DoVPN may earn a commission through links in the VPN comparison below. How we fund DoVPN.
Vietnam internet freedom and privacy
Vietnam's crypto rules and internet logging: What a VPN can protect
Vietnam's new internet rules require providers to keep records that connect network activity to subscribers. At the same time, the country is tightening oversight of cryptocurrency trading. A Proton VPN signup spike has drawn attention to both changes, while raising a practical question: which records can a VPN actually protect?
In a September 5 post, David Peterson shared Proton data showing daily registrations from Vietnam reaching about 450% above baseline. The post links the increase to crypto penalties and internet-provider obligations. Its description of cryptocurrency transactions being criminalized goes further than the legal texts support: Vietnam has a licensed-market framework with a transition period, alongside administrative sanctions and other applicable law.
What the 450% signup chart tells us
The chart attached to Peterson's post measures daily Proton VPN signups from Vietnam as a percentage increase over baseline. The line rises sharply around September 1 and ends near +450%. Its last point has no date label, so assigning that peak to a specific day would add precision the chart does not provide.
Neither the chart nor the post explains the baseline calculation or gives absolute registration counts. The data therefore supports an attributed report about demand for one provider. It does not show how many people in Vietnam use VPNs, how many new accounts became active users, or why each person registered. The timing is consistent with concern about the new rules; it does not establish that those rules caused the increase.
There was also an earlier spike. When checked on September 5, the Proton Observatory listed Vietnam on July 17 at 170% above baseline in connection with online-speech restrictions. That entry describes a separate episode. Combining it with the September chart would obscure the different periods. Proton also sells VPN services, which makes clear attribution especially useful.
The crypto restriction has a transition period
Decree 284/2026/ND-CP, issued on July 16 and effective September 1, sets administrative penalties for violations involving crypto assets and their market. Article 9 addresses domestic investors trading outside providers licensed by the Ministry of Finance. It expressly refers to the framework in Resolution 05.
Resolution 05/2025/NQ-CP, adopted on September 9, 2025, established a five-year crypto-market pilot. Article 7(2) ties the domestic trading restriction to six months after the first service provider is licensed. The September 1 effective date of the penalties decree does not, by itself, start or end that six-month period.
A September 3 report from VNA/VLLF said Vietnam had not yet licensed a crypto exchange. It reported that five companies had passed an initial assessment and explained why domestic investors would not automatically be fined from September 1. Its account of the licensing status is dated September 3.
The policy aims to bring trading into a supervised market, with investor-protection and anti-money-laundering requirements. It permits activity through the pilot framework; describing it as a blanket ban on cryptocurrency transactions misses that distinction. Resolution 05 also refers to administrative or criminal liability depending on the nature and severity of a violation under applicable law. Crypto-related conduct can still carry criminal liability; the decree does not make every transaction a criminal offence.
Changing an IP address does not change the trading venue's licence or the identity attached to an exchange account. Anyone making a trading decision needs the current licensing and transition rules, not an inference that reaching a website makes its use compliant.
What internet providers must retain
Decree 333/2026/ND-CP took effect on August 19 under the Cybersecurity Law that commenced on July 1. Chapter IV deals specifically with IP address identification. Articles 21 and 22 require telecom and internet providers to connect IP use to subscriber information and maintain the technical records needed to trace a connection.
The specified records include source and destination IP addresses and ports, connection protocol, address-translation mappings, session start and end times, and subscriber information. Article 22 requires continuous retention for at least 12 months. These records can associate traffic with the customer using an address at a particular time, including when customers share public addresses through network address translation.
Under Article 23, providers must supply requested IP-identification information following a lawful written or valid electronic request from the Ministry of Public Security's specialized cybersecurity force. The deadline is 24 hours, or three hours in specified emergencies. The signed text places these ISP provisions on pages 27 and 28.
Platforms have separate account and log duties
The government's explanation of Article 16 describes account verification using Vietnamese mobile numbers or legally recognized identity information. Only verified accounts may post, share or interact with information under those provisions. Commercial livestreaming has an identity-verification requirement.
Covered services must also retain retrievable system logs for at least 12 months, including account, login, IP and information-processing records. The explanation sets deadlines of 24 hours for providing user data under valid requests and three hours in specified emergencies. These platform duties should be read separately from ISP connection logs and the decree's other data-localization provisions.
Logging a connection does not automatically reveal its encrypted contents. HTTPS normally protects page contents, passwords and the path after a website's domain from an observer on the network. But connection records can still reveal relationships and patterns over time. Retention requirements matter even when the underlying messages remain encrypted.
Vietnam's censorship history adds context
OONI measured Telegram blocking in Vietnam in 2025 on several networks, with differences between networks and between access to the website and app. Its findings cover blocking beginning in late May and record its lifting on measured networks in July. They demonstrate that access restrictions can vary by connection; they do not establish a current nationwide Telegram block.
Freedom House's Freedom on the Net 2025 report documents restrictions on online expression and identity requirements during its June 2024 to May 2025 reporting period. This is useful background to the current law, rather than evidence of a new September 2026 blocking event.
Financial supervision and investigation of specific offences have stated public-policy purposes. Keeping detailed records of ordinary users and restricting online expression also carries a privacy cost. People need private access to information for reasons that have nothing to do with cryptocurrency. A broad assessment of Vietnam's rules should consider those readers as well as traders.
