PrivadoVPN has formally completed its migration from Switzerland to Iceland, updating its Terms of Service to reflect a new legal home under Icelandic jurisdiction. The move, months in the making, replaces the former Swiss entity Privado Networks AG with Privado Networks ehf., headquartered in Garðabær, near Reykjavík. The transition is a direct response to proposed Swiss surveillance legislation that threatened to fundamentally compromise what privacy-focused VPN providers can legally promise their users.
Why Switzerland Lost Its Privacy Crown
For much of the past decade, Switzerland occupied a privileged position in the digital privacy conversation. Its strict data protection laws, independence from the European Union, and strong constitutional protections made it a preferred jurisdiction for privacy-conscious technology companies. That reputation, however, depended on political stability - and in March 2025, that stability cracked.
The Swiss government put forward amendments to its surveillance framework that would have extended mandatory monitoring and data collection obligations to what it defined as "derived service providers." That classification swept VPN providers, social media platforms, and messaging applications into the same regulatory category as traditional telecommunications companies. For a VPN provider, compliance with such rules would be self-defeating: the entire value proposition of a VPN rests on not retaining user data or exposing connection metadata to third parties.
PrivadoVPN read the regulatory trajectory clearly and began its exit well before the proposals hardened into law. The question was where to go next.
Iceland's Legal Framework Offers a Structural Advantage
Iceland's appeal is not merely reputational. It rests on a specific and consequential legal distinction. Under Icelandic law, VPN providers are classified as application-layer service providers - a technical designation that places them outside the scope of telecommunications regulation. Telcos in most jurisdictions carry mandatory data retention obligations, meaning they must log connection records and make them available to authorities upon lawful request. Application-layer providers do not.
For PrivadoVPN, this distinction eliminates the legal mechanism through which user data could be compelled from the company. It is not merely a matter of policy or goodwill - it is a structural exemption written into how the relevant law categorizes the service. That is a meaningfully stronger protection than a company simply choosing not to log data while operating under a jurisdiction that could legally force it to do so.
Iceland is also a member of the European Economic Area, meaning it benefits from GDPR-aligned privacy standards, while remaining outside the EU's direct legislative reach and outside the intelligence-sharing frameworks that link many larger European states. It is a position that offers the benefits of European legal culture without its expanding surveillance obligations.
What the New Terms of Service Actually Change
The updated Terms of Service are substantially more detailed than the August 2023 version they replace. The expanded document sets out explicit protections and operational obligations under Icelandic law, reducing the legal ambiguity that shorter, vaguer ToS documents often leave unresolved. Greater specificity in a Terms of Service is not just a legal formality - it creates clearer accountability for both the provider and the user, and makes it harder for either party to claim misunderstanding after the fact.
One notable practical addition is the explicit cap on the 30-day money-back guarantee, which the new document states may only be used once per user. This closes a loophole that some users had previously exploited by cycling through refund requests across multiple accounts.
For users already familiar with PrivadoVPN's offering - which includes a free tier providing 10GB of monthly data with unthrottled speeds, plus a premium service with unlimited data, up to ten simultaneous connections, and server access across more than 60 countries - the jurisdiction change requires no action. The practical experience of using the service remains unchanged. What changes is the legal ground on which that service now stands.
A Signal to the Broader VPN Industry
PrivadoVPN's move reflects a broader pattern taking shape across the VPN industry. As established privacy jurisdictions face mounting legislative pressure, providers are being forced to make active choices about where they operate rather than relying on historical reputation. Switzerland's shift is a telling indicator: no jurisdiction's privacy credentials are permanent, and companies that fail to track regulatory change expose their users to risks that marketing language cannot cover.
Iceland's emergence as an alternative privacy hub is unlikely to go unnoticed by other providers watching the same regulatory pressures build across Europe. The country's combination of favorable law, EEA membership, and demonstrated political commitment to press freedom and digital rights makes it a credible long-term option - not merely an emergency exit. For PrivadoVPN, the legal transition from Zug to Garðabær is now complete. Whether the Icelandic framework holds its current form as European surveillance ambitions expand remains the more open question.
