US VPNs: borderless tax bills

1. Market context

Market size

Consumer VPN app revenue reached US$5.9 billion in 2024, up 15.6% on 2023, from around 147 million users worldwide.¹ US-based providers generate around US$3.6 billion a year.² Headline figures of US$58.6 billion to US$89 billion describe the total VPN market including enterprise networking and should not be used to benchmark a consumer subscription business.³ Growth is increasingly driven by regulation. UK daily VPN use more than doubled to over 1.4 million after age checks under the Online Safety Act began in July 2025.⁴ Demand spikes of this kind can create a new customer base in a country almost overnight and the tax obligation arrives with it.

Key export markets

US exports of services reached US$1,234.9 billion in 2025, up US$82.1 billion on 2024, producing a services surplus of US$339.5 billion.⁵ For a US VPN provider the principal overseas consumer markets are typically the EU, the UK, Canada, Mexico and India. All five tax digital services supplied by non-resident businesses to consumers. The EU, the UK, Mexico and India apply no registration threshold, so tax is due from the first sale, while Canada applies a modest threshold. Mexico and India are also actively enforcing against unregistered foreign providers. No reliable split of consumer VPN revenue by country is published. Most providers can produce one from their own billing data and this is the starting point for any review.

2. Regulatory changes over the past 12 months

The most significant changes in the focus markets have come from Mexico, which has moved from periodic returns towards continuous oversight of foreign digital providers. Standard VAT rates in the EU have not changed for e-services in 2026, although two increases introduced in mid-2025 now affect full-year pricing. The UK, Canadian and Indian regimes for non-resident digital suppliers are broadly unchanged, with enforcement rather than legislation driving the risk.

Key dated changes

Enforcement trends

Tax authorities increasingly identify unregistered suppliers from third-party data. Since 1 January 2024, EU payment service providers have reported payees receiving more than 25 cross-border payments in a quarter to the CESOP database,⁸ a level a subscription business passes almost immediately. Mexico now has real-time access to provider data and publishes a list of registered foreign providers.⁶ India brought all online services within its OIDAR rules from October 2023, regardless of the degree of human involvement, which widened the range of foreign suppliers required to register.¹⁰

3. Key issues in selling to overseas consumers

A US VPN provider selling direct to overseas consumers generally owes VAT or GST where the subscriber lives. Four issues account for most of the exposure: a wide registration footprint, weak evidence of customer location, the split between app-store and direct sales and historic exposure.

Registration triggers

Four of the five focus markets apply no threshold to non-resident suppliers, so tax is due from the first sale.⁹

Customer location evidence

VAT and GST on digital services are due where the consumer belongs. In the EU a non-EU supplier must hold two items of non-contradictory evidence, such as billing address, IP address, bank details or the SIM country code.¹¹ The simplified one-item rule applies only to EU-established suppliers. The UK, Canada, Mexico and India apply their own evidence rules. VPN providers face three specific problems:

• ●IP evidence is unreliable. A customer may already be connected through a VPN at checkout, so the IP address shows the server country rather than where the customer lives.
• ●Privacy-focused payments. Cryptocurrency and gift cards carry no bank country and some wallets do not provide a card-issuing country.
• ●No-logs commitments. EU OSS records must be kept for 10 years and Mexico requires real-time data access. A minimal data retention promise must be reconciled with these duties through joint tax and privacy legal review.

App store versus direct sales

Apple collects and remits tax on App Store sales in the regions listed in its developer agreement and states that developers are responsible elsewhere.¹² Google collects on Google Play billing in the countries it names but not on alternative billing. Direct web sales remain the provider’s responsibility in every market. Getting this split wrong leads to double taxation where platform-taxed revenue is also declared or to under-collection where direct sales are assumed to be covered.

Historic exposure

Many providers began selling internationally before reviewing their obligations. Tax not collected from past subscribers cannot be recovered from them and is funded from margin. Back tax, penalties and interest accrue by period and by country. Several authorities offer voluntary disclosure that reduces penalties where a business comes forward before being contacted, although the terms differ by country.

4. Implications for the CFO and finance team

For a US VPN provider, overseas indirect tax is a margin, cash and governance matter as much as a compliance one.

Financial risk

• ●Back taxes: VAT or GST not charged at checkout remains payable and cannot be recharged to past subscribers.
• ●Penalties and interest: These accrue per period and per country, so exposure grows with every month of unregistered sales.
• ●Margin pressure: Tax-inclusive pricing means each rate rise reduces margin until prices are updated.

Cash flow

• ●Payment timing: Monthly payments in Mexico and India and quarterly payments elsewhere, in multiple currencies with FX costs on each.
• ●Annual plans: Tax on multi-year subscriptions collected upfront must be paid in the correct period.
• ●One-way cash flow: Few input tax reclaims arise for a US provider, so tax paid is rarely offset.

Resource strain

A provider registered in the EU, the UK, Canada, Mexico and India faces around 40 returns a year, each with its own portal, deadlines and authority correspondence. Mexico’s legal representative requirement and real-time access obligation add third-party and systems cost.