Different restrictions call for different explanations. Our coverage of Discord's video restriction in Brazil separates a platform feature suspension from a network block. Our AmneziaWG analysis examines attempts to make VPN traffic harder to classify. Neither case establishes what works on a Vietnamese connection today.
What changes when you use a VPN
A VPN encrypts traffic between a device and the VPN server. For traffic carried inside a working tunnel, the ISP sees a connection to that server instead of the individual destinations reached through it. The ISP can still observe the server address, timing and traffic volume, and knows which subscriber it connects. That distinction is central to EFF's guidance on choosing a VPN.
| Record or observer | Effect of a working VPN tunnel | What remains exposed |
|---|---|---|
| Local network and ISP | Inner destinations and traffic are carried in an encrypted tunnel. | Subscriber identity, VPN server address, connection times and traffic volume. |
| VPN provider | The provider forwards traffic and takes on much of the network visibility. | Source IP and connection metadata; destination IPs and potentially DNS. HTTPS still protects content. |
| Website or exchange account | The service normally sees the VPN exit IP. | Login identity, cookies, submitted documents and the service's transaction records. |
| Bank and public ledger | A different network route does not remove existing records. | Bank records and, for Bitcoin, publicly recorded transactions. |
| Phone or computer | Traffic protection applies while it travels through the tunnel. | Local files, app access and information exposed by a compromised device. |
The provider's own systems and retention policy now matter. A no-logs claim describes what it records, rather than proving that the gateway cannot observe traffic while forwarding it. Our explanation of what a VPN provider can see covers that distinction, including the protection HTTPS continues to supply through the VPN connection.
For crypto users, the records outside the tunnel are particularly relevant. Bitcoin's privacy guidance explains that transactions are public and traceable. An exchange may also associate an account with identification documents or bank transfers. A different exit IP does not erase those links. Other crypto systems have different designs, so Bitcoin's properties should not be assumed for every asset.
Practical privacy checks
Choose a provider whose ownership, logging policy and technical assessments you can inspect. Check whether an audit covers the service and apps you would actually use, and what period it examined. An audit is evidence with a scope, rather than a permanent guarantee. Our protocol transparency research explains why public implementation details and independent assessments answer different questions.
Install from the provider's official distribution channel and keep the app and device updated. Understand the app's kill switch and any split-tunnelling exclusions: excluded traffic does not get the tunnel's protection. Check IP and DNS behaviour after connecting and after changing networks. A successful check on one connection says little about whether another ISP will block the service tomorrow.
Keep HTTPS enabled and protect important accounts with strong authentication. Treat requests to install certificates or grant unrelated device permissions cautiously. A VPN cannot repair a compromised device or make information you voluntarily give a service disappear.
Proton's own threat model acknowledges that VPN servers and protocols can be blocked and that cookies or browser fingerprinting can identify users. Obfuscation may help with some traffic filters, but it does not make connectivity certain. DoVPN has not conducted in-country connectivity tests for this article, so we cannot verify any provider's current reliability in Vietnam.
The next concrete crypto-market event to check is the first Ministry of Finance licence: that event determines the transition timetable in Resolution 05. For the signup story, a published baseline and dated endpoint would make Proton's figure easier to assess. Meanwhile, the privacy distinction is already clear: protecting network transit leaves subscriber, account and transaction records to consider separately.
Sources and scope
Sources were checked on September 5, 2026. Legal descriptions above summarize the Vietnamese originals; the cited signed decrees and resolution control the wording. Licensing status is attributed to the September 3 report. The signup statistic comes from Peterson's post and its chart, not an independent DoVPN measurement.
- Signed Decree 284, especially Articles 4 and 9; Resolution 05, Article 7(2).
- Signed Decree 333, Article 16 and Articles 21 to 23; government explanation of service-provider duties.
- VNA/VLLF on the licensed-market transition, September 3, 2026.
- Peterson's September 5 post, its daily signup chart and the Proton Observatory.
- OONI's 2025 Telegram measurements and Freedom House's 2025 Vietnam report.
- EFF's VPN guidance, Proton's threat model and Bitcoin's privacy guidance.
Vietnam's internet rules and VPNs: FAQ
No. Decree 284 establishes administrative sanctions within a regulated crypto-asset market. Resolution 05 ties the domestic requirement to trade through licensed providers to six months after the first provider receives a licence. Criminal liability can still arise under applicable law depending on the conduct.
The Proton-branded chart shared by David Peterson on September 5 measures daily Proton VPN registrations from Vietnam relative to a baseline. It reaches about 450% above that baseline. The post and chart do not disclose the baseline calculation or absolute signup counts, so this is an attributed provider statistic, not a measurement of nationwide VPN use.
No. The ISP still supplies the connection and can associate it with a subscriber. A working VPN can hide the destinations carried inside its tunnel from the ISP, while leaving the VPN server address, connection times and traffic volume observable.
No. A VPN changes the network route and the IP address seen by a service. It does not remove exchange identity checks, account records or bank records. Bitcoin transactions also remain on a public ledger. Network privacy does not change whether a transaction complies with local law.
