On October 23, Iranian authorities approved internet price increases of up to 40%, marking the third tariff hike in less than a year. For users in Iran, this is far more than a price adjustment. Under Iran's regulatory framework, international bandwidth is billed at full rates while domestic platforms receive state subsidies. Because widespread censorship forces users onto commercial VPNs, every price hike directly compounds the cost of reaching the open web.
Meanwhile, state officials have openly normalized network interference: a government spokesperson acknowledged that state agencies deliberately throttle connections while the secretary of the Supreme Council of Cyberspace said there was "no alternative" to internet shutdowns. Iranians are now paying up to 40% more for an internet connection that is intentionally degraded, heavily filtered, and subject to arbitrary disconnection.
Key Findings
- Internet prices increase by up to 40%: New tariffs for mobile and fixed internet deepened the financial burden on users, while preferential domestic data pricing made access to the global internet increasingly expensive.
- Declassified 32-point plan codifies state control:: The release of the Supreme Council of Cyberspace's framework confirmed that promises to unblock major platforms like WhatsApp and YouTube were illusory, while provisions to criminalize VPNs and force users onto domestic infrastructure moved ahead. Domestic platforms fail to replace international services: Despite state-backed promotion and high reported view counts, 71.5% of Iranian internet users continued using international platforms, according to survey findings.
- Persistent throttling impairs core infrastructure:: Cloudflare network traffic from Iran remained severely depressed throughout October. Independent testing across five ISPs confirmed persistent throttling on ordinary websites and circumvention tools, with upload speeds suppressed below 0.1 Mbps, roughly the speed of 1990s dial-up, slow enough to make sending a basic voice message painfully slow and VPNs constantly disconnect.
Part One: Internet Policy
1. Rising Internet Costs: Economic Filtering
On October 23, prices for internet data packages, voice calls, and text messages rose by up to 40%. While existing packages remained valid until expiration, this latest tariff revision deepens a system of economic discrimination embedded in Iran’s communications infrastructure The increases impacted both mobile and fixed broadband internet.
Iran's internet pricing system has long discriminated between domestic and international traffic. Under Communications Regulatory Commission Resolutions 248, 251, and 266, operators must distinguish domestic from international traffic and offer preferential rates for eligible domestic services. As a result, users pay different rates for the same amount of data depending on which websites or messaging platforms they use.
Under the pricing rules tied to the October 23 increase, domestic messaging apps are charged at one-third of the standard rate, and domestic websites at half . International traffic, by contrast, is billed at full price.
While the ratio between domestic and international rates remains unchanged, the 40% hike sharply widens the nominal financial gap. A user consuming 10 GB of data on international platforms absorbs the full 10 GB allowance. By comparison, that same volume counts as 5 GB on an approved domestic website and just 3.3 GB on an approved domestic messenger. As nominal prices rise across the board, every gigabyte of global access becomes significantly more expensive than state-approved domestic alternatives.
This economic discrimination becomes even more troubling when combined with widespread internet filtering. Users seeking access to blocked international messaging apps, social networks, and other services must already contend with access restrictions, connection disruptions, and the cost of VPNs. They also lose out on the discounted data rates available to users of eligible domestic services.
Official figures reveal the scale of this financial burden. According to a survey by the Iranian Parliament's Research Center, published in October 2026, 64.7% of respondents use VPNs to access international social media platforms. Among those paying for VPN services, the average monthly cost has reached 405,000 tomans, on top of their regular internet expenses. VPN use can also increase data consumption through additional traffic overhead, repeated disconnections, and reconnection attempts, adding further costs as data prices rise.
The result is a threefold financial burden on access to the global internet: full-rate data charges instead of domestic discounts, potential additional data consumption caused by VPNs and connection disruptions, and subscription fees for users who depend on paid VPN services. This is no longer simply a question of internet prices. Economic pressure has become another source of inequality in access to information.
Operators have justified each tariff cycle with familiar claims of rising capital costs, foreign exchange depreciation, network maintenance, and 5G deployment. Mobile Communications of Iran (MCI) and Irancell cited the necessity of infrastructure upgrades to maintain stability. Yet both operators omit a lucrative parallel revenue stream enabled by network restrictions: "Internet Pro".
Capped at 40,000 tomans per gigabyte, Internet Pro is sold at more than double the price of standard internet, which remains below 20,000 tomans even after the October increases. Rather than addressing underlying network bottlenecks, operators monetize artificial scarcity by selling privileged, higher-tier access to a select corporate and institutional clientele. State-imposed restrictions have become a recurring tax on regular users, while serving as a profitable business model for dominant telecom providers.
2. The 32-Point Plan: A Conditional Promise Left Unfulfilled
On October 13, the head of Iran's National Center for Cyberspace ordered the declassification of a 32-point plan titled "Facilitating Access to Foreign Platforms and Enhancing Law-Based Governance." Originally approved by the Supreme Council of Cyberspace in late 2024, state-aligned media framed the initiative as an impending thaw that would restore access to services like WhatsApp and Google Play. At the time, Filterwatch warned that the plan could expand state control, giving security and judicial authorities greater power to impose restrictions while reducing the cost of digital repression.
Nearly two years later, the full text reveals that unblocking was never a genuine policy goal. Platform restoration,specifically for YouTube and Telegram,was made contingent on foreign tech companies accepting domestic legal jurisdiction, opening local offices, and submitting to state data demands—conditions the authorities knew global platforms would not accept.
