{"id":992411,"date":"2026-11-03T16:02:14","date_gmt":"2026-11-03T16:02:14","guid":{"rendered":"https:\/\/www.taxdesk.com\/?p=992411"},"modified":"2026-11-03T16:16:23","modified_gmt":"2026-11-03T16:16:23","slug":"us-vpns-borderless-tax-bills","status":"publish","type":"post","link":"https:\/\/www.taxdesk.com\/de\/us-vpns-borderless-tax-bills\/","title":{"rendered":"US VPNs: borderless tax bills"},"content":{"rendered":"
\n
\n

1. Market context<\/h2>\n

Market size<\/h3>\n

Consumer VPN app revenue reached US$5.9 billion in 2024, up 15.6% on 2023, from around 147 million users worldwide.1<\/a><\/sup> US-based providers generate around US$3.6 billion a year.2<\/a><\/sup> Headline figures of US$58.6 billion to US$89 billion describe the total VPN market including enterprise networking and should not be used to benchmark a consumer subscription business.3<\/a><\/sup> Growth is increasingly driven by regulation. UK daily VPN use more than doubled to over 1.4 million after age checks under the Online Safety Act began in July 2025.4<\/a><\/sup> Demand spikes of this kind can create a new customer base in a country almost overnight and the tax obligation arrives with it.<\/p>\n

Key export markets<\/h3>\n

US exports of services reached US$1,234.9 billion in 2025, up US$82.1 billion on 2024, producing a services surplus of US$339.5 billion.5<\/a><\/sup> For a US VPN provider the principal overseas consumer markets are typically the EU, the UK, Canada, Mexico and India. All five tax digital services supplied by non-resident businesses to consumers. The EU, the UK, Mexico and India apply no registration threshold, so tax is due from the first sale, while Canada applies a modest threshold. Mexico and India are also actively enforcing against unregistered foreign providers. No reliable split of consumer VPN revenue by country is published. Most providers can produce one from their own billing data and this is the starting point for any review.<\/p>\n

2. Regulatory changes over the past 12 months<\/h2>\n

The most significant changes in the focus markets have come from Mexico, which has moved from periodic returns towards continuous oversight of foreign digital providers. Standard VAT rates in the EU have not changed for e-services in 2026, although two increases introduced in mid-2025 now affect full-year pricing. The UK, Canadian and Indian regimes for non-resident digital suppliers are broadly unchanged, with enforcement rather than legislation driving the risk.<\/p>\n

Key dated changes<\/h3>\n
\n\n\n\n\n\n\n\n\n\n
Date<\/th>\nChange<\/th>\nImplication for a US VPN provider<\/th>\n<\/tr>\n<\/thead>\n
1 Apr 2026<\/strong><\/td>\nMexico requires foreign digital service providers to give the tax authority real-time online access to Mexican transaction data6<\/a><\/sup><\/td>\nSystem changes needed; non-compliance can lead to suspension of internet access in Mexico<\/td>\n<\/tr>\n
30 Jan 2026<\/strong><\/td>\nMexico publishes its list of 272 registered foreign digital service providers6<\/a><\/sup><\/td>\nUnregistered providers selling to Mexican consumers are readily identifiable<\/td>\n<\/tr>\n
1 Jan 2026<\/strong><\/td>\nMexico extends VAT withholding by digital platforms, with 100% of the 16% VAT withheld where the seller has no Mexican tax ID6<\/a><\/sup><\/td>\nSales through Mexican intermediaries are taxed at source unless the provider is registered<\/td>\n<\/tr>\n
1 Aug 2025<\/strong><\/td>\nRomania increases its standard VAT rate from 19% to 21%7<\/a><\/sup><\/td>\nApplies to e-services declared through the non-Union OSS; tax-inclusive prices lose margin until repriced<\/td>\n<\/tr>\n
1 Jul 2025<\/strong><\/td>\nEstonia increases its standard VAT rate from 22% to 24%7<\/a><\/sup><\/td>\nAs above<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
\n

Risk flag<\/strong>   Mexico can block access to the services of foreign digital providers that are not registered or do not meet their obligations.6<\/a><\/sup> For a VPN business, loss of access in a market is a revenue risk as well as a tax one.<\/p>\n<\/div>\n

Enforcement trends<\/h3>\n

Tax authorities increasingly identify unregistered suppliers from third-party data. Since 1 January 2024, EU payment service providers have reported payees receiving more than 25 cross-border payments in a quarter to the CESOP database,8<\/a><\/sup> a level a subscription business passes almost immediately. Mexico now has real-time access to provider data and publishes a list of registered foreign providers.6<\/a><\/sup> India brought all online services within its OIDAR rules from October 2023, regardless of the degree of human involvement, which widened the range of foreign suppliers required to register.10<\/a><\/sup><\/p>\n

3. Key issues in selling to overseas consumers<\/h2>\n

A US VPN provider selling direct to overseas consumers generally owes VAT or GST where the subscriber lives. Four issues account for most of the exposure: a wide registration footprint, weak evidence of customer location, the split between app-store and direct sales and historic exposure.<\/p>\n

Registration triggers<\/h3>\n

Four of the five focus markets apply no threshold to non-resident suppliers, so tax is due from the first sale.9<\/a><\/sup><\/p>\n

\n\n\n\n\n\n\n\n\n\n
Market<\/th>\nThreshold for non-resident B2C digital services<\/th>\nRoute<\/th>\n<\/tr>\n<\/thead>\n
EU (27 member states)<\/strong><\/td>\nNone<\/td>\nNon-Union OSS: one registration and one quarterly return for all member states<\/td>\n<\/tr>\n
UK<\/strong><\/td>\nNone<\/td>\nDirect registration with HMRC<\/td>\n<\/tr>\n
Canada<\/strong><\/td>\nC$30,000 in 12 months<\/td>\nSimplified GST\/HST registration; Qu\u00e9bec QST and other provincial taxes may also apply<\/td>\n<\/tr>\n
Mexico<\/strong><\/td>\nNone<\/td>\nTax ID registration, legal representative, 16% VAT, monthly returns and real-time data access<\/td>\n<\/tr>\n
India<\/strong><\/td>\nNone<\/td>\nOIDAR registration, 18% IGST and monthly GSTR-5A returns10<\/a><\/sup><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
\n

Risk flag<\/strong>   Thresholds should be confirmed with each authority before relying on them. Canada’s threshold is tested over a rolling 12-month period, so a demand spike can cross it mid-year without the finance team being aware.<\/p>\n<\/div>\n

Customer location evidence<\/h3>\n

VAT and GST on digital services are due where the consumer belongs. In the EU a non-EU supplier must hold two items of non-contradictory evidence, such as billing address, IP address, bank details or the SIM country code.11<\/a><\/sup> The simplified one-item rule applies only to EU-established suppliers. The UK, Canada, Mexico and India apply their own evidence rules. VPN providers face three specific problems:<\/p>\n