Five Eyes, Nine Eyes, and 14 Eyes Explained: Why VPN Jurisdiction Matters in 2026
The surveillance alliances behind the acronyms, what they can actually see, and how to pick a VPN headquartered beyond their reach.
What the Five, Nine, and 14 Eyes actually are
The Five Eyes is an intelligence-sharing alliance between the United States, United Kingdom, Canada, Australia, and New Zealand, formalized after World War II under the UKUSA Agreement. Member agencies pool signals intelligence, which can include internet traffic and communications metadata. For VPN users, the practical takeaway is simple: data collected in one member country can end up in the hands of all five.
Nine Eyes extends the arrangement to Denmark, France, the Netherlands, and Norway, while 14 Eyes adds Germany, Belgium, Italy, Sweden, and Spain. The wider circles cooperate less tightly than the core five, but the direction of travel is identical: surveillance data crosses borders far more easily than most people assume, and formal treaties are only part of the picture.
Why this matters when you pick a VPN
A VPN provider is bound by the laws of the country where it is incorporated. If that country sits inside an intelligence alliance, the company can be served with data demands, gag orders, or retention requirements, and it may be legally barred from telling you any of it happened. That is why serious reviewers treat jurisdiction as a scoring factor rather than trivia, especially for journalists, activists, and anyone with a genuine threat model.
What jurisdiction changes, and what it does not
Jurisdiction determines what a government can compel, not what a provider actually stores. A VPN with genuine no-logs infrastructure has nothing meaningful to hand over, whatever letterhead the demand arrives on. Conversely, a provider registered in a supposedly safe country that quietly logs activity is worse than an audited service operating inside the Five Eyes.
So read jurisdiction as one layer of defense among several. A friendly legal home raises the cost of mass data demands and removes retention mandates, but it only works alongside verified no-logs claims, regular independent audits, and technical designs that minimize what exists to seize in the first place, such as servers that keep nothing on disk and apps anyone can inspect.
Two strong picks based outside the alliances
Proton VPN operates from Switzerland, which belongs to none of the Five, Nine, or 14 Eyes pacts and has strong constitutional privacy protections. Its apps are fully open-source, its no-logs policy is audited annually, and its Secure Core feature routes traffic through hardened data centers before it exits to the wider internet, blunting attempts to trace connections back to you.
ExpressVPN is incorporated in the British Virgin Islands, a jurisdiction with no data-retention laws and no membership in any intelligence pact. Its servers run entirely in RAM, so everything vanishes on reboot, and the company has published more than a dozen independent audits covering its apps, servers, and privacy claims.
The bottom line
Jurisdiction is a tiebreaker, not the whole game. Start with providers whose no-logs claims have survived repeated independent audits, then prefer the ones headquartered beyond the Five, Nine, and 14 Eyes. Proton VPN and ExpressVPN comfortably clear both bars, which is why they anchor our privacy recommendations for 2026 and why we rate them 9.1 and 9.5 out of 10 respectively.
Frequently asked questions
Is a VPN based in a Five Eyes country automatically unsafe?
What is the difference between the Nine Eyes and 14 Eyes?
Which VPN jurisdictions are considered most privacy-friendly?
Related reading
VPNsBest VPN for travel in 2026
Hotel wifi, foreign card machines, and banking apps abroad all get safer with the right VPN installed before departure.
VPNsBest VPN Deals in 2026: How VPN Pricing Really Works
VPN pricing is theater: sticker prices, countdown timers, and renewal jumps all follow a script you can use to your advantage.
VPNsIs Public Wi-Fi Safe in 2026? Real Risks and a Practical Checklist
HTTPS fixed the worst of public Wi-Fi, but fake hotspots and sloppy networks still catch people out; here is what actually helps.