MEP Leire Pajín (S&D) has asked the European Commission to clarify whether virtual private network (VPN) services fall under the Digital Services Act (DSA) as intermediary services, and if so, which specific category applies. The question, submitted on 22 June 2026, seeks to resolve legal uncertainty that has emerged from diverging judicial and administrative rulings across Member States on the classification of VPNs under the DSA.
Pajín's written parliamentary question references the DSA's own recognition that new technologies have created an increasingly complex online ecosystem, and notes that doubts persist about the legal nature of services like VPNs. She specifically asks the Commission to consider whether VPNs qualify as intermediary services under the regulation, and if so, under which of the DSA's defined categories they would fall. The question also points to the AGORA data-sharing platform between Digital Services Coordinators and the Commission as a potential source of relevant information.
the DSA imposes obligations on intermediary services to collaborate with authorities on removing or blocking illegal content, and provides liability exemptions. If VPNs are classified as intermediaries, they would be subject to these rules, potentially affecting their operations and the privacy of their users. Conversely, exclusion from the DSA's scope could leave a regulatory vacuum.
Pajín's question does not propose specific numerical targets or deadlines, but seeks a legal interpretation that could have significant implications for VPN providers, national regulators, and users. The Commission is expected to respond within approximately six weeks, and its answer will signal whether it views VPNs as part of the regulated digital ecosystem or as outside the DSA's framework.
VPN providers face potential new compliance obligations if classified as intermediaries, including content moderation and reporting duties. National Digital Services Coordinators would gain clearer enforcement powers over VPNs. Users could see reduced privacy if VPNs are required to block illegal content, but also benefit from stronger accountability. The broader tech industry may face a precedent for how emerging services are regulated under the DSA.