The Hidden Cost of Going Global: Indirect Tax and the B2C VPN Market

VPN subscriptions sold to consumers in Frankfurt by non-EU companies create a German VAT obligation. Sales to subscribers in Sydney create an Australian GST obligation above threshold. Neither requires a physical presence. Both require action.

The consumer VPN market is entering a period of structural expansion. Privacy regulation is proliferating, public awareness of data security is at a historical high, and smartphone-first internet access is unlocking subscriber growth in markets that barely registered on vendor roadmaps five years ago. For finance and tax teams inside VPN businesses, that growth comes with an obligation that scales directly with revenue: indirect tax compliance. Every subscription sold outside a vendor’s home jurisdiction creates a potential VAT, GST or digital services tax liability in the consumer’s country, and in most cases there is no registration threshold and no de minimis. The obligation exists from the first sale.

A market growing faster than it looks

The global B2C VPN market was valued at approximately $1.01bn in 2024, and is projected to grow at a 13.1% CAGR through 2035 to reach an estimated $2.7bn, with 1.8 billion global monthly VPN users already in 2024. That figure captures direct subscription revenue only; once enterprise and B2B deployments are included, some forecasts put the total VPN market at $69.8bn in 2025. The B2C segment is the faster-growing piece within that broader market, and it’s driven by dynamics quite different from the corporate world:

• Privacy as a primary growth engine. Roughly 33% of all internet users globally now use a VPN at least occasionally, with daily or near-daily use reported by around 35% of subscribers, driven by growing awareness of surveillance by governments, ISPs and data brokers.
• Streaming and content access. Geo-restricted content remains a major acquisition driver, especially in markets like India, Indonesia and parts of Latin America where major streaming catalogues carry real gaps. This use case brings higher churn, since subscribers who join to unblock one title are less sticky than privacy-motivated buyers.
• Cybersecurity incident correlation. Major publicised data breaches reliably produce subscription spikes. When 147 million Americans had personal data exposed in a single incident, VPN search volume and conversion both rose in the following weeks.
• Corporate familiarity spillover. Office workers mandated to use corporate VPNs during the pandemic normalised the technology, and a meaningful share of that cohort, particularly Millennial and Gen X professionals in North America and Western Europe, has since converted to personal subscriptions.
• 5G and mobile-native growth. 5G rollout across Asia-Pacific, the Middle East and Latin America is bringing in users with no prior desktop browsing habits at all. Mobile VPNs are now the fastest-growing product segment, at a projected 11% CAGR, and they’re generating revenue in jurisdictions that already have digital services tax obligations in force.

Devices shape both economics and tax exposure

Around 62% of all VPN downloads in 2024 were on mobile devices, up from 51% in 2022; in Asia-Pacific alone, mobile VPN app downloads grew 54% year-on-year to reach 372 million in 2023. Mobile is now the primary acquisition channel globally, but it comes with a structural pricing constraint: subscriptions transacted through the Apple App Store or Google Play carry platform fees of 15–30%, and marketplace facilitator rules in some jurisdictions place the VAT obligation on the platform rather than the vendor, adding a reconciliation layer that requires careful handling.

Tablets, while a shrinking share of the subscriber base overall, remain significant among older cohorts and household plans, correlating with higher-tier, unlimited-device subscriptions. And the industry-wide shift toward multi-device and household licences drives average order value up, but complicates something that matters a great deal for tax: determining where a service is actually consumed when one licence covers devices in multiple countries.

On pricing, annual plans typically range from $40 to $100 at the premium end. In the US, 51% of VPN users pay for their service, a notably high conversion rate compared with more price-sensitive emerging markets. Free subscriptions generally don’t trigger VAT, but trial periods that auto-convert to paid plans need careful VAT treatment from the date of first charge.

Where the growth, and the tax complexity, is concentrated

North America generates around 37% of global VPN revenue, led by the US market (valued at $265m in 2024, projected to reach $1bn by 2035), where 42% of internet users are VPN adopters against a 23% global average, and growth is increasingly privacy-driven as US federal and state privacy legislation advances.

Western Europe combines GDPR-driven privacy consciousness with relatively high ARPU. Germany is set to become the largest single European market at an estimated $290m by 2035, and the region is also the most complex indirect tax environment globally for digital service providers, with VAT rates ranging from 17% in Luxembourg to 27% in Hungary.

Asia-Pacific is the fastest-growing region at a projected 19.4% CAGR through 2030, splitting into developed markets (Australia, Japan, South Korea, Singapore) with established digital services tax regimes, and emerging markets (India, Indonesia, Vietnam, the Philippines) driving high volume at lower price points. India’s VPN adoption has reached 43–45% of internet users, all within scope of India’s 18% GST on digital services.

The Middle East combines high adoption with regulatory complexity: roughly 42% of UAE internet users accessed a VPN in Q3 2024, with government-imposed restrictions in several countries actually driving demand. The UAE and Saudi Arabia are the primary revenue markets, both with VAT frameworks that apply to digital services.

Latin America holds around 8% of global share and is growing quickly, led by Brazil at a projected 16% CAGR through 2034, though Brazil’s indirect tax landscape is among the most complex in the world. Central and Eastern Europe shows strong privacy awareness rooted in historical experience of state surveillance; EU member states in the region fall under the OSS framework, while non-EU markets like Ukraine and CIS states have their own evolving rules.

