ExpressVPN says it is pulling its servers out of India, citing the impossibility of complying with an upcoming mandate to record users' names and activities
New Delhi: Virtual private network (VPN) operator ExpressVPN is pulling its servers out of India, citing the impossibility of complying …
Context & Ripple Effects
India had already said VPN and cloud operators that would not meet its cybersecurity rules would have to leave, after rules requiring VPN providers to collect real-user information were announced. ExpressVPN is the first supplied coverage here to make that compliance conflict concrete through a server withdrawal.
The later departure of Proton VPN, following Surfshark and Nord, shows ExpressVPN's move was part of a broader provider response to the customer-data collection rules, rather than an isolated infrastructure decision.
First-order effects
- ExpressVPN will remove its India-based server presence rather than retain records of users' names and activities, forcing its Indian operation to operate without local servers.
- India's mandate immediately divides VPN providers between accepting identity-and-activity logging requirements and withdrawing local infrastructure, the outcome regulators had signaled in their compliance-or-pullout warning.
Second-order effects
- Rival VPN services face the same choice, and the later exits by Proton VPN, Surfshark, and Nord indicate that privacy-focused providers are more likely to retreat from local operations than change their data practices.
- Indian users seeking privacy tools face a less locally rooted VPN market, while providers that remain gain an advantage only by accepting the government's registration requirements.
Third-order effects
- The sequence points toward internet-access controls extending beyond provider obligations to distribution: the later removal of VPN apps from Apple and Google's Indian stores shows enforcement can move from local servers to app availability.
- If this pattern persists, India's VPN market will be shaped less by server performance and more by whether providers can satisfy state data-retention and access requirements.
The trend: India is tightening control over privacy and connectivity services by pairing data-collection rules with infrastructure and app-distribution enforcement.