Tails OS: what it is, whether it is legal in the UK, what it does not protect and which USB stick it needs

Tails is a complete operating system based on Debian that is not installed on the computer: it is installed on a USB stick and starts from it. While it runs, the computer's hard disk is not touched and everything happens in memory, which is wiped at shutdown. Its own site compares it to a tent: you carry it, pitch it anywhere and leave nothing behind. It is made by the Tor Project, a non-profit, and funded by donations from individuals and organisations such as Mozilla, DuckDuckGo, Open Tech Fund and Craig Newmark Philanthropies (tails.net/about, read on 28 September 2026).

Inside it brings the toolbox already set up, and that is half its value: Tor Browser, Thunderbird for encrypted email, the Secrets password manager, LibreOffice, OnionShare for sharing files over Tor and Metadata Cleaner. Applications are blocked if they try to reach the internet without going through Tor, so the classic mistake of a home-made setup, an app leaking traffic outside the tunnel, cannot happen here.

What it is not: a system for everyday use. It does not start on a phone, it keeps nothing except what you choose to put in the encrypted Persistent Storage, and every session starts clean. It is built for working on something sensitive for a set time, by anyone with a serious reason not to leave a trace on a computer that is not theirs.

Tails is free software with its source code published, downloaded from its own site without an account and made by the Tor Project, a non-profit. We have found no UK law that makes using it an offence in itself: what you do inside it answers to the same rules as outside it, as with any browser.

The UK detail that most guides leave out concerns the encrypted Persistent Storage. Part III of the Regulation of Investigatory Powers Act 2000 lets an authorised officer serve a notice under section 49 requiring you to make protected information intelligible or to hand over the key. Under section 53, knowingly failing to comply is an offence with a maximum of two years in prison, or five years in a national security or child indecency case (legislation.gov.uk, sections 49 and 53, read on 28 September 2026). Encryption protects your files from whoever finds the stick; it does not put them outside the law.

What does change is visibility, not legality. Tails' own documentation warns that parental controls, broadband providers and countries with heavy censorship can identify and block connections to Tor that do not use bridges.

Tails cannot be traced the way an ordinary computer can, because it does not leave the history, the files you opened, the passwords or the list of Wi-Fi networks you joined. But its warnings page lists by name where identity escapes, and it is worth reading in full before any forum.

Three of those routes do not depend on Tails and cannot be fixed inside it. The first is metadata: a photo carries where it was taken and the camera's model and serial number, and an office document carries its author and its changes. Tails includes Metadata Cleaner for this, and its documentation is candid about the limit: it is impossible to remove all metadata reliably from complex formats, because a Word document can contain embedded images with their own metadata, so it recommends saving in simpler formats such as plain .txt, and suggests Dangerzone for documents other people send you (tails.net/doc/sensitive_documents/metadata, 28 September 2026). The second is using one session for two things: if you log into two accounts on the same website in one session, the site can tell they belong to the same person because they share a Tor circuit; the advice is to restart Tails between activities, and to use a different stick for each area of your life. The third is the exit node: the last Tor relay makes the real connection to the destination, and if that connection is not HTTPS it can watch the traffic.

And there is a fourth, the most uncomfortable: Tails runs safely on a computer with a virus, but it cannot always protect you if you install it from an infected computer, or run it on a machine with compromised BIOS, firmware or hardware. No operating system stops a physical keylogger.

It is one of the first questions people ask about Tails, and the project answers it directly: Tails does not currently work with VPNs (tails.net/support/faq, read on 28 September 2026). Its reasoning is that Tor gives anonymity because no single point in the network knows both the origin and the destination of a connection, whereas a VPN provider can see both where you connect from and where you connect to.

The same FAQ also lists where a VPN has clear advantages over Tor when strong anonymity is not needed: reaching websites that block Tor or only open from one country, video calls, private company networks and browsing faster. That is most of the day for most people, and it is the part Tails does not cover, because it does not start on a phone and is not a system to live in. For that other job, a VPN protects your whole connection from the network you are on and from your broadband provider, and it works on the phone. It does not give anonymity: it changes who sees your traffic.

There is a bridge between the two that is not our marketing: NordVPN's Onion Over VPN servers route traffic through the Onion network after the encrypted connection, and its own page explains that this makes Tor Browser unnecessary for reaching onion sites. If you want onion sites without setting anything up, that is the short route; if you want a session that leaves no trace on the computer, the route is still Tails.

Tails is free. The only thing to buy is the stick, and its documentation is unusually specific about it, with a section of its own and a sentence worth reading slowly: the quality of your USB stick is crucial, because a bad one will be slower and more likely to corrupt the files in your Persistent Storage.

The requirements fit on one line: 8 GB minimum, a new stick, from a well-known brand (it names Kingston, Samsung and SanDisk) and ideally USB 3.0 or later, because USB 2.0 tops out at around 50 MB/s read on a stick and USB 3.0 at around 500. It adds a sum almost nobody does: if you will use the Persistent Storage, buy two of the same size, a primary and its cloned backup, and ideally a smaller, cheaper third one for manual upgrades. And a practical check: you can compare the write speed of your sticks by timing how long each takes to clone Tails.

The last piece of advice goes against convenience, so here it is in full: Tails says to buy your sticks from a reputable local store, and to avoid buying USB sticks online or using sticks that were given to you, because they could contain malware (tails.net/doc/about/requirements, read on 28 September 2026). If you order one online anyway, our advice is to pick one of the brands it names, sold and shipped by the retailer itself rather than a marketplace seller, and to make it the stick you install onto, never one you plug in elsewhere first.

The short answer is yes, for what it does, and its most valuable part is not the anonymity: it is that the system keeps itself up to date and does not let you choose badly. But there is a fact about its rhythm that changes how anything written about it should be read.

Tails now ships a new version every two weeks, by design. Its news page says it plainly: Firefox is moving to a two-week release cadence from September, so Tor Browser and Tails are doing the same, and Tails 7.12 was the first release on that cadence (tails.net/news, read on 28 September 2026). Between 12 May and 16 September 2026 there were ten releases, from 7.7.3 to 7.13, and the gaps below show the rhythm was already close to two weeks before it became official. When the browser inside publishes a security fix, the whole operating system has to follow.

The practical consequence is twofold. Any guide, video or screenshot from three months ago describes a version that no longer exists, so step-by-step instructions age before you read them; the only instructions that are always current are the ones on tails.net. And automatic upgrades work from version 7.0 onwards, so a stick that has sat in a drawer may need a manual upgrade before it lets you in, which is what the documentation's smaller third stick is for.