VPNs are legal in a lot of the world, but some states have banned VPNs entirely or put quite severe restrictions in their usage. Those bans are more pertinent to the people that live there than to individuals who travel there: we are unaware of any tourists being thrown in the clink for running a VPN to secure their resort Wi-Fi, but clearly it is prudent to be careful in more repressive regimes.
In nations that do restrict VPN use there is often a distinction between approved and unapproved ones. For instance, in China VPNs have to be approved by the Chinese authorities, which suggests they’re the very last things you should rely on to conceal your actions from the Chinese authorities. Should you use an unapproved one, then you may be fined heavily.
In the United Arab Emirates, you could be fined over half a million dollars and/or thrown in jail for using any VPN. It’s a similar story in Russia, while in Iran usage of an unapproved VPN can place you in prison. So does North Korea.