Do VPNs Keep Logs? How to Read the Evidence

How to Judge a No-Logs Claim in 5 Minutes

When a VPN says “no logs,” it means they claim not to record your online activity—your browsing history, downloads, or connection timestamps. But that statement alone is meaningless without proof. Anyone can write “we don’t log” in their privacy policy. What matters is whether they can back it up when tested.

Start by asking: has this provider ever been forced by law enforcement to hand over user data—and if so, what did they provide? Real-world incidents like police raids or court orders are the strongest evidence. For example, in 2023, Swedish police raided Mullvad’s offices looking for user data. They found nothing because Mullvad’s infrastructure is designed not to store logs in the first place [3]. That’s not marketing—that’s proof. Similarly, Private Internet Access (PIA) faced two separate U.S. investigations in 2016 and 2018. In both cases, they had no user data to give because their systems were configured to discard logs automatically [3].

Compare that to HMA (HideMyAss) in 2011, which handed over logs that led to an arrest—despite claiming a no-logs policy at the time [3]. The same happened with IPVanish in 2016 and PureVPN in 2017. These companies had logs when law enforcement came knocking, proving their policies didn’t match reality.

So your first filter: check if the provider has been tested in court or by a raid. If yes, what happened? If no, treat their claim as unproven. You can find verified cases on our court-proven list.

What Independent Audits Actually Cover (and What They Don’t)

An audit is better than nothing—but not all audits are equal. Many so-called “independent audits” only review parts of a system, like server configurations or app code, without verifying the full backend infrastructure or data retention practices.

For example, some audits check whether a provider uses RAM-only servers (which wipe data on reboot) but don’t examine backup systems, logging daemons, or third-party integrations that might still collect data. Others are performed by firms with unclear independence or limited scope.

True validation comes from audits that are public, detailed, and conducted by reputable firms like Cure53 or Deloitte. Look for evidence that the audit covered logging mechanisms, server configurations, and network traffic handling—and that it resulted in public findings, not just a press release.

IVPN, for instance, has undergone multiple public audits that confirmed their no-logging setup across OpenVPN and WireGuard servers [3]. Mullvad has also published audits showing their systems are built to prevent logging by design.

But remember: an audit is a snapshot in time. It doesn’t guarantee future behavior. That’s why ongoing transparency—like regular reports and warrant canaries—is essential.

Use our audited list to find providers with verified, public audits. And always read the audit report yourself if available—don’t rely on marketing summaries.

Transparency Reports and Warrant Canaries: Signs of Accountability

A transparency report tells you how often a provider receives legal requests (like subpoenas or warrants) and how they responded. It’s a sign they’re willing to be open about government pressure. A warrant canary is a regularly updated statement saying “we have never received a secret surveillance order.” If the canary disappears, it may mean they’ve been served with a gag order.

These tools don’t prove no logging by themselves, but they show a provider is trying to be accountable. For example, IVPN publishes detailed transparency reports showing every request they’ve received and their responses [3]. Mullvad maintains a warrant canary that’s updated monthly.

However, some providers publish vague or infrequent reports. Others use “we have never logged” statements as canaries, which is misleading—because a canary should specifically address secret legal demands, not repeat their privacy policy.

Also, a missing canary isn’t definitive proof of a secret order. It could mean negligence, technical issues, or even the company going out of business. But combined with other evidence, it’s a useful red flag.

Check our warrant-canary list to see which providers maintain active, meaningful canaries.

Why Free VPN Apps Are Structurally Likely to Log

Free VPNs have to make money somehow. Since they’re not charging users, they often monetize through data collection. This isn’t speculation—it’s documented. Many free Android and iOS apps have been caught harvesting browsing data, device identifiers, and even selling access to user bandwidth via proxy networks.

For example, research has shown that some free VPNs inject tracking headers, log DNS queries, or route traffic through third-party ad networks [1]. Because they’re not transparent about ownership or infrastructure, you can’t verify their claims.

The business model itself creates a conflict of interest: the more data they collect, the more valuable they become to advertisers or data brokers. That’s why we maintain a free-honest list—only a tiny fraction of free services meet basic privacy standards.

If you need a free option, consider alternatives like Cloudflare WARP (which doesn’t claim anonymity) or Tor. But don’t expect real privacy from most free apps. As the saying goes: if you’re not paying, you’re the product.

How to Grade Any VPN’s No-Logs Claim in 5 Minutes

Here’s a quick checklist to evaluate any provider:

1. Has it been tested in court or by a raid? Look for documented cases where law enforcement asked for data and the provider had nothing to give. See our court-proven list.
2. Has it undergone a public, independent audit? Check if the audit covered logging systems and was done by a reputable firm. See audited.
3. Does it publish transparency reports? These show how often they get legal requests and how they respond.
4. Does it maintain a warrant canary? A regularly updated canary suggests accountability. See warrant-canary.
5. Is it free? If yes, assume it logs unless proven otherwise. See free-honest.

If a provider scores high on this list, it’s more trustworthy. If it relies only on policy text, treat it with skepticism.

Also consider ownership: who runs the company? Is it based in a surveillance-heavy jurisdiction like the U.S. or U.K.? Does it accept anonymous payments like cash or cryptocurrency? These factors affect risk.

Use our independent and no-kyc lists to find providers that minimize trust requirements.

Finally, remember: no VPN makes you anonymous. It shifts trust from your ISP to the provider. Your goal should be to minimize that trust through verifiable evidence—not marketing promises.

(aktuell passen keine Anbieter - sieh dir die gesamte Vergleichstabelle an.)