Since the US and several EU countries have specific laws mandating data retention requirements for personal information, authorities can and do take advantage of this in those jurisdictions. At the same time, it can be difficult for those authorities to identify VPN users. By aggregating data, surfing behavior can be followed. For that reason, it's important to pay attention to where a VPN provider is located since it will be subject to that country and/or union's jurisdiction.