Is Tor legal in Germany? What the law says

As of November 2026, using Tor is legal in Germany. Bavaria’s interior ministry told the state parliament in 2018 that using anonymisation and encryption technology does not, on its own, suggest that someone is a security risk.^[1] What German law targets is crime committed over Tor, including running a platform built for it.^[2]

So if you’re asking “Ist Tor legal?”, the answer is yes. Germany also matters more to the Tor network than almost any other country. Below: how much of the network it hosts, what its “darknet” law covers, how courts have treated relay operators, and what a 2024 police case revealed. For how Tor works, start with What is Tor Browser?

How much of the Tor network is in Germany?

A large share. Relays are the volunteer-run servers that carry Tor traffic, and as of November 2026 Tor Metrics lists nearly 1,700 running relays in Germany, out of about 9,400 worldwide. Only the US, with about 3,200, has more.^[3]

German relays carry more weight than their number suggests. They hold about 27% of the network’s consensus weight, the figure Tor uses to decide how often each relay is picked, which is more than any other country. There’s roughly a one-in-four chance that a Tor connection’s entry relay is in Germany, and about the same for its exit relay, the last hop whose address websites see. Only the Netherlands has more exit capacity, at about 31%.^[3]

What does Germany’s “darknet” law, § 127, cover?

It began with a 2019 proposal from the Bundesrat, the chamber that represents Germany’s states, which would have covered only online services that were hard to reach because of special technical measures, such as sites on the darknet.^[4] Critics pushed back. A spokesperson for the Chaos Computer Club, a hacker association, called its clauses vague and aimed at criminalising the people who run and use anonymisation services, and the news site netzpolitik.org warned that, at worst, running Tor servers could become illegal.^[5]

The federal government’s 2021 bill took a different route. It chose not to limit the offence to hard-to-reach parts of the internet, noting that they have many lawful and desirable uses as well as being an ideal setting for criminal markets, and that illegal markets exist on the open web too. It added that a platform’s location on the darknet or deep web could be one indicator of a criminal purpose.^[4]

That approach is now § 127 of the Criminal Code (Strafgesetzbuch). It makes it a crime to run a trading platform on the internet, whether openly accessible or not, whose purpose is aimed at enabling or promoting listed crimes. The basic penalty is up to five years in prison, and more for commercial or gang operations.^[2]

Can Tor relay operators be held liable in Germany?

Germany’s Federal Court of Justice (BGH) ruled on a case involving one in 2018. A man ran public Wi-Fi hotspots and two Tor exit relays, and a computer game had been shared illegally through his connection. The court held that under the Telemedia Act, as amended in October 2017, he could no longer be ordered to stop, or made to pay damages, over what users did.^[6]

It wasn’t a complete win. A rights holder could still ask for blocking measures, if there was no other way to stop the infringement and the blocking was reasonable and proportionate, and the court sent that question back to a lower court. He also had to pay the cost of an earlier warning letter, which fell under the old rules.^[6]

For Germany today, the Tor Project’s guidelines for exit operators point to section 7 of the Digitale-Dienste-Gesetz (DDG) and Article 4 of the EU’s Digital Services Act.^[7] The DDG has been in force since 14 May 2024. Its section 7 says that a provider that isn’t liable under Article 4 can’t be made to pay damages, or ordered to remove or stop something, over a user’s unlawful act, unless it deliberately works with that user.^[8]

Operators still deal with the police. Digitalcourage, a German group that runs more than 30 exit relays, says house searches of operators still happen now and then, for example when file-sharing has been traced to an exit relay’s address. It calls them pointless, because its relays don’t store users’ IP addresses.^[9] The Tor Project’s guidelines add that German police regularly use the phone and fax numbers listed in IP address records, and suggest registering abuse contacts there.^[7]

A middle relay, which passes traffic between other relays, is a smaller commitment. Digitalcourage says one can run at home, for example on an old laptop, while exit relays should have dedicated hardware in a data centre. Finding a host can be hard: in 2016, when it wrote to almost every German Linux hosting company, only one agreed to host an exit.^[9]

How did German police identify a Tor user?

In September 2024, Panorama and STRG_F, programmes from the public broadcaster NDR, reported that the Federal Criminal Police Office (BKA) and the Public Prosecutor General’s Office in Frankfurt had identified at least one Tor user through “timing analysis”: tracing an anonymised connection back to its user by timing individual data packets. According to the reports, investigators also obtained data from the mobile operator Telefónica on O2 customers who had connected to a known Tor relay.^[10]

The case concerned Boystown, a dark-web platform for child sexual abuse material. Its suspected operator was arrested in North Rhine-Westphalia and convicted in 2022. The Chaos Computer Club said the evidence strongly suggested that police had used timing analysis against Tor users repeatedly, over several years.^[10]

The Tor Project disputed that its network had been broken. It said it believed the user was caught because they ran an outdated version of Ricochet, a chat app that worked over Tor, without protections against this kind of attack; a maintained version, Ricochet-Refresh, has since added them.^[10] For what this means for everyday browsing, see our guide to Tor Browser.

What stays illegal in Germany?

Anything that’s illegal offline. The crimes listed in § 127 include drug, weapons and explosives offences, child sexual abuse material, fraud, computer crime, data espionage and money laundering, among others; running a platform built to enable them is an offence in itself.^[2] Using Tor doesn’t make any of them legal, and the Boystown case shows that investigators can still find people who use Tor to commit them.

Laws differ from country to country. Compare whether Tor is legal in the UK and in the US, or see our country-by-country guide. If you’ll use Tor on a phone, start with Tor on iPhone and Android.