VPN Jurisdiction Explained: What Five Eyes and 14 Eyes Mean

Search for how to choose a VPN and you will quickly meet the terms "jurisdiction", "Five Eyes" and "14 Eyes". Articles often present them as a simple traffic light: green countries are safe, red countries are not. Real life is less tidy. Jurisdiction is a real factor, but it is easy to overstate, and the labels hide a lot of detail.

This guide explains what the terms mean in plain language, why jurisdiction can matter, where the fear is exaggerated and how to weigh it against other things you can actually check. It is general education. It makes no statement about the jurisdiction or data practices of any specific company, and it is not legal advice.

What "jurisdiction" means for a VPN

Jurisdiction means the legal system that has authority over something. For a VPN service, three different places can be involved.

• Where the company is based. This is the country where the company is registered or has its main operations. Its laws govern what the company must keep, what it can be ordered to hand over and what it can refuse.
• Where the servers are. Each server is in a physical place, in a data centre run by another business. Local law applies to that equipment and to the data centre operator.
• Where you are. You remain subject to the laws of the place where you live or travel, whatever service you use.

These three are separate, and mixing them up is the most common mistake in jurisdiction articles. A company based in one country can run servers in many others. A request in one country may not reach a company in another, or may reach it through a formal process between governments.

What the Five Eyes are

The Five Eyes is an intelligence-sharing alliance with roots in an agreement between the United States and the United Kingdom after the Second World War, later joined by Canada, Australia and New Zealand. The partners cooperate on signals intelligence and share some of what they collect. The name has since become shorthand for these five countries.

Two wider groupings are often mentioned:

Name	Countries	What it adds
Five Eyes	United States, United Kingdom, Canada, Australia, New Zealand	The original and closest partnership
Nine Eyes	The five above, plus Denmark, France, the Netherlands and Norway	A wider circle of cooperation
Fourteen Eyes	The nine above, plus Germany, Belgium, Italy, Spain and Sweden	Wider again, with more limited sharing

The "9 Eyes" and "14 Eyes" names are informal. They are used by commentators, and the exact level of cooperation is not the same across every country in the list. Treat them as a loose description of intelligence-sharing relationships rather than a formal bloc with a membership card.

Why people worry about it

The concern is straightforward. If a VPN company is based in a country that shares intelligence widely, data held by that company might be requested by authorities and shared onwards. If the company does not keep much data, there is little to hand over, so the main question is what data the company holds. The trust-model article what a VPN provider can see goes through the types of data in detail.

Worries tend to cluster around three things:

1. Mandatory data retention. Some countries require telecom companies to keep certain records for a period. It is worth checking whether and how such rules apply to a VPN service in a given country, since this varies widely and changes over time.
2. Secret or compelled cooperation. Some legal systems allow authorities to demand data or assistance, sometimes with restrictions on telling the customer. How far this applies to a VPN company depends on the country and the case.
3. Bulk surveillance. Intelligence agencies in several countries have conducted large-scale collection of internet traffic. This mostly concerns traffic crossing network backbones, which a VPN encrypts between your device and its server.

What jurisdiction does not prove

This is where many articles overreach.

• Being in a Five Eyes country does not mean the company is spying on you. It only describes the legal and political environment.
• Being outside those alliances does not make a company trustworthy. Many other governments have strong surveillance powers, and some have weaker legal protection for individuals. A country with a good privacy reputation on paper can still have a poorly run company.
• A "privacy-friendly" country is not a guarantee. The law may be favourable, but the company still has to act on it and store little data in the first place.
• The country label says nothing about security quality. Software quality, encryption design and operational discipline are separate and often matter more for most users.

Think of jurisdiction like the neighbourhood of a shop. Knowing the neighbourhood tells you something about the rules that apply. It does not tell you whether the shopkeeper is honest.

How a company's data practices interact with jurisdiction

Jurisdiction matters most when a provider holds a lot of data. Compare two situations:

• Provider A keeps detailed connection records for months. A lawful request can lead to a large amount of information being disclosed, so the legal environment matters a great deal.
• Provider B keeps very little. A request finds little to disclose, so the legal environment matters less, although it still affects what the company could be compelled to start collecting.

Neither arrangement is verifiable by customers without trust, transparency reports or independent review. That is why the practical advice is to give more weight to what you can inspect: the privacy policy, the amount of data requested at signup, the company's accountability and the quality of independent evidence. See what to check before paying for a VPN.

Worked example: two hypothetical travellers

Lena travels often for work and uses a VPN mainly on hotel and airport Wi-Fi. Her main worry is another guest or a hotel network operator reading her traffic. For her, the right threat model is the local network, and jurisdiction is a minor factor compared with choosing a provider that is run carefully and uses strong encryption. The basic idea of a VPN as a protected path across an untrusted network is described in Cloudflare's VPN explainer.

