Recently, the Indian Computer Emergency Response Team (CERT-In) issued directions under Section 70B of the Information Technology Act, 2000. One of the contentious directions is that virtual private network (VPN) service providers would be required to register and maintain information about their customers for a period of five years or more. The information includes validated names of customers hiring VPN services, internet protocol (IP) addresses allotted to or being used, the email addresses, IP addresses and time stamp while registration, validated addresses and contact numbers, the period and purpose of hiring services, etc. These directions affect internet users’ privacy and anonymity.