Six US Democratic lawmakers have sent a letter demanding the DOJ clarify whether American citizens using commercial VPNs are exposed to warrantless government surveillance. The concern: VPN traffic may be classified as "foreign-linked" — stripping constitutional protections. Separately, states like Utah are passing age verification laws that specifically target VPN users.
The Core Legal Question
When you use a VPN, your traffic routes through servers that may be physically located in another country or owned by foreign entities. The concern raised by lawmakers: intelligence agencies may classify this traffic as "foreign communications" — subjecting it to different, weaker privacy protections under FISA (Foreign Intelligence Surveillance Act) compared to purely domestic communications.
Six Democratic senators have sent a formal letter to the Department of Justice asking: "Does the use of a commercial VPN service by an American citizen expose their communications to warrantless surveillance under any current legal authority?" The DOJ has not yet responded publicly as of April 3, 2026.
Utah's "Liability Trap" for VPN Users
NordVPN publicly called Utah's new age verification law a "liability trap" for VPN users. Utah requires age verification for adult content sites. The law creates legal uncertainty for users who bypass this verification via VPN — potentially exposing them to legal consequences for accessing content that is legal in most other states. NordVPN has warned that similar laws spreading to more states could create a legal patchwork that makes VPN use legally risky for ordinary Americans.
Post-Quantum Encryption — The New VPN Standard in 2026
Away from the legal battles, VPN technology itself is evolving rapidly. Post-quantum encryption (PQE) — which protects against future quantum computers that could break current encryption — is rolling out across the industry. NordVPN and ExpressVPN already have PQE deployed. Surfshark and ProtonVPN have PQE on their 2026 roadmap. This matters because of "harvest now, decrypt later" attacks — where adversaries collect encrypted traffic today, planning to decrypt it when quantum computers become available. For journalists, activists, and anyone with long-term privacy needs: choosing a VPN with PQE is increasingly important in 2026.
What You Should Do Right Now
- ✅ Use a VPN with a verified no-logs policy — Swiss or Panamanian jurisdiction preferred
- ✅ Choose VPNs with post-quantum encryption already deployed (NordVPN, ExpressVPN)
- ✅ Understand your state's age verification laws if they apply to your usage
- ✅ Continue using your VPN — the legal questions are about government surveillance, not ordinary privacy use
VPN Legal Status — FAQ
Today's VPN legal questions