VPN privacy and trust analysis
Can your VPN provider see your traffic? What 7,000 apps reveal
A VPN can stop your internet provider from seeing the destinations carried inside the tunnel. It does not make that privileged view disappear. It moves much of it to the VPN provider, which is why the company behind the app matters as much as the encryption logo on its store page.
Proton VPN has given that warning a timely mobile-app angle. Its August 27 survey says it examined more than 7,000 VPN apps and found widespread tracker code, unclear ownership, and access to sensitive device data. The headline is important. The evidence also needs careful wording because static code signatures do not prove that tracking happened, and Proton is both the publisher of the survey and a commercial VPN provider.
What a VPN provider can actually see
There are two layers to separate. First is the provider's position on the network path. Second is data collected by the VPN app on your phone or computer. They can overlap, but they are not the same thing.
Network visibility
A VPN moves the privileged observation point
The VPN tunnel protects the first part of the route. HTTPS remains a separate layer between your app or browser and the destination.
- Before the tunnel Local network and ISP
- Sees your IP and the VPN server IP
- Sees timing and data volume
- Usually cannot see destinations inside the tunnel
- Privileged network position VPN provider
- Sees your source IP and connection metadata
- Can observe destination IPs and provider-handled DNS
- Usually cannot read HTTPS contents
- At the destination Website or app
- Sees the VPN exit IP
- Sees accounts, cookies, and submitted data
- Usually does not see your home IP if there is no leak
Content protection
HTTPS still matters
Page contents, passwords, and encrypted messages remain protected from an ordinary VPN gateway when end-to-end encryption is working correctly.
Separate collection path
The VPN app may collect more
App permissions, device identifiers, diagnostics, and tracker code are different from what the VPN gateway can observe on the network path.
| Data | Usually visible to the VPN provider? | Why |
|---|---|---|
| Your source IP address | Yes | The VPN server accepts the connection from your device. |
| Connection time and data volume | Yes | The gateway handles packets and connection state. |
| Destination IP addresses | Usually | The provider forwards traffic to those destinations. |
| Domain names | Often | Provider DNS, destination IPs, and other metadata can reveal or suggest domains. |
| HTTPS page contents and full paths | Normally no | TLS encryption continues from your browser to the site. |
| Plain HTTP or other unencrypted data | Yes | There is no destination-to-device encryption to hide it. |
| Account, payment, and support records | Depends on signup | These are collected outside the tunnel itself. |
Destination IP does not always identify one website. Many sites share cloud infrastructure, and privacy technologies can hide more of the hostname. Traffic timing and volume may still reveal patterns. The safe conclusion is not that the provider sees every page. It is that the provider occupies a position where it can observe useful metadata and any traffic that lacks end-to-end encryption.
Why HTTPS does not make provider trust irrelevant
HTTPS is a strong boundary. It is why a normal VPN gateway cannot simply read your banking password or the text of an encrypted web page. Trust still matters because metadata can be sensitive, DNS can reveal interests, software can leak, and the provider controls the app and server infrastructure carrying the connection.
A VPN app that asks you to install a root certificate deserves special scrutiny. Such a certificate can enable TLS interception if the app controls a trusted intermediary. That is different from ordinary VPN routing and should not be necessary for a conventional consumer VPN.
What Proton's 7,000-app survey found
Proton's survey examined mobile VPN listings across multiple countries. For its US sample, Proton reports that 85% of apps contained known tracker code, 64 of 390 apps were Chinese-owned, and 64 apps tracked physical location. Those are Proton's classifications. It also says the apps in its global analysis received an estimated 13.2 million downloads in June 2026.
The most useful part of the report is the broader warning: a store listing tells you little about who operates an app, how its business is funded, or what its code may collect. Those questions matter more for a VPN because its entire purpose is to take a privileged place in the user's network route.
Important limits in the published method
Proton provides a short methods section, but we did not find a downloadable app-level dataset on the report page. That prevents readers from reproducing individual ownership, permission, or tracker classifications. The page also describes a global analysis of Apple and Google stores while its methods say apps were examined from Google Play.
