portal and avoid blocks. Once the day approached, however, authorities were forced to withdraw the ban due to a lack of legal grounds to ban VPNs, as per Pakistan's Law Ministry.
In a recent report, the PTA has also blamed VPN usage for slow internet speeds across the country. Experts, however, have long argued that government-imposed censorship is the real culprit behind the slowdown.
Fast-forward to the end of December, the PTA announced a new strategy to finally address the unregistered VPN matter – VPN providers need to obtain a license within the country to keep working.
"VPN service providers are required to obtain Class License for Data (Data Services) to provide VPN and related services," wrote the telecom regulator in a press release.
The concept of localized VPN service providers was first suggested by the Pakistan Software Houses Association (P@SHA) – a representative of the country's IT industry – to facilitate almost 2.5 million freelancers scattered across the nation who every day rely on these services for work.
As the Pakistani English-speaking newspaper The Dawn pointed out, the PTA plan envisages local companies to provide VPN or proxy services to citizens, instead of foreign companies which are more difficult to control.
"Until now (January 8, 2025) only three companies have applied to get the license of VPN service provider – Zettabyte, Alpha3Cubic, and the state-owned telecom company the PTCL," Kalbe Ali, a journalist at the Dawn, told TechRadar, adding that the licenses have yet not been issued.
Another India-like VPN exodus?
The main problem here is that, if they become licensed service providers, the anonymity of Pakistan VPN users would be compromised as authorities would be able to monitor VPN traffic. Worse still, VPN providers will be forced to collect and "promptly provide all information, as and when desired by the Authority [PTA]."
Such provisions mirror India's controversial data retention law enforced in 2022. At that time, the law provoked an exodus of VPN companies from India. The likes of ExpressVPN, NordVPN, Hide.me, Surfshark, and Proton VPN all removed servers physically based in the country to protect the privacy of their users.
Talking to TechRadar, Proton VPN confirmed that if the PTA's VPN framework is eventually enforced, the company's response would be the same as three years ago – replacing their physical servers with its Smart Routing technology. Physically based in Singapore, these servers would be able to give users (in this case) a Pakistani IP.
NordVPN's position appears to be simpler as, a company's spokesperson told TechRadar, the provider doesn't have physical servers in Pakistan. "In light of similar regulations, we will rely on our network of remote virtual servers, ensuring continued service in the region without compromising user privacy," he added.
Surfshark sees PTA's new directives as "a troubling development in restricting online freedom" in Pakistan.
Gytis Malinauskas, Head of Legal at Surfshark, told TechRadar: "Taking such radical actions, which significantly impact the privacy of millions of people in Pakistan, is likely to be counterproductive and could severely harm the growth of the country’s digital sector."
According to Malinauskas, not only VPN users' privacy but the new rules will also put even more Pakistanis' data at risk of breach. He said: "According to Surfshark's global data breach statistics, over the past 20 years, the account details of 22 million online users in Pakistan have been leaked, making any future breaches even more damaging."
Subbu Sthanu, IPVanish's Chief Commercial Officer, also expressed his concerns about the new directives, pointing out that so far the company hasn't received any official notice from the government nor users lamented any disruptions.
Nonetheless, "We will never concede our values to maintain business in a given region," he told TechRadar. "Citizens deserve secure, uncensored access to the global internet. If VPN providers are required to log and pass on customers’ internet usage, that will reduce Pakistanis’ privacy and freedom."
Bottom line
Given last year's failures in successfully regulating Pakistan VPN usage, it's difficult to predict what's at stake for all the people who use these services every day across the country.
Asked about the likeliness for PTA's new plan to be finally implemented, Ali from The Dawn said: "The telecom regulator PTA has become a laughing stock and a target of criticism over this matter, similarly to previous attempts to curtail social media and the internet."
What's certain, though, is that the public remains divided on the VPN matter. Some people are scared the government will keep squeezing overall internet speed to try to prevent people from using these services. While, for the majority of people, a VPN is the only way to keep exercising their freedom of expression on social media.
Ali said: "The fear is that if VPNs are controlled in any manner and the blockade of X becomes successful the same trend will follow at other forums, and the check over any kind of criticism will further tighten."