For users, the plan has delivered little: international platforms remain blocked, access to VPNs has become more difficult, and even future unblocking would offer a restricted, state-regulated version of these services rather than open internet access.
3. Forced Migration to Domestic Platforms: Public Funding and Vanity Metrics
Last month, Iran's National Center for Cyberspace published a report assessing five domestic platforms—Rubika, Eitaa, Bale, Soroush Plus, and Virasty—during the first six months of the Iranian year 1405 (March–September 2026). The report showcased approximately 616 million content items across the five platforms and 1.088 trillion views on the first four. Yet these impressive figures mask severe internal imbalances. Engagement was centralized: Rubika alone accounted for 71.7% of all views, and combined with Bale accounted for nearly 91% of total traffic. Eitaa, despite producing 38.8% of all content, received just 8% of views while Virasty omitted view counts entirely in favor of an undefined "penetration rate".
Beyond this uneven distribution, aggregate view counts reveal little about genuine user behavior, especially given that the reporting window overlapped with prolonged international internet shutdowns. The Center’s analysis noted that content across all five services was heavily dominated by state narratives surrounding defense, regional conflict, and deterrence. Rather than indicating organic public interest, these viewing spikes reflect captive audiences forced onto domestic platforms to access essential administrative, banking, educational, and healthcare services that are deliberately withheld from the open internet.
Independent polling confirms that compulsion has not translated into true migration. According to a June 2026 survey by the Iranian Students Polling Agency (ISPA), 71.5% of internet users still use international platforms, spending an average of more than two hours per day on global services compared to 90 minutes on domestic apps.Some 74.4% use VPNs, while Instagram (47.8%) and Telegram (20.9%) topped the list of platforms users most wanted unblocked.
These findings come despite users spending nearly half the period from last winter through spring under complete internet shutdowns or severe restrictions. Yet neither widespread filtering nor the need for VPNs has driven Iranians away from international platforms.
Part Two: Internet Network Conditions
1. Continued Decline in Cloudflare Traffic
The decline in traffic from Iran observed on Cloudflare's network, documented in our previous monthly report, continued throughout October. This does not necessarily indicate an equivalent drop in Iran's overall internet traffic. However, because some censorship circumvention tools rely on Cloudflare's infrastructure, the trend is consistent with repeated user reports on social media of unstable VPN connections and disruptions to circumvention tools.
Further evidence comes from MahsaNet's October 2026 internet monitoring findings, shared with Filterwatch. Tests conducted across five Iranian internet service providers (ISPs) found that, from the beginning of October, ordinary websites hosted behind Cloudflare's CDN, including Iranian websites, loaded extremely slowly over HTTPS or timed out entirely. Starting October 2, widespread blocking and heavy throttling also affected IP ranges belonging to international hosting providers.
From October 27, access to some Cloudflare-hosted websites partially recovered, but uploads to Cloudflare remained severely throttled, with speeds below 0.1 Mbps. These findings show that October's disruptions extended beyond censorship circumvention tools, affecting access to ordinary websites and internet services.
MahsaNet's tests also found that restrictions varied across ISPs. In some cases, connections failed to establish altogether. In others, the initial connection or handshake succeeded, but data transfers remained extremely slow or failed entirely. This distinction highlights why a successful connection alone is not a reliable measure of actual internet accessibility or connection quality.
Taken together, these observations point to multiple layers of network restrictions, with consequences ranging from slow or inaccessible websites to unstable connections and services that users could not effectively access.
2. DDoS Attacks and Electronic Warfare
On October 19, Behzad Akbari, CEO of Iran's Telecommunication Infrastructure Company (TIC), reported an increase in the frequency and intensity of DDoS attacks targeting the country's communications networks. On October 29, he confirmed that multiple attacks exceeding 500 Gbps had been recorded.
These incidents raise a critical question: why should users bear the cost of poor network management and resilience? And why can a single attack or disruption affect such large portions of the country's internet infrastructure?
Much of the answer lies in Iran's highly centralized network structure. As Filterwatch documented in an October 2024 investigation, TIC serves as the country's near-exclusive gateway to the global internet. Under its charter, the company is responsible for importing and distributing international internet bandwidth. It also controls internet exchange points (IXPs), while domestic operators purchase their international bandwidth from TIC.
This concentration increases the network's vulnerability to attacks and disruptions while enabling authorities to impose widespread connectivity restrictions. More than 70% of TIC's revenue comes from the country's two major mobile operators, MCI and Irancell.
The consequences of this monopoly extend beyond network quality and security. The costs of limited competition and restrictive policies are ultimately passed on to internet users, including through higher tariffs.
3. Renewed Disruptions to AI Tools
On October 20, Iranian users reported renewed difficulties accessing ChatGPT, Claude, and Grok without a VPN. The disruptions varied across mobile and fixed broadband providers, as well as between web and app versions. Some users encountered messages stating that the services were unavailable in Iran, while others could still access them without a VPN.
It remains unclear whether these disruptions were caused by changes within Iran's domestic network or geographic restrictions imposed by foreign service providers. For students, researchers, developers, and small businesses, however, the incidents once again highlight the fragility of access to essential tools for education and work.
Iranian users face restrictions on both sides: geographic limitations imposed by international technology companies and domestic internet filtering and controls. Together, these barriers make reliable access to global online services increasingly difficult.