ExpressVPN has become the first major VPN service provider to remove its servers from India, and has slammed the new directive by India’s Computer Emergency Response Team (CERT-In) in the process.
CERT-In, India’s top cybersecurity agency, last month issued the directive under which VPNs will have to keep customer names, validated physical and IP addresses, usage patterns and other forms of personally identifiable information. They may be asked to handover the data to the government, and face punitive action if they don’t comply.
The new VPN rule is set to come into effect on June 27, 2022.
ExpressVPN said that the law is “overreaching” and so broad as to open up the window for potential abuse. The company said that it refuses to participate in the Indian government’s attempts to limit internet freedom.
“The new data law initiated by CERT-In, intended to help fight cybercrime, is incompatible with the purpose of VPNs, which are designed to keep users’ online activity private,” the service provider said in a blog post.
“We believe the damage done by potential misuse of this kind of law far outweighs any benefit that lawmakers claim would come from it,” it added.
ExpressVPN said that as a company “focused on protecting privacy and freedom of expression online”, it will continue to fight to keep users connected to the open and free internet with privacy and security, no matter where they are located.
Top VPN service providers such as Surfshark and NordVPN have also said they may not be able to comply with the directive to maintain the personal data of users for five years or longer.
ExpressVPN stated that it will never collect logs of user activity, including no logging of browsing history, traffic destination, data content, or DNS queries. “Essentially, we do not store or collect any data that could identify an individual and their online activity.”
While the company will no longer have local servers in the country, Indian users can still connect to “virtual” VPN servers in Singapore and the UK that will give them Indian IP addresses, allowing them to access the internet as if they were located in India. ExpressVPN said the difference in user experience would be “minimal”.