14 Eyes Explained: What VPN Users Should Know

If you have ever read a "best VPN" article, you have probably met the instruction "avoid any provider in the 14 Eyes". It sounds precise, as if there were an official register and a clear rule. In reality the label is looser than most readers expect, and using it as a filter can lead you to reject good choices and accept poor ones.

This article explains what the label refers to, where it came from and what its structure does and does not tell you. It then offers something more practical than a ban list: a small scoring sheet that lets you weigh a provider's location together with the factors that usually matter more. The aim is not to dismiss the topic, which has real substance, but to put it in proportion. For the basic meaning of a company's legal home, see VPN jurisdiction explained. Here we look at the larger grouping and how to use it sensibly.

What "14 Eyes" actually refers to

The name stacks up from a smaller core. At the centre are five English-speaking countries that have cooperated on signals intelligence since the middle of the twentieth century. Around them, analysts describe further rings of partners.

• The core group is the United States, the United Kingdom, Canada, Australia and New Zealand.
• A second ring adds Denmark, France, the Netherlands and Norway, which gives the label "Nine Eyes".
• A third ring adds Germany, Belgium, Italy, Spain and Sweden, which gives the label "14 Eyes". Reporting links this wider circle to a European signals-intelligence forum often called SIGINT Seniors Europe.

Three points about this structure deserve emphasis.

1. None of these names is an official title. Governments rarely publish the list or its rules. The names were popularised by journalists, researchers and activists.
2. The rings do not mean equal participation. The inner group is described as sharing the most. The outer rings are described as sharing less and under narrower arrangements.
3. The word "Eyes" is shorthand for intelligence-sharing, not a global surveillance machine. It describes relationships between agencies that remain legally separate.

Because the list is informal, you will see slightly different versions in different articles. A claim of "exactly fourteen" is as much a convention as a fact, which is a good reason to treat it as a rough sketch rather than a legal boundary.

Where the label comes from, and why it stuck

The five-country core traces back to a wartime and postwar intelligence agreement, parts of which were declassified in the 2000s and 2010s. The wider rings became widely discussed after leaked documents in 2013 described cooperation between several agencies and the existence of tiers of partners. Internet privacy communities seized on the numbers because numbers are easy to remember and easy to put on a comparison chart.

That convenience is the reason the label spread into VPN marketing. A list gives readers a simple rule, and simple rules sell. It also gives providers an easy line: either "we are outside the 14 Eyes" or, less often, "we are inside but here is why it does not matter." Neither sentence is meaningful without the data practices behind it, which we return to below.

Five things the list does not tell you

A country list answers one narrow question: which governments are said to share signals intelligence. It stays silent on many things that affect your privacy more directly.

1. What the company stores. A provider with minimal records has little to disclose wherever it sits. A provider that stores a lot is exposed in any country.
2. Which laws bind the company. Data-retention rules, court-order powers and gag-order rules differ even between countries inside the same ring.
3. How strong local privacy protection is. Some listed countries have strong data-protection regimes and independent oversight; some unlisted countries have none.
4. Where traffic travels. Interception of cables and exchange points does not depend on where the VPN company has its headquarters.
5. What happens on your own device. Browser fingerprints, logged-in accounts and apps tell websites who you are regardless of any tunnel. See can you be tracked with a VPN.

If you remember only one of these, make it the first. The same country can host a careful company and a careless one.

Why using the list as a filter misleads

The "no 14 Eyes" filter fails in three predictable ways.

It rejects good options. A provider that publishes clear terms, keeps little data and explains its process for legal requests may sit in a listed country. A filter throws it out before you have read a word.

It admits poor options. A company registered in an unlisted country, but with vague terms, aggressive data collection and no track record, passes the filter easily. The filter cannot see any of that.

It creates a false sense of safety. Readers who choose "outside the 14 Eyes" sometimes relax other habits: they reuse passwords, tap unknown links or assume they have become anonymous. That is exactly backwards. Can a VPN make you anonymous explains why the answer is no, whatever the provider's address.

There is also a quieter issue. Many countries outside the list have mutual legal assistance treaties with listed countries, and may cooperate on specific criminal cases. This is ordinary international law enforcement, not secret intelligence, but it means an unlisted address is not a wall.

A scoring sheet instead of a ban list

Instead of a yes-or-no filter, score each provider you are considering from zero to three on each factor, then total the result. Zero means a clear weakness, three a clear strength. You can change the weights to match your own situation.

