What Five and Fourteen Eyes Actually Mean

If you have read more than one VPN comparison you have met the phrase "Five Eyes" or "Fourteen Eyes", almost certainly without being told what it is. It gets used as a warning label, which is roughly the right instinct and completely the wrong amount of detail. Here is the whole thing, and then the part that matters: how much it should actually change what you buy.

The alliances, in plain terms

Governments spy on communications, and some of them have agreed to share what they collect with each other. The oldest and closest of those arrangements began between the United States and the United Kingdom after the Second World War and grew to five countries: the United States, United Kingdom, Canada, Australia and New Zealand. That is the Five Eyes.

Two wider circles sit outside it, sharing less and less closely. Nine Eyes adds Denmark, France, the Netherlands and Norway. Fourteen Eyes adds Germany, Belgium, Italy, Spain and Sweden on top of that. The numbers are just the count of countries; there is no thirteenth alliance you have missed.

The reason this comes up in VPN comparisons is that a VPN provider is a company, a company sits in a country, and that country's police and courts can compel it to do things. If that country also routinely shares intelligence with thirteen others, a request that arrives at your provider may not stay in one jurisdiction.

Why the usual advice is half wrong

The advice you normally get is "pick a provider outside the Fourteen Eyes", and the reason it is half wrong is that people apply it geographically rather than by membership. Sweden, the Netherlands and Italy are routinely described in VPN roundups as privacy-friendly European choices. All three are Fourteen Eyes members. Switzerland and Panama are not. "In Europe" and "outside the alliances" are unrelated facts, and a comparison that treats the European Union as a privacy stance is telling you something that is not true.

This is why this directory records the two separately. Jurisdiction is the country whose courts govern the contract you sign, which decides practical things like whether you have standing under the GDPR. Government data sharing is a different question about the same country: whether its intelligence services routinely pass material to others. A provider has both, and they do not move together.

How much it should weigh

Less than the amount of space it gets. Jurisdiction describes what could be demanded of a provider; it says nothing about what that provider actually holds. A company in a Five Eyes country that keeps no connection logs, runs its servers from memory rather than disk, and has had an outside firm verify that, has less to hand over than a company in a favourable jurisdiction that has never been examined by anyone.

The things that have actually been tested are better evidence than the things that might theoretically happen. Has an independent auditor looked at the no-logs claim, and how recently? Has the company ever been asked for data in court, and what did it produce? Does it publish those numbers? Those questions have checkable answers, and jurisdiction is the input you reach for when they run out.

So treat the alliance as one line on a spec sheet rather than a verdict. It is worth knowing, it is worth recording accurately, and it is not the reason to rule a service in or out on its own.