There is a timing discrepancy too. The main text gives June 2026 download figures, while the methods say AppTweak download estimates were taken for May. These issues do not erase the warning, but they limit how precisely the percentages should be reused. Proton also sells a competing VPN, so its report should be checked against independent work rather than treated as neutral market research.
Ownership needs similar care. Hidden ownership or an undisclosed operating relationship is a legitimate transparency concern. Nationality alone is not evidence that an app logs, leaks, or abuses traffic. The strongest criticism is about verifiable control, legal exposure, and observed behavior.
Independent research finds the risk is real
Proton's exact percentages need those caveats, but its core concern is not isolated. Recent academic and civil-society investigations have found weak transport security, tracking activity, undisclosed operating clusters, and inaccurate disclosures among popular VPN apps.
MVPNalyzer: dynamic tests of 281 free Android VPNs
The strongest current comparison is MVPNalyzer, presented at NDSS 2026. Researchers installed 281 operational free VPN apps from the US Google Play Store on a physical Android phone and observed how they behaved. The test measured runtime behavior instead of relying only on library signatures.
More than 80% of the apps contacted at least one URL classified as advertising or tracking. Seventy-six transmitted the Android advertising ID, 38 transmitted the device IP in application-layer fields, and one transmitted precise coordinates. The framework also found 10,552 unencrypted flows across 61 apps and traffic or tunnel leaks in 29 apps. These apps had more than 2.4 billion cumulative installs, although install totals are not the same as active users.
The study also found that store privacy labels and Google's VPN trust signals were not a complete or consistently accurate substitute for testing. Its scope was free Android VPNs available in one country, so the results should not be projected onto every paid service or platform. They do show that weak behavior reaches a large audience.
OTF: common infrastructure behind supposedly separate providers
The Open Technology Fund's 2025 VPN Transparency Report investigated 32 apps presented as 21 distinct providers. Through static and dynamic analysis, the researchers identified two hidden clusters covering 16 apps and more than 700 million combined downloads. They also found hard-coded Shadowsocks passwords in apps within both clusters.
That report adds useful nuance. An anonymous development team may need to protect its members from a repressive government. Corporate transparency is therefore an incomplete proxy for safety. Even so, undisclosed shared code, infrastructure, and control stop users from evaluating who holds their data and whether apparently independent choices are truly separate.
VPN users already struggle with the transfer of trust
A USENIX Security 2023 study of 1,252 US VPN users found flawed mental models about what VPNs protect. Interviews with nine providers also highlighted the difficulty of communicating limits in a market shaped by review-site commissions and broad privacy claims. Many users are making a trust decision without a clear picture of what changes after they connect.
How to decide whether a VPN provider is trustworthy
There is no single trust badge. A public audit can be narrow or old. Open source can omit the deployed server configuration. A no-logs policy can use vague definitions. Look for several independent signals that reinforce one another.
- Identify the operator and business model. Find the legal entity, controlling owners, jurisdiction, related VPN brands, and payment processor. If a free service has no clear source of revenue, keep asking how it pays for infrastructure.
- Read the data categories, not the slogan. Check whether the service stores source IPs, timestamps, bandwidth, destinations, DNS requests, device IDs, diagnostics, or support records. Look for specific retention periods and opt-outs.
- Check what an audit actually covered. Prefer a recent public report that names the app versions, server systems, privacy controls, and remediation. A mobile app audit from years ago does not prove the current server network keeps no logs.
- Compare policy with technical behavior. Independent leak tests, permission review, tracker analysis, and observed network connections can reveal gaps. Our IP leak test checks the connection you are using, while our kill switch test guide covers interruption failures.
- Look for evidence under pressure. Transparency reports, documented legal demands, server seizures, and reproducible infrastructure design can show how a policy works outside marketing copy. Absence of a public incident is not proof, but specific outcomes are stronger than promises.