Systems and data

• ●Location evidence: Checkout and renewal must capture and store two non-contradictory items where required.
• ●Tax calculation: Billing must apply the correct destination rate, including Canadian provincial rates.
• ●Reconciliation: Billing data, app-store tax reports and tax returns must agree by country and channel.

Governance

• ●Provisioning: Under US GAAP (ASC 450) a loss contingency is accrued when probable and reasonably estimable.
• ●Board reporting: Overseas indirect tax exposure should sit on the risk register with a named owner.
• ●Due diligence: Unresolved indirect tax exposure is a common finding in investor and acquirer due diligence and frequently leads to price reductions, escrows or indemnities.

Strategic decisions

• ●Channel mix: Moving customers from app stores to web checkout saves commission but takes on tax liability in every market.
• ●Market entry: Registration, representation and filing costs should form part of the business case for each new market.
• ●Build versus outsource: Compare the cost of in-house specialists and software with that of an outsourced compliance provider.

5. Checklist: five key considerations

These steps should be addressed in sequence, as each informs the next.

1. 1.Map your footprint by channel. Split subscription revenue by country and channel (App Store, Google Play, web and resellers) and test each direct-sales market against its threshold.
2. 2.Confirm registrations. Review non-Union OSS, UK, Canadian, Mexican and Indian registrations and close any gaps, including Canadian provincial registrations.
3. 3.Fix location evidence. Confirm that checkout captures two non-contradictory items where required, define a rule for crypto and gift-card sales and align retention with privacy commitments.
4. 4.Reconcile app-store and direct revenue. Exclude platform-taxed sales from your own returns and identify regions outside platform collection.
5. 5.Quantify past exposure and decide on resourcing. Estimate historic liabilities, choose disclosure routes before an authority makes contact, assign internal ownership and weigh in-house capacity against outsourced support.

6. Working with Tax Desk: CFO FAQs

Q1. We are a US company selling subscriptions online. How do we know where we must register?

Your obligations depend on where your subscribers are, how they buy and whether a platform collects the tax. Tax Desk carries out an obligations review that maps your sales by country and channel against VAT and GST thresholds. You receive a clear view of where you must register now, where you are approaching a threshold and where no action is needed.

Q2. Most of our sales go through Apple and Google. Do we still need to register?

Often yes. App stores collect tax on their own sales in the regions they cover, but your website sales and regions outside the platforms’ collection lists remain your responsibility. Our country experts review your app-store and direct sales together so nothing is missed.

Q3. Can the EU’s One Stop Shop cover all of our European sales?

For B2C digital services, the non-Union OSS lets a non-EU provider account for VAT in all 27 member states through one registration. It does not cover the UK, Canada, Mexico, India or other markets outside the EU, which have their own regimes. Tax Desk advises on the right combination of schemes and local registrations for your business model.

Q4. We have been selling overseas without registering. What is our exposure?

Our country experts calculate the tax due on past sales together with likely penalties and interest in each country. Many authorities offer voluntary disclosure programmes that reduce or waive penalties where a business comes forward before being contacted. We advise on the best approach for each country and manage the disclosure process and authority correspondence on your behalf.

Q5. How long does registration take and what do you need from us?

Timescales range from a few weeks to several months depending on the country. Mexico also requires a legal representative for non-resident providers. Tax Desk provides a clear document checklist, prepares and submits applications and tracks progress with each authority. Your dedicated account manager keeps you informed throughout so you know when you can begin charging tax correctly.

Q6. What happens once we are registered?

Tax Desk manages ongoing submissions, payments and audit support across VAT, GST and OSS in 90+ countries. Each client has a dedicated account manager as a single point of contact, supported by country experts in each jurisdiction who monitor thresholds and legislative changes and alert you when new registrations are needed as you grow.

Sources

1. 1.Business of Apps, VPN app revenue and usage statistics (updated 29 August 2025).
2. 2.IBISWorld, VPN providers in the US.
3. 3.Axis Intelligence, VPN statistics (reconciliation of five market estimates).
4. 4.Ofcom, Online Nation, reported by AOL/PA.
5. 5.US Bureau of Economic Analysis, US international trade in goods and services, December and annual 2025 (19 February 2026).
6. 6.KPMG US, Mexico: tax provisions for digital platforms in 2026 tax reform; Mexico: registered foreign digital service providers (February 2026).
7. 7.Tax Foundation, VAT rates in Europe.
8. 8.PwC Luxembourg, CESOP.
9. 9.VAT on digital services.
10. 10.Taxgarden, OIDAR GST compliance in India 2026: foreign digital services and GSTR-5A; Business Standard, New GST rules to tighten compliance for foreign digital service providers (September 2023).
11. 11.Council Implementing Regulation (EU) 282/2011, Article 24f.
12. 12.Apple, Exhibits to schedules 2 and 3.

Dates and thresholds in this briefing were checked on 30 October 2026. This briefing is general information and does not constitute tax or legal advice. Rules, rates and thresholds change frequently and the position for your business should be confirmed before acting.