EU introduces strict security rules for VPN services

Users looking to protect their online privacy have largely had to rely on advertising promises from VPN providers or occasional external audits of encryption and no-logging policies. That's why the European Telecommunications Standards Institute (ETSI) is introducing a single, legally binding standard, EN 304 620. The new rules require that all VPN services sold on the European market meet strict, independently verifiable requirements for encryption, authentication and vulnerability management.

The new draft standard is aimed squarely at VPN clients, servers, and gateways. It specifies how these products must protect and encrypt user internet traffic as it travels over unverified or public networks. Whether a provider uses industry-standard AES-256 encryption, modern WireGuard protocols, or servers that run entirely in system memory, they will be required to clearly demonstrate the operation of their security mechanisms.

The standard forms an important part of the broader Cyber Resilience Act, which will require all digital product manufacturers to meet basic cyber requirements by the end of 2027. The new rules also provide for mandatory and rapid reporting of security vulnerabilities that are actively exploited, which means much greater liability for providers in the event of a breach. For the average user, this brings a significantly higher level of security, as unverified or even dangerous free VPN apps will have to improve their protection or be removed from the European market.

At the same time, regulatory oversight does not stop at VPNs. ETSI has launched the approval process for a total of 17 European standards supporting the CRA legislation. These also cover other everyday digital solutions such as password managers, antivirus software, smart home assistants, connected toys and wearables. The result of these efforts will be a significantly more secure and resilient digital world for all European consumers.