VPN Logging Policies: What to Look For

Data points that a VPN might record fall into three broad categories: activity logs, connection logs, and aggregated logs. Knowing which data belongs in each one is the key to protecting your privacy.

1. Activity Logs

Collecting activity data is the most invasive type of logging. It removes any privacy or anonymity benefit that a VPN might otherwise offer.

Also known as “usage logs,” this covers any data explicitly tied to your online activity.

Hola VPN’s privacy policy provides a good example of activity logging:

Free VPNs like Hola VPN are common culprits. This data is often shared or sold to third parties for advertising, effectively subsidizing the cost of a “free” subscription.

Not all activity logging is equally damaging, though. Some subscription-based “no-log” VPN services monitor activity only if they’re suspicious about an individual, or if they’re legally compelled to. Others record activity in real time and delete it the moment your session ends.

When I reviewed SkyVPN, for example, I found the service logs personally identifiable information such as your originating IP address and location, but keeps it only for as long as your session is live.

Activity data that’s discarded the moment you disconnect is far less dangerous than activity data that’s stored, simply because there’s a much smaller window in which it can be requested, leaked, or seized. It’s not something I’d choose, but it’s a world away from a provider building a permanent record of where you go online.

Other providers make activity logging much harder by design. The strongest examples run RAM-only (diskless) servers that wipe on every reboot, so there’s no long-term record for anyone to seize. It isn’t an absolute guarantee, since hardware that can’t store data permanently can still process it in the moment, but as architectural safeguards go, it’s the best one available, and one of the first things I look for.

Needless to say, any VPN storing full activity data should be avoided at all costs. If this concerns you, jump to the popular VPNs that log activity data.

2. Connection Logs

This type of data tends to be metadata about your VPN sessions rather than a record of what you did during them.

Connection logs can be collected at the server-level (e.g. total server bandwidth usage) or the user-level (e.g. your originating IP address).

Typically, this data is used to optimize network performance and troubleshoot support queries.

Server-level connection logs are a great example of why not all logging is a problem.

It’s practically impossible to run a VPN network without recording any data at all. In fact, storing the right, non-identifiable data helps ensure you get the best possible experience.

Storing the wrong connection logs, however, could let a VPN match you to your activity, and personally identify you.

That’s a serious problem for privacy-conscious users. Read on to find out exactly which logs are acceptable and which aren’t.

Claims that detailed data is only used to “deliver the best possible experience” or “improve customer service” are rife.

But after years of testing these services, I know the level of detail shown above in Avira Phantom VPN’s privacy policy simply isn’t necessary to run a well-performing VPN network. Some of the fastest VPNs I’ve tested are also among the ones collecting the least data.

And it’s not just one provider. Plenty of trusted security brands hold more connection data than you’d expect. F-Secure’s FREEDOME VPN, for instance, doesn’t log the websites you visit, but it does keep identifying connection data: your source IP address, a device ID, connection timestamps, session duration, and the volume of data transferred. Its provisioning logs, which include your IP address and device ID, are kept for a full year.

This matters because any log that exists can be handed over, or seized. In January 2019, Finland’s National Bureau of Investigation seized FREEDOME’s connection logs at the request of German police.

A court later ordered the logs destroyed, but the lesson is simple: a VPN can only surrender the data it chooses to keep in the first place.

3. Aggregated Logs

Some of the most popular VPNs collect aggregated logs. This means gathering information that’s supposedly anonymized and impossible to link to a specific user.

A VPN might collect the sites you visit, the bandwidth you use, or your connection times, then strip out any identifying factors and add it to a larger database.

Be aware that some VPNs claim that they don’t keep logs when in fact they keep aggregated logs. Hotspot Shield’s privacy policy, above, is a good example of what to look out for.

Ultimately, aggregated and anonymized data isn’t always the magic bullet that marketing teams claim.

The exact data being aggregated, and the strength of the anonymization, decides whether this type of logging is acceptable. You have to trust that your VPN service is anonymizing effectively.

If that’s a leap of faith you’re uncomfortable with, you’re better off choosing a truly no-logs VPN service.

What Is a No-Logs VPN?

A truly no-logs VPN service doesn’t collect or store any activity or connection data that could be used to personally identify you. Most importantly, it won’t hold any information transmitted through the VPN tunnel whatsoever.

This ensures no user can be tied to any specific activity or connection on the network. Every user stays private, anonymous, and unknown even to the VPN provider.

For most no-logs VPNs, the only identifying information they hold is your email address (to register your account) and billing details (in case you want a refund). Some go further and collect even less.

A genuine no-logs VPN can’t hand your activity or connection data to authorities or third parties, for the simple reason that it never had it.

That’s how a strong logging policy offsets the risk of an unsafe VPN jurisdiction, although as I explain below, it doesn’t remove that risk entirely.

