Can a Small VPN Provider Be Served an IPA Notice Without Logs?

Yes, a notice can be served; having no logs only changes what the notice finds. The Investigatory Powers Act 2016 (IPA) does not ask whether you keep records. It asks whether you are a "telecommunications operator", and a VPN service plausibly is, however small.

This is general information, not legal advice. Where I am giving my own reading rather than the text of the Act, I say so.

Why a VPN counts as an operator at all

The definition lives in section 261 of the IPA. A telecommunications operator is a person who offers or provides a telecommunications service to persons in the UK, or who controls or provides a telecommunications system located in or controlled from the UK. That is the legislation. Nothing in it sets a minimum size or turnover.

A VPN carries your traffic between you and the wider internet. My reading is that this is an ordinary telecommunications service, much as a mail server was in the earlier post on one-person mail servers. A court has not told us otherwise for VPNs specifically, so treat it as likely rather than settled.

What a notice can actually ask for

Three tools matter here, and they behave differently:

• A data retention notice (Part 4): the Secretary of State can require an operator to retain specified communications data, for up to 12 months, with Judicial Commissioner approval.
• Communications data acquisition (Part 3): a public authority with the right authorisation asks for data the operator holds or can obtain.
• A technical capability notice (Part 9): the operator must keep or build the ability to give effect to warrants and authorisations.

Retention and capability notices are the ones that bite a "no logs" provider, because they look forwards.

The surprise: a notice can create the logs

A no-logs policy describes what you do today. A retention notice can require you to start keeping data from the date it takes effect. Having nothing to disclose is therefore not the same as being immune from a notice.

That does not mean any provider gets any notice. The Act requires necessity and proportionality, an independent approval step, and a review process if the operator objects. A tiny provider with a handful of users is a hard case to call necessary and proportionate, in my opinion, but that is a judgement call for the Secretary of State and the Judicial Commissioner, not a loophole.

Notices also tend to come with confidentiality obligations. So "we have never received a notice" is a statement a provider may be unable to keep making honestly. That is why some publish a warrant canary, though how far a canary protects you legally is untested as far as I know.

Quick detour: your kernel remembers the peer

Hang on, why does "no logs" so often turn out to be "no log files"? Because state lives in memory too. If you run WireGuard, the kernel tracks each peer's last known endpoint and handshake time:

sudo wg show wg0 latest-handshakes
sudo wg show wg0 endpoints

The second command prints the public IP and port each peer last connected from. Nothing is written to disk, yet an operator under a lawful requirement could read it live. It disappears on reboot or interface teardown, which is exactly the kind of detail a privacy policy should state plainly.

What a genuinely log-light server holds

Even a careful provider usually still has some communications data:

• Payment records and the account email address.
• Signup time and often the signup IP address.
• Whatever is needed to enforce a device limit, such as a count of live sessions.
• The in-memory peer table above.
• Records held by upstream hosting, which is itself likely to be an operator.

Under Part 3, an authorisation reaches what exists. A request for connection records on a provider that keeps none gets a short, honest answer. Payment and account data is another matter, and it often identifies the person more reliably than any traffic log would.

Where the size of the provider does matter

Practical enforcement is the real variable. The Act has provisions for serving notices on operators outside the UK, and for enforcement through civil proceedings. How that plays out against a small overseas provider with no UK presence is a question of jurisdiction and practicality, not something the statute resolves on its own.

The Act also lets the Home Office take into account whether complying is technically feasible, and an operator can seek a review. A one-person service may argue it cannot reasonably comply with a demanding notice. That is an argument, not a guarantee.

What I would do as a small operator

1. Write down what you do and do not hold, including memory state, so your policy is true.
2. Collect as little at signup as you can, since account data is what survives.
3. Know your hosting provider's own retention.
4. Decide in advance who handles a notice, and take legal advice on the day it arrives.

A log-free design genuinely reduces what can be handed over. It just does not remove the legal duty to be ready for the request.