Factor	What to look for	Suggested weight
Data practices	Specific list of what is collected, with retention periods	Double
Legal-request handling	A described process, ideally with published reports	Double
Company transparency	Named company, clear ownership, a way to reach a person	Normal
Home-country legal environment	Strong data protection and independent courts	Normal
Payment model	Fits how long you need it; minimal stored billing	Normal
App quality	Reasonable permissions, regular updates, honest store description	Normal
Marketing honesty	No claims of anonymity, total security or untouchability	Normal

The point of "Double" next to the first two rows is that they carry the most direct privacy impact. Country membership in a 14 Eyes list is folded into the fourth row, where it sits beside other aspects of the legal environment rather than overruling them.

Worked example: three imaginary providers

Below are three invented providers so you can see how scoring changes a decision. No real company is described.

Provider X is based in a listed country. Its policy names each category of data collected and its retention period, explains how legal requests are reviewed and publishes a report every six months. The company is named, with a real postal address. Its app asks for few permissions.

Provider Y is based in an unlisted country. Its policy is a page of general statements. It says nothing about retention or legal requests. Ownership is not clear, and the website promises that users become "completely untraceable".

Provider Z is based in an unlisted country with a strong privacy regime. Its policy is clear and its ownership public, but it has no published reports and its app requests several permissions unrelated to its job.

Scoring each factor from zero to three, with double weight on the first two:

Factor	X	Y	Z
Data practices (double)	3 x 2 = 6	0 x 2 = 0	3 x 2 = 6
Legal-request handling (double)	3 x 2 = 6	0 x 2 = 0	1 x 2 = 2
Company transparency	3	0	3
Legal environment	1	1	3
Payment model	2	2	2
App quality	3	1	1
Marketing honesty	3	0	3
Total (maximum 27)	24	4	20

Provider X, the only one in a listed country, wins by a wide margin. A simple "avoid the list" rule would have discarded the best-documented option and left you choosing between Y and Z. Provider Z is a perfectly reasonable second choice, and Y is a clear warning. Your own scores will differ, but the method keeps you honest about what you are judging.

How different people might weigh location

The weight you give the legal environment should depend on your situation, which is the idea behind a privacy threat model.

• A student sharing a flat network. The practical risk is other residents and weak passwords. Give the home-country factor little weight and put effort into payment model, app quality and basic security habits.
• A remote worker handling client files. Your employer's policy and the client's contract may matter more than any list. Prioritise a provider with clear terms and stable connections, and follow company rules.
• A family travelling for two weeks. The main concern is hotel and airport Wi-Fi. Pick a provider with simple apps for every family device and a pass that matches the trip length. Country lists change nothing here.
• Someone with a specific reason to expect serious attention. This is a small group. Weigh the legal environment more heavily, but remember that a VPN is a minor part of a much larger plan, and seek specialist advice rather than relying on an article.

A reader in Thailand might also note that the list is mostly about where a company is based, not where you live. Your local laws apply to you wherever your VPN company sits.

Common mistakes with 14 Eyes

• Treating the list as an official register that never changes.
• Assuming every listed country behaves identically.
• Assuming every unlisted country protects privacy.
• Using the list to pick a provider and ignoring its actual data practices.
• Believing that "outside the 14 Eyes" means anonymous.
• Comparing providers on location alone and never reading a policy.
• Ignoring the app on your phone, which may collect more than the head office ever sees.
• Forgetting that your own device and accounts are part of the picture.

Limits and honest uncertainty

• The list is informal. Versions differ, and the arrangements behind it are not public.
• Laws change. A country's rules on retention and surveillance can shift, so any assessment is a snapshot. Check current official sources, and ask a qualified professional about legal questions that affect you.
• No scoring sheet is objective. The weights reflect your priorities, and the scores depend on what you can verify. Use it to organise your thinking, not to produce certainty.
• A VPN does not change legality. What is unlawful stays unlawful when done through a tunnel.
• Location is only one factor. The wider surveillance picture, from websites and apps to your internet provider, is covered in what a VPN provider can see.

Summary

"14 Eyes" is an informal label for a wider circle of countries reported to cooperate on signals intelligence, built out in rings from the original five. Because it is loose and says nothing about what a company stores, using it as a pass-or-fail filter often rejects good providers and accepts poor ones. A short scoring sheet that gives extra weight to data practices and legal-request handling puts location in proportion, and the right weight depends on whether you are a student, a remote worker, a traveller or someone with a specific serious concern.

When you are comparing options, the pricing page shows what a prepaid pass looks like, which you can read next to the scoring sheet at your own pace.