The Great Firewall Is Winning, and Chinese VPN Users Are Running Out of Options

Key Takeaways

• Chinese law explicitly prohibits unauthorized VPN use, with fines of up to 15,000 yuan for individuals who only browse, with no exemptions for personal use, research, or AI tools. Penalties for distributors grow nearly tenfold, and serious enough cases may even come with imprisonment.
• Leaked surveillance data from 2023 shows that cross-border internet traffic from China's most monitored region averaged just over 4% of total traffic, with genuine VPN use estimated in the low single digits as a percentage of the population.
• The Great Firewall actively detects and blocks VPN traffic fingerprints, and police network audits can surface VPN records from years prior, meaning getting away with it is never as certain as it feels.
• State-approved VPNs exist and are tolerated for businesses, but they offer access at the explicit cost of privacy, with the government able to see exactly where traffic goes.

When Using a VPN Becomes a Criminal Matter

China's 2024 updated regulations on international internet connectivity leave very little room for interpretation. The law forbids any individual from establishing or using an unauthorized channel to connect internationally, with no carve-out for personal use, academic research, or even tools like ChatGPT or GitHub.

The penalty structure is tiered, and the floor is already uncomfortable. Individual browsing through an unauthorized VPN carries a fine of up to 15,000 yuan. Selling or distributing VPN tools can result in up to 15 days of detention and fines reaching 100,000 yuan. Cases deemed serious enough are referred for criminal prosecution under China's criminal code, carrying up to three years of imprisonment.

What makes this framework genuinely threatening is that enforcement is very much a real thing, and China Digital Times documented multiple verified cases. For example, one person was fined 15,000 yuan simply for watching content through a VPN, and another whose circumvention activity from 2020 was discovered during a routine network audit in 2024, despite four years having passed since, which shows that China will go after every straw it can get its hands on.

The same reflexive intolerance that got a comedian banned for a joke about being sick applies here, just with a fine attached and arguably on an even bigger scale. China does not require you to have done something dramatic to attract enforcement. Inconvenience is often more than enough.

The Firewall That Learned to Hunt

The legal threat is real, but it exists alongside a technical suppression system that has been getting better at its job for two decades. The Great Firewall does not just maintain a blocklist of foreign sites. It actively identifies and eliminates the tools people use to reach them.

VPNs are no longer available in Chinese app stores for ordinary users. Beijing forbids companies from offering unauthorized circumvention services domestically, and beyond that, it has spent years blocking the discoverability of circumvention tools themselves. Someone who has never left China has little chance of learning that a functional alternative even exists, which is just what the system intended.

For those who do find something, the Firewall's detection mechanisms are waiting. As ChinaFile's Locknet research documents, the system uses traffic fingerprinting and active probing to identify VPN connections, recognize their signatures, and block them. Even a VPN downloaded while abroad may stop working once a user returns to China, with the network identifying the traffic pattern and cutting it.

The consequence is visible in scale. Lantern, a major circumvention provider, served more than four million monthly users in China at the start of 2023. By early 2025, it had fewer than half a million. When a tool becomes widely used, it attracts attention and gets shut down. That dynamic has pushed circumvention further underground, toward word-of-mouth "airport" proxy services that charge monthly fees but expose both sellers and buyers to criminal liability.

And then there is the leaked data. Researchers reviewing documents from Geedge Networks, a Chinese surveillance company whose internal files were leaked to a global consortium, found detailed records of internet traffic flowing through Xinjiang's three major carriers in 2023. Cross-border traffic never reached 6% of total traffic across the reporting period, averaging just over 4%. Foreign apps tracked in the reports, most of them banned, accounted for less than 1% of even that foreign traffic slice.

The researchers estimate that genuine VPN usage in the region sits somewhere between 0.4% and a few percentage points of the population at most. Xinjiang is an extreme case given the severity of repression there, but the Firewall's technical blocking mechanisms operate the same way across China. The difference elsewhere is probably one of degree, not kind.

What makes the latent demand visible is a single anomaly in the data. Around the June 4, 2023 anniversary of the Tiananmen Massacre, WhatsApp usage spiked by orders of magnitude, briefly accounting for over two percent of all foreign traffic when a gap in the censorship system opened. It collapsed again quickly. But the speed and scale of that spike is the clearest possible evidence that the demand is there.

The reality is that the Firewall is not suppressing a population that doesn't want access. It is suppressing one that mostly can't find it and that understands the system well enough to know what happens when it does.

The Deal Beijing Is Actually Offering

There is a version of foreign internet access that Beijing permits, and it is worth understanding exactly what it is. State-approved VPNs, used by the businesses, are still a thing there. They allow employees to connect to blocked foreign services reliably, and that reliability is the point, because the government can see exactly where traffic goes. These tools offer access without privacy, and Beijing tolerates them precisely because the visibility they provide is more valuable than the inconvenience of blocking them entirely.

For everyone else, the offer is the domestic ecosystem. WeChat replaces messaging, Douyin replaces video, and Baidu replaces search. The substitution has been engineered deliberately, and the Geedge data makes its success measurable: the top five domestic apps drew twenty-five times more users than the top five foreign apps in the same traffic records and moved a thousand times more data.

The Firewall's success at achieving its goal is not purely technical. A system that blocks access is one thing. A system that blocks access, criminalizes the attempt, surfaces old records to prosecute people years later, and simultaneously floods the domestic environment with functional alternatives is something considerably more durable. When circumvention feels unnecessary, inaccessible, and dangerous at the same time, most people stop trying, and that is exactly the point.

What Happens When the Firewall Keeps Getting Better

The most uncomfortable part of the Geedge data is not what it shows about the present. It is what it implies about the trajectory. The crackdown on VPNs has moved in one direction, consistently, for over a decade. Major providers have shrunk. Black-market tools have been prosecuted. Detection has improved. Records that people assumed were forgotten are being retrieved in routine audits four years later.

I find it hard to look at that trajectory and conclude it will reverse on its own. The infrastructure is built, the legal framework is in place, and enforcement is far from symbolic. The WhatsApp spike around June 4 is the most honest data point in the whole report: the moment a crack opened, usage flooded through it, which is proof that the suppression is working against a population that still wants what it cannot reach.

The real question is not whether China's censorship system is effective. The Geedge data settles that. The question is what it costs every person who lives inside it and has learned, correctly, that curiosity has a price.

And yet, nothing is unbeatable, not even the Great Firewall. Its primary weapon against VPNs is traffic fingerprinting, which identifies the signature patterns of known VPN protocols and datacenter IP ranges. However, a virtual private network with residential IPs, functioning in a decentralized, peer-to-peer nature, like Mysterium VPN, has a structural advantage. Its traffic is routed through real residential nodes and looks like ordinary household traffic, not a tunnel from a commercial server, which makes it nearly impossible to detect.

In other words, I’m not really suggesting anything, but just so you know, Mysterium VPN goes for 78% off right now. So if you value your privacy and happen to be where downloading a VPN doesn’t break any laws just yet, it’s definitely something worth looking into.