- Judge updates and accountability. Security contacts, prompt fixes, signed releases, open issue handling, and clear ownership changes matter throughout the subscription.
The Electronic Frontier Foundation's current guide to choosing a VPN reaches the same basic conclusion: define what you need protection from, then decide whether the provider is a better party to trust than the network you are leaving behind. Our VPN review methodology explains how DoVPN separates policy claims, public assessments, and hands-on tests.
What to do if your risk is unusually high
A trustworthy commercial VPN can reduce what an ISP, public Wi-Fi operator, or website learns. It is not designed to remove every link between identity and activity. Accounts, cookies, device fingerprints, payment records, malware, and legal compulsion can all sit outside the tunnel.
Journalists, activists, abuse survivors, and people facing targeted surveillance should start with a threat model and specialist guidance. Tor can distribute trust across several relays instead of concentrating it in one VPN provider, though it brings different speed, compatibility, and blocking trade-offs. The right choice depends on the person or organization you need protection from.
Our assessment
Proton is right about the central issue: a VPN provider is not a neutral pipe and should be chosen carefully. Its survey is a useful warning about the scale and opacity of the mobile VPN market. Its percentages should be described as Proton's findings, not as a fully reproducible independent census.
The independent record is already strong enough to act on. Dynamic academic testing has found apps sending identifiers to tracking endpoints, leaking traffic, and using weak configurations. Transparency research has found supposedly separate VPN brands sharing hidden infrastructure and credentials. Users do not need to assume every VPN is hostile. They do need to stop treating a VPN logo as proof of privacy.
The most accurate mental model remains simple: the tunnel hides more from the network you are on, the VPN gateway sees more of the route beyond it, and HTTPS continues to protect content. Choose the provider on evidence because you are transferring trust to it. For a broader explanation of the tunnel and its limits, see our complete guide to how VPNs work.
Sources
- Proton VPN's August 2026 mobile VPN survey for the reported app, ownership, tracker, permission, and download figures.
- Exodus Privacy's report methodology notice for the limit of static tracker-signature analysis.
- MVPNalyzer, NDSS 2026 for dynamic security and privacy tests of 281 free Android VPN apps.
- Open Technology Fund VPN Transparency Report 2025 for ownership, infrastructure, and credential findings across selected apps.
- USENIX Security 2023 research on user and provider views for evidence about VPN mental models and the transfer of trust.
- VPNalyzer, NDSS 2022 for independent desktop VPN leak and tunnel-failure testing.
- An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps for foundational analysis of 283 Android VPN apps.
- EFF's Choosing the VPN That's Right for You for independent consumer guidance on VPN capabilities and trust.
VPN provider visibility: FAQ
A VPN provider can usually observe destination IP addresses and may see DNS requests or infer domains. HTTPS normally prevents it from reading the page contents, full URL path, passwords, or form data. Shared infrastructure and newer privacy features can also make a destination IP less specific than a website name.
Not during an ordinary HTTPS connection. Your browser encrypts the password for the destination website, and that encryption continues through the VPN gateway. A malicious app that installs a trusted root certificate, performs TLS interception, or records data on the device would be a different and much more serious threat.
No. A VPN gateway has to process traffic in real time to route it. A no-logs claim concerns what the provider records and retains, not what its systems can technically observe while a connection is active. The exact policy, server design, audit scope, and legal history matter.
No. Static analysis can find code signatures associated with analytics or advertising libraries, but presence alone does not prove that the code ran or sent data. Dynamic testing of network activity gives stronger evidence about actual collection.
No. Price is not a security test. A limited free tier can be funded by paying customers, while a paid app can still collect data or have weak security. Ownership, business model, permissions, technical tests, public audits, and a precise retention policy are better signals.
No. Store review can remove obvious abuse, but it is not a full technical or ownership audit. Independent mobile VPN research has found mismatches between disclosures and observed behavior, including among apps carrying store trust signals.
