VPN Logging Policies: Does your VPN Keep Logs?

Exposed – Many VPN Providers Log Your Data

However, if any provider keeps an extensive number of logs or the provider comes under 5, 9 & 14 eyes jurisdictions due to which