Omar is a journalist who handles confidential sources. Jurisdiction, data retention, operational security and the risk of legal pressure are central to his decisions. A VPN is only one tool in a larger practice, and he should rely on specialist security training and organisations such as the EFF rather than a country label. For him, what a VPN cannot protect you from is essential reading.

The same label, "based in a Five Eyes country", means something very different for Lena and for Omar.

A practical way to weigh jurisdiction

Use these steps to decide how much weight jurisdiction deserves for you.

1. Define what you are protecting against. Is it a stranger on public Wi-Fi, an advertiser, your internet provider or a serious adversary? The more ordinary the risk, the less jurisdiction matters.
2. Find where the company is based. A reputable provider tells you who operates the service and where. If it does not, treat that silence as information.
3. Read what data it collects. Check the privacy policy for specific categories and time periods. Less data held means less to disclose, whatever the country.
4. Look for transparency. Does the company publish anything about legal requests it has received, or about how it responded? Some do, many do not. Absence is not proof of wrongdoing, but presence is a positive signal.
5. Look for independent checks. Reviews, audits and technical write-ups that explain their method are worth more than a badge.
6. Decide whether jurisdiction is a deal-breaker for your situation. For many people the honest answer is "it is one factor, not the deciding one".
7. Accept that there is no perfect answer. Every legal system has trade-offs.

Reading a provider's legal pages

Every serious provider has terms of service and a privacy policy. Few customers read them, but they are the best evidence you can inspect. Look for these details:

• The legal entity. A company name, registration country and contact address. Without them, you cannot tell which laws apply at all.
• What happens on a legal request. Some policies say the company will only act on valid orders from its own courts, will review requests and will inform the customer where it is allowed to. Others say nothing. Wording is not proof of practice, but a clear statement is better than silence.
• Data categories and retention periods. Specific wording such as "connection timestamps are kept for X days" is more useful than "we respect your privacy".
• Third parties. Payment processors, analytics tools, email services and data centres each see part of the picture. A good policy names the categories.
• Changes over time. A policy that has a revision date and a history is easier to hold to account than one that quietly changes.

None of this proves a company will behave well. It does show whether the provider is willing to be specific, and specificity is the nearest thing to evidence a customer can get.

Five Eyes myths worth dropping

• "Five Eyes countries read all VPN traffic." A VPN encrypts the traffic between your device and its server. Observing it from outside shows encrypted data and endpoints, not the contents. The risk that remains is mainly about what the provider itself holds.
• "Moving the company offshore solves everything." It changes which laws apply. It does not change what the service technically sees, and it adds complexity of its own.
• "Only the headquarters matters." Servers, payment processors and data centres all bring in their own legal environments.
• "Alliance membership is a fixed list." The groupings are informal, differ between sources and say little about any individual company.

Common mistakes

• Treating server location as company location. A provider with servers in many countries is not governed by all of them in the same way.
• Choosing a country because a blog ranked it highly. Rankings often rely on out-of-date information. Laws change.
• Ignoring the rest of the risk picture. Your browser, accounts and habits expose more about you than your VPN provider's country does. See common VPN security myths for related misunderstandings.
• Assuming a VPN is anonymity. It is not. See whether a VPN can make you anonymous.
• Believing absolute claims. No country label makes a service immune to every legal process, and no provider can promise a guaranteed outcome.

Limits and what to watch for

• Laws change. Data retention rules, surveillance powers and court decisions evolve. Anything written about a specific country can go out of date quickly, so check current sources before relying on it.
• Corporate structure can be complicated. A brand may be owned by a holding company in another country, or share ownership with other brands. This is one reason to read who actually operates the service.
• The data centre is also a party. Servers run in third-party facilities, which have their own legal duties.
• Your own country counts. You are subject to your own local laws whichever VPN you pick, and using a VPN does not change that.
• This article is general information. It does not tell you what is legal where you live. If you need to assess a specific legal risk, speak to a qualified professional.

Summary

VPN jurisdiction is the legal environment a provider operates in. Five Eyes, 9 Eyes and 14 Eyes describe intelligence-sharing relationships, and they are informal labels, not a verdict on any company. Jurisdiction matters most when a provider holds a lot of data and least when it holds very little, and for everyday risks like public Wi-Fi it matters far less than good encryption, careful operation and your own habits. Weigh it as one factor next to the privacy policy, transparency and independent evidence. If you want a prepaid VPN pass without automatic renewal, you can look at XPASS pricing.