Who’s actually subscribing

The core subscriber base skews young: 35% of users fall in the 16–24 age bracket and 33% in 25–34, making Millennials and Gen Z roughly 68% of the global subscriber base, mobile-native and comfortable with subscription payments. Five buyer archetypes cover most of the market:

• Privacy advocates — ideologically motivated, low churn, brand loyal, concentrated in Germany, the Netherlands, Switzerland and the Nordics.
• Streaming unlockers — utility-driven, high churn, highly price-sensitive, the largest single use case by volume in South and South-East Asia.
• Security pragmatists — driven by practical risk on public Wi-Fi and travel networks, strongly represented among business travellers, higher ARPU through multi-device and annual plans.
• Casual travellers — episodic subscribers with seasonal demand around summer and business travel, prone to repeated subscribe-and-cancel cycles.
• Technically proficient users — protocol-aware, comparison-shop on technical merit, hardest to retain at premium pricing.

Selling internationally brings more than a tax question

App store dependency reduces payment friction but imposes 15–30% platform fees and creates ambiguity over who holds the VAT obligation, the app store or the vendor, depending on the jurisdiction’s marketplace facilitator rules. Direct web sales preserve margin and give vendors control over the billing data needed for tax compliance, and local payment methods matter enormously in emerging markets, from UPI in India to PIX in Brazil.

Consumer rights add another layer: EU consumers get a 14-day cooling-off right on digital subscriptions, and the UK’s Consumer Rights Act imposes equivalent protections, both independent of VAT compliance. And in markets where VPN use sits in a legal grey area, such as Russia, China, Turkey, Belarus and Iran, vendors must navigate sanctions compliance and geofencing decisions alongside the reputational risk of operating there at all.

The tax rules underneath it all

Over 100 jurisdictions now impose VAT, GST or digital services tax on non-resident providers of electronically supplied services. For B2C VPN vendors, the question isn’t whether obligations exist, it’s which ones apply and whether they’re being met.

VPN subscriptions qualify as electronically supplied services under virtually every major tax regime, meaning the place of supply is set by the consumer’s location, not the vendor’s. A VPN vendor headquartered in the British Virgin Islands selling to consumers in France, Germany, Australia and Canada has VAT and GST obligations in each country, regardless of where it’s based.

In the EU, VAT rates range from 17% in Luxembourg to 27% in Hungary, applied at the rate of the consumer’s own member state. The One Stop Shop (OSS) scheme lets non-EU vendors register once and file a single quarterly return covering all B2C digital sales across the bloc, but registration is required from the very first sale, a threshold most VPN businesses of any scale cross quickly.

In the UK, VAT is a fully separate obligation since Brexit, with no joint compliance mechanism alongside EU OSS. Non-established vendors must register separately from the first taxable supply, at a standard rate of 20%, filing quarterly to HMRC.

GST across Asia-Pacific varies significantly by market:

In the US, there’s no federal digital services tax, but more than 30 states impose sales tax on SaaS or digital subscriptions. Post-Wayfair economic nexus rules mean a vendor crossing a state’s revenue or transaction threshold, typically $100,000 or 200 transactions, acquires a filing obligation with no physical presence required. Taxability is inconsistent between states, and marketplace facilitator rules reduce but don’t eliminate vendor obligations, particularly for direct web sales.

Where compliance most often breaks down

• Failure to register in jurisdictions where thresholds have already been crossed, usually because compliance hasn’t kept pace with subscriber growth.
• Incorrect customer location determination. VPN users mask their own IP addresses by design, which complicates the two-piece, non-contradictory evidence of residence that EU rules require; payment card country and billing address are valid evidence, IP address alone is not.
• Trial period VAT treatment, since the applicable rate is set by the subscriber’s location at first charge, not at trial sign-up.
• Refunds and cancellations, where EU cooling-off rights drive meaningful cancellation volumes, and incorrect VAT treatment on refunds creates reconciliation errors in OSS returns.
• Historical exposure, where vendors who discover past non-compliance face the question of how to handle years of unpaid VAT, typically manageable through voluntary disclosure but requiring specialist handling.

How Tax Desk supports VPN providers

Tax Desk provides specialist indirect tax compliance for digital subscription businesses, including VPN providers, across more than 60 jurisdictions, covering the full lifecycle from registration through to audit support:

• Registration across EU Non-Union OSS, UK VAT for non-established suppliers, IOSS where mixed goods-and-services models apply, GST across Australia, New Zealand, Singapore, Japan, South Korea, Malaysia and India, and US sales tax registration with continuous nexus monitoring as subscriber volumes grow.
• Return preparation and submission, including a single quarterly EU OSS return across all 27 member states, separate UK VAT filing to HMRC, and multi-state US returns, with reconciliation against app-store-remitted sales tax to identify any residual vendor obligations.
• Payment processing across every registered jurisdiction, managing multi-currency requirements and correct exchange rate methodology to reduce late or underpaid penalty risk.
• Audit support, including preparation of the customer location evidence required under EU rules and representation during tax authority enquiries, plus support with voluntary disclosure and historical exposure analysis for vendors with legacy compliance gaps.

From EU OSS to US state-level sales tax, from APAC GST to UK VAT, Tax Desk manages the indirect tax obligations that come with selling VPN subscriptions to consumers globally. Get in touch to talk through your compliance position across the markets you operate in.

This report has been prepared by Tax Desk for general information purposes and does not constitute tax or legal advice. All market data is sourced from publicly available third-party research and should be independently verified. VAT, GST and sales tax rules change frequently; Tax Desk recommends a specific compliance review before making registration or filing decisions.