It’s worth noting that “no-logs” doesn’t mean that absolutely no data is kept at all. Genuine “zero logging” is effectively impossible while maintaining a strong network or enforcing device limits.

Most no-logs VPNs keep very basic data such as aggregate server load (the number of users or bandwidth per server). This involves no identifying information whatsoever, and it’s still classed as a no-logs VPN.

The strongest providers reinforce this by running RAM-only servers and publishing independent audits.

VPNs are privacy tools above all else, so some data should never be collected. But not all logging is dangerous. The table below shows the difference at a glance.

✅ Acceptable VPN Logging	❌ Unacceptable VPN Logging
Aggregated bandwidth usage	Browsing activity
Aggregated connection logs	Originating IP address
VPN server location	Assigned VPN server IP address
Server load data	Individual timestamps *
Subnet of originating IP address †	Individual bandwidth usage *
	DNS queries

† A fragment of your IP address. It can identify your ISP, but not you personally.

* This data is only dangerous when logged in combination with other detailed connection data.

The rule of thumb: anything that can be tied back to you as an individual is unacceptable. Data that only describes the network as a whole is fine, and often necessary to keep the service running well.

The following VPN services log your browsing activity. This is the most egregious form of logging and should be avoided at all costs.

This is by no means an exhaustive list, and these policies change more often than you’d think. I read them in full rather than relying on summaries, and I’d encourage you to check your own provider’s policy yourself before trusting it with your data.

Provider	Data Logged	Storage Time
Hola Free VPN	Web pages visited Time spent on pages Access dates and times Originating IP address Browser type	“As long as necessary”
Psiphon	Domains visited VPN protocol used VPN session time Bandwidth usage Location data ISP	90 days
UrbanVPN	Extensive web browsing data Unique device ID Originating IP address Location data AI chat prompts and results	“As long as it remains necessary”

Unsuspecting users are routinely misled by vague, false, or deliberately confusing logging policies designed to create the illusion of privacy.

If you don’t know what to look for, you could end up using a VPN service that puts you at risk.

If you’re assessing a privacy policy or about to subscribe, watch out for the following common problems. Already familiar with them? Skip straight to how to protect yourself.

1. False Advertising

Short of an independent audit, it’s almost impossible to truly verify a VPN’s logging policy until it’s too late.

Below are two examples of supposedly “private” or “no-logs” VPNs that were later caught sharing detailed logs with authorities.

In 2011, London-based VPN service HideMyAss (HMA) played a key role in the arrest of Cody Kretsinger, a 23-year-old member of the hacker collective LulzSec.

HMA marketed itself as a privacy-first service, yet when the FBI traced Kretsinger’s activity to an HMA IP address and a UK court demanded logs, HMA complied and handed over the connection data that identified him.

Selling a product that explicitly claims to protect a user’s identity, then doing the opposite, is undeniably deceptive. And HMA isn’t alone.

In 2016, IPVanish cooperated with the FBI in a criminal investigation, providing detailed connection data despite a privacy policy that explicitly promised zero logging.

It’s worth noting IPVanish was under entirely different ownership and management at the time. But the lesson stands: look into your provider’s history before you trust it.

2. Deliberate Ambiguity

In an ideal world, every logging policy would clearly explain what’s kept during and after a session. In reality, many providers rely on ambiguity to manufacture a false sense of security.

Most users don’t realize that broad phrases like “no logs” aren’t always what they seem. Because there’s no standard industry definition of “logs,” providers can avoid stating what type of data their claim actually refers to.

A provider might legitimately advertise “no logs” for activity data, but continue to record personally-identifiable connection data.

It’s also common for marketing to contradict the privacy policy outright: a bold “zero-logging” claim on the homepage, and the data they actually keep buried in the terms and conditions.

I found the perfect example of this on ThunderVPN’s Google Play Store listing. Fortunately, I was able to capture proof of this misleading behavior before the VPN provider could take it down.

The advertised “strict no-logging policy” was completely at odds with its privacy policy at the time.

If a VPN makes contradictory or misleading statements like this about its logging, think twice about trusting it with your data.

3. Lack of Detail

It’s surprisingly common for less popular VPNs to operate with no privacy policy at all. If there’s no detail about data collection on the provider’s website, the VPN shouldn’t be trusted.

Watch out for unusually short policies, too. Plenty simply state something like “we don’t log your activity while connected,” which explains nothing about how your data might be collected in other ways.

Even very well-known security brands can be guilty of disgracefully thin policies. When I went looking for McAfee’s VPN terms, I found the company dedicates just a single sentence of its privacy policy to the product.

Some services are also vague about how their terms are enforced. Dozens boast “no-logs” while warning that they’ll “investigate suspicious behavior” or “ban abusive users” in the same breath.

The obvious question: if a VPN doesn’t log your IP address or activity, how can it investigate suspicious behavior at all?

If a logging policy is short or vague, contact the provider’s support team for details. I do this routinely, and the quality of the answer tells you almost as much as the policy itself. Don’t use a product that won’t take the time to be clear about its practices.

4. Jurisdiction

Logging policies and jurisdictions are closely intertwined. Obscure jurisdictions can be great for privacy, but they can also make a company harder to hold accountable if it deceives customers.

More importantly, a provider’s jurisdiction affects its legal obligation to log data and share it with authorities.

Recent years have seen surveillance laws expand sharply: warrantless collection under Section 702 of FISA in the US, mandatory Internet Connection Record retention under the UK’s Investigatory Powers Act, and data-retention mandates in Australia and India, among others.

These invasive jurisdictions matter far less if a VPN is genuinely no-logs, because there’s nothing to hand over. But choosing a service based outside them can add another layer of protection.

For a full breakdown of the surveillance laws that make this matter, see why a no-logs VPN matters and our VPN jurisdictions guide.

You don’t have to take any provider’s word for it. Here’s the hierarchy of evidence I use to judge a no-logs claim, from strongest to weakest.

• A real-world test. Has a court order, subpoena, or police seizure ever forced the provider to hand over data, and did it come up empty? This is the gold standard. Every no-logs VPN I recommend has passed it.
• An independent audit. A reputable firm (Deloitte, KPMG, Cure53) inspecting the servers and policy. Strong evidence, but an audit is a snapshot in time, not a permanent guarantee.
• RAM-only (diskless) servers. Hardware that wipes on every reboot can’t retain long-term logs, even if someone wanted it to. It’s an architectural safeguard, not a promise.
• A clear privacy policy in a good jurisdiction. Read what it says it collects, and check whether its country forces data retention. On its own, this is the weakest proof, because it’s just words.

And here are the red flags that should give you pause:

• Vague phrases like “we may collect some data.”
• A policy that logs your originating IP address and timestamps together.
• Ownership you can’t trace back to a real, named company.
• A “free” VPN with no clear way of making money.

The bottom line: if a service can’t tell you plainly what data it keeps, assume it keeps too much.

If you’re worried your VPN might not be fully protecting your privacy, there are several steps you can take to keep your data safe.

1. Choose a Verified No-Logs VPN

A handful of providers have had their no-logs claims proven by real-world events, and independently audited too. These are the ones I trust most:

• Private Internet Access: produced no usable data in a 2016 US court case, and Russian authorities seized a server the same year and found nothing. RAM-only network, Deloitte-audited.
• ExpressVPN: a 2017 Turkish server seizure recovered no logs. Runs its entire network in RAM (TrustedServer), with a KPMG audit and 20+ security audits.
• Mullvad: Swedish police raided its office for user data in 2023 but left empty-handed. Collects no email at all.
• NordVPN: in a 2024 legal case, could only produce payment details and confirmation that an email was tied to an account. Panama-based, RAM-only, regularly audited by Deloitte.
• Proton VPN: a 2019 Swiss court ordered it to hand over user data, but it had none. Swiss jurisdiction and annual public audits.

If VPN logging concerns you, a VPN service with a proven track record in the real world is always the safer bet.

2. Prioritize RAM-Only, Audited Providers

Not every trustworthy provider has been dragged into court, and you shouldn’t rule one out purely because it hasn’t.

In the absence of a courtroom test, RAM-only (diskless) servers and a recent independent audit are the two strongest technical signals that a no-logs claim is real.

Favor providers that have both, and that publish the audit in full rather than just referencing it.

3. Sign Up and Pay Anonymously

The less a VPN knows about you, the less there is to log.

Where you can, register for a VPN with a throwaway email address and pay with an anonymous method, such as cryptocurrency or, in Mullvad’s case, cash.

This limits how useful any account data could ever be.

4. Use Multi-Hop Instead of a Single Server

Routing your traffic through two VPN servers (often called multi-hop or Double VPN) adds a layer of separation between your real IP address and your destination.

It’s built into providers like NordVPN and is a cleaner, more reliable approach than trying to run two separate VPN apps at once, which rarely works smoothly, if at all.

5. Combine a VPN With Tor

Used correctly, a VPN together with the Tor browser moves you a step closer to anonymity.

Just remember Tor is slow at the best of times. Every time I’ve paired it with a VPN, speeds have dropped far enough to make anything beyond basic browsing genuinely frustrating.

6. Choose a Privacy-Friendly Jurisdiction

Subscribing to a VPN based outside the major intelligence-sharing alliances is the safest option.

Bear in mind that a friendly jurisdiction alone doesn’t guarantee trustworthiness.

A provider could still cooperate with foreign authorities or log your data if it chose to. Always pair jurisdiction with real-world proof.