14 Eyes Countries: Five, Nine and Fourteen Eyes Explained

The Fourteen Eyes are the United States, the United Kingdom, Canada, Australia, New Zealand, Denmark, France, the Netherlands, Norway, Germany, Belgium, Italy, Spain and Sweden. Their spy agencies share the communications they intercept. The first five form the Five Eyes and the first nine the Nine Eyes. They matter for VPN users, but less than VPN marketing suggests.

The three circles and where the lists come from

Five Eyes. The alliance rests on the UKUSA Agreement, signed on 5 March 1946. According to GCHQ’s own history, it was signed by the United Kingdom’s London Signals Intelligence Board and the US State-Army-Navy Communications Intelligence Board. GCHQ is the UK agency that intercepts communications, which is called signals intelligence. Canada joined in 1949, and Australia and New Zealand in 1956. Together they formed what GCHQ calls the 5 Eyes alliance.

People knew about the agreement from the 1980s, but it was not officially acknowledged until 2010. That year, files describing it were released to the UK National Archives. A 2013 study for the European Parliament’s civil liberties committee describes how the network grew. It started with the 1946 agreement and over time took in privileged partners. The study names Sweden and Israel. Sweden gives the Five Eyes access to internet cables from the Baltic states and Russia.

Nine Eyes. The wider circles are not described in any published treaty. They became public through documents leaked by Edward Snowden. The Guardian reported them on 2 November 2013, in a piece by Ewen MacAskill and James Ball. The piece describes the 9-Eyes as adding Denmark, France, the Netherlands and Norway. Intelligence-sharing with them is more restricted than within the Five Eyes. The piece also quotes GCHQ minutes noting that the Germans were a little grumpy at not being invited to join the 9-Eyes group.

Fourteen Eyes. The same reporting lists the 14-Eyes as adding Germany, Belgium, Italy, Spain and Sweden to the nine. The group has a formal name, SIGINT Seniors Europe, or SSEUR. SIGINT is short for signals intelligence. The Intercept published documents about the group on 1 March 2018, in a report by Ryan Gallagher. According to those documents:

• The group was formed in 1982 with nine members focused on the Soviet military.
• It grew to fourteen after September 2001 and turned to counterterrorism.
• As of April 2013, it consisted of the Five Eyes agencies plus those of Belgium, Denmark, France, Germany, Italy, the Netherlands, Norway, Spain and Sweden.

The report says the NSA sometimes calls it the 14 Eyes. The NSA is the US signals-intelligence agency. The Guardian also mentions a 41-Eyes grouping covering the coalition in Afghanistan. VPN marketing does not mention that group.

What the alliances do

They share signals intelligence. That means intercepted communications and the metadata around them, such as who contacted whom and when. Each member’s agency collects it. They exchange it under arrangements that are closest among the five and looser further out.

The European Parliament study examined the UK, Sweden, France, Germany and the Netherlands. It found that four of the five ran some form of large-scale interception and surveillance of communications data. In practice, this matters for anyone whose traffic crosses those countries. An agency there may collect it and may share it with partners. The what is a VPN page explains what a VPN hides from that kind of collection. The VPN vs Tor page explains what it does not hide.

What membership means for a VPN, and what it does not

It is not a law about VPNs. No published text of the UKUSA Agreement or of the SSEUR arrangements requires a private company to log its customers or to hand over data. Each country’s laws and courts decide whether a provider must keep data, and how it can be forced to hand it over. The tools include data-retention rules, warrants, subpoenas and production orders. A subpoena or production order is a legal demand to hand over records. The alliance tells you which agencies share intelligence. It tells you nothing about what a VPN company in that country is required to keep.

The record cuts across the tiers. Our provider data holds the cases where this was tested:

• Sweden, a Fourteen Eyes member. Police searched Mullvad’s Gothenburg office in April 2023 with a warrant to seize customer data. They left with nothing, because none existed.
• The United States, a Five Eyes member. Private Internet Access could give the FBI only the name of a server cluster in 2016. In a 2018 federal trial, it testified that it keeps no activity logs. In the same country, IPVanish under a previous owner handed a subscriber’s details and connection times to US authorities in 2016, because it had them.
• Canada, another Five Eyes member. Windscribe says it had no user data to hand over in a case a Greek court dismissed in 2025. In February 2026, one of its servers was seized in the Netherlands, a Nine Eyes member. That server held no logs.

In each case, what mattered was what the company kept, not where it was based.

Being outside the alliances is not immunity. NordVPN operates under Panamanian law. In October 2024 it received a binding warrant from the Panamanian prosecutor. The warrant required it to provide the user data it held in a criminal case.

Proton VPN’s operator is Proton AG in Switzerland. In September 2021, a binding Swiss order required it to log and disclose the IP address of a climate activist’s Proton Mail account. In 2024 it gave Spanish police the recovery email of a Proton Mail account, through Swiss authorities. Proton says Swiss law cannot force its VPN to log in the same way. Neither Panama nor Switzerland is in any of the three circles. Both still have legal ways to make a company hand over data.

Owners and staff count too. NordVPN operates under Panamanian law, but its parent company, Nord Security, is based in the Netherlands. The Netherlands is a Nine Eyes member, and NordVPN’s sister brand Surfshark is incorporated there. ExpressVPN, CyberGhost and Private Internet Access all belong to Kape Technologies. IPVanish is owned by Ziff Davis, a US company. Where the engineers, the parent company and the payment processor are based can matter as much as where the company is registered. That is why our no-logs explainer spends more time on what a company keeps than on where it is registered.

Where twelve VPN providers sit (verified 31 October 2026)

Two entries need a note. The British Virgin Islands and Gibraltar are British Overseas Territories with their own lawmakers and courts. Our data records them as outside the alliances, because the UKUSA parties are national governments. Readers who weigh the UK connection differently can do so.

PrivadoVPN’s marketing pages still describe it as Swiss-based. But its terms and privacy policy have named an Icelandic company as the service provider since 1 May 2026. The reviews hub links each provider’s full identity record. Our laws hub tracks the national rules that actually bind them.

Why jurisdiction is one factor among several

Our methodology scores jurisdiction as part of privacy. Jurisdiction is the country whose laws a provider must follow. The most points go to providers outside all three circles. Fourteen Eyes members get fewer, Nine Eyes members fewer still, and Five Eyes members the fewest.

Jurisdiction sits next to other privacy factors, and those often count for more:

• The age of the newest no-logs audit.
• RAM-only servers, which keep no data after a restart.
• A written policy.
• Anonymous payment.
• The incident record.

That is why a US company and a Swedish company both appear on our best VPNs for privacy list. The US company has two court tests behind it. The Swedish company passed a police search. Providers in friendlier countries with no audit do not appear.

If your threat is a national agency with partners, the circle matters. If your threat is a subpoena or a seized server, what the company keeps matters more. The Mullvad vs Proton VPN comparison is a worked example of a Fourteen Eyes provider set against a non-member.

Related

• What a no-logs policy really covers
• Double VPN explained
• VPN vs Tor
• What is a VPN?
• Best VPNs for privacy
• VPN laws by country
• How we score privacy and jurisdiction