120+ VPN Logging Policies Debunked: Does Your VPN Keep Logs?

I’ve read through over 120+ VPN logging policies to find out which VPNs keep which logs and can potentially endanger a user’s anonymity.

This analysis revealed that at least half of reviewed VPNs either keep some logs, are unclear about what logs they keep, or can compromise a user’s privacy in another way.

Here’s what I found:

• 47% of VPNs are based in 5/9/14 Eyes countries.
• 15% of VPNs don’t make it completely clear in their privacy policies which information they store.
• 14.4% of VPNs log traffic activity.
  27% of VPNs log your IP address whilst you’re connected.
• 50% of VPNs log your connection timestamps in one way or another.
• 42% of VPNs log your server location.
• 10% of VPNs log ALL OF THE ABOVE

What’s a No-Logs VPN?

How Can I Trust a VPN’s “No-Logs” Claim?

The first step to verify whether this claim is true is to check privacy policies or terms of use of a VPN provider. If they’re transparent and clear about which data they retain or don’t retain, there’s a lower risk of them misleading you about what happens to your data.

Go to our comparison table of VPN logging policies to see which VPNs keep which logs.

The second step is to check the VPNs’ commitment to their policies.

You can do that by checking whether the VPN logging policies have been independently audited or verified in another way.

Go to our table of audited VPN providers to see the list of verified providers.

As an additional step, you can also check which servers a VPN is using.

If it’s using RAM-only servers rather than hard drives, it means that any data is automatically erased each time a server is rebooted. In this case, there’s no possibility of VPN logging and therefore, no possibility of your data being recorded.

Go to our table of VPN providers that use RAM-only servers to see what those VPNs are.

What Kind of Data Can / Should VPNs Log?

Your Traffic Activity

So, if you don’t want your data to leak or be flooded with ads when you browse, I recommend opting for a VPN that doesn’t log your traffic activity.

“This analysis revealed that at least half of reviewed VPNs either keep some logs, are unclear about what logs they keep, or can compromise a user’s privacy in another way.”

vpnAlert Tweet

Your IP Address

A VPN that possesses logs of your originating IP address can easily match that address to you – which means that whoever else gets that data can do the same.

Similar to traffic logs, free VPNs often retain IP logs.

For instance, HMA’s privacy policy makes it clear that if you use their free browser extension, your IP address will be collected.

This is a significant issue for users concerned about their privacy – IP addresses are even considered “personal data” in some jurisdictions.

I’d recommend choosing a VPN that doesn’t log your IP address if you’re such a user.

Your Connection Timestamps and Server Location

VPN connection logs can include:

• Time and date of connection
• Connections to a specific server
• Bandwidth usage

The times you’ve connected to and disconnected from a VPN service using specific servers can also be recorded. Unlike VPN logging of IP addresses and traffic, however, this type of logging can help VPN solve network issues for users.

For instance, if too many users connect to a single server at the same time, a VPN can take steps to improve the user experience on that server or create other servers nearby to reduce overload.

However, connection timestamps can also be used to potentially identify a user, especially when paired with an IP address or traffic logging.

Data can be analyzed to match a user’s online activity at a specific time to a specific IP address, thus removing any kind of anonymity.

To prevent that, some VPNs use aggregate timestamp and server logs – anonymized aggregated data about usage. It’s important to pay attention to whether a VPN logging policy stipulates that that’s what’s happening, and if yes, how.

For instance, VPNhub’s privacy policy says that they may aggregate data to calculate a percentage of users accessing a certain feature.

Therefore, to ensure a logging policy prioritizes your privacy, it’s important to check how VPNs collect connection data together with other data.

VPN Logging Policies: Policies of 120+ Services Reviewed

VPN logging of traffic activity can include:

• Domain names and URLs of visited pages
• DNS requests
• Browser type
• Usage metadata

If a VPN logs the domain names or URLs of pages you visited and DNS requests, for however short a period, it’s a major red flag. The data about your online activities can be lost, stolen, requested by authorities, or simply sold to third parties like advertisers.

Free VPN providers are often guilty of the latter – that’s how they make money.

For instance, Hola VPN’s privacy policy explicitly states that their log data of free users may include browser type, web pages they visit, etc.

A no-logs VPN is a VPN service that doesn’t collect information a user transmits, or shares, through the network. If a VPN keeps logs that can potentially identify you as its user, that defeats the point of a VPN that promises to protect your privacy.

For that reason, many providers claim to be “no-logs” VPNs.

Audited or Otherwise Verified VPNs

When I read through the privacy policies, I saw that many were primarily for marketing purposes and not specific enough about the data they were / weren’t logging.

For instance, Identity Cloaker’s policy states “we do not store the addresses of the visited websites or other resources and we store no transported data for a period longer than necessary to finish the Internet data transfer handover”. It’s not clear which transported data they do store, even if they don’t store the addresses of webpages their users visit.

Also, a solid privacy policy isn’t a guarantee that a provider will follow it.

That’s why I recommend going a step beyond reading the policies in detail.

I’m referring to checking whether the specific providers’ policies and approach to security have been independently audited or verified as a result of a legal precedent.

It’ll help you make a more informed decision about how much your chosen provider cares about your privacy.

I collected the data about the VPNs that have been subject to an audit or verification of any other kind.

From the table below, you’ll see that 8% of VPNs I assessed have had an audit or undergone another kind of verification of their commitment to security and privacy.

Some of these audits covered just logging policies, whereas others were more about security vulnerabilities.

“Only 8% of VPNs we assessed have had an audit or undergone another kind of verification of their commitment to security and privacy.”

vpnAlert Tweet

Audited VPN Providers

A no-logs VPN is a VPN service that doesn’t collect information a user transmits, or shares, through the network. If a VPN keeps logs that can potentially identify you as its user, that defeats the point of a VPN that promises to protect your privacy.

For that reason, many providers claim to be “no-logs” VPNs.

However, independent audits only tell one side of a story on a given date.

Just because a VPN has passed an audit once, it’s not a guarantee they will again – policies may change, and new security threats may emerge. Also, VPNs are mostly owned by commercial companies, and any change in their ownership can easily lead to policy changes.

As a result, your activity whilst using VPN might not end up so private.

A possible solution to that problem is choosing a VPN with RAM-only servers.

VPNs With RAM-only Servers

For extra assurance of privacy, some VPNs use RAM-only servers.

Those servers erase any logs and user data as soon as they’re turned off.

A VPN that has RAM-only servers simply can’t keep any logs because they’d be wiped away at the end of a session, thus erasing any trace of your activity during it. Even if such a server is stolen, the malicious actors won’t be able to get their hands on your data for that reason.

For this reason, I also checked the structure and set-ups of the VPNs I reviewed to see which ones make it abundantly clear that they have such servers.

From the data below, you’ll see that 6% of providers I assessed have RAM-only servers, which shows their genuine commitment to not keeping logs.

“Only 6% of providers we assessed have RAM-only servers, which shows their genuine commitment to not keeping logs.”

vpnAlert Tweet

List of RAM-only VPNs

Problems with VPNs’ Privacy Policies

VPN’s Jurisdiction (5/9/14 Eyes)

Some jurisdictions are very hostile for privacy. For instance, laws of the Russian Federation where Kaspersky is based require VPN providers to store user data – the opposite of what VPNs are about.

If a VPN is located in a country that’s part of the 5/9/14 eyes alliances, that’s also a concern.

They’re jurisdictions with mandatory data retention laws. A truly no-logs VPN would not be retaining any data – but if it’s located in a 5/9/14 country, it would most likely be obliged to. Its jurisdiction would be collecting the data of a VPN that keeps logs and share it with other members of the alliance.

Therefore, even if a VPN’s privacy policy stipulates that it’s a no-logs provider, I recommend checking where it’s located. If it’s a 5/9/14 country, privacy policy might be overruled by international law.

For that reason, I suggest checking whether such VPNs have the technical capacity to not keep logs – e.g. if they have RAM-only servers – before choosing a provider.

Unclear Presentation with Wrong Purpose

Some VPN logging and privacy policies I reviewed didn’t stipulate clearly what data they were retaining and when. For instance, SmartDNSProxy’s privacy policy seems to only apply to users’ activities on the website, and it’s not the only provider with such stipulations. I had to double-check via customer support whether the policy applied to users’ activities within the VPN (it does).

Other providers’ policies only seemed to focus on making the VPN look like a no-logs VPN by, for example, posting large “We don’t keep logs” statements at the very beginning. When I read through the small prints of those policies, however, I saw that that wasn’t the case at all.

For instance, F-Secure’s policy starts that way by promising they don’t read traffic, but later stating that they “analyze the traffic for suspicious or malicious files and destinations (i.e. URLs) and automatically screen the traffic to inhibit usage that is against our acceptable use policy”.

So, it contradicts itself in a legal document, which means that you’re not certain what’s happening with your activities when you’re connected to their VPN.

Wrapping Up

Before choosing a VPN provider, you need to know what’s happening with your data whilst you’re connected to it. VPN logging and privacy policies are a good place to start as they’d ideally stipulate whether or not the data is retained. However, as you can see, that’s not always clear.

Despite most VPNs claiming they don’t keep logs, many of them in fact do, in one way or another. And the way the policies are written doesn’t always answer the question one way or another.

Based on what I’ve discovered in the days of my research, I suggest that you:

• Choose VPNs that don’t keep traffic and IP logs.
• Consider VPNs with audited or verified logging policies and/or RAM-only servers.
• Be wary of VPNs in 5/9/14 countries or those with unclear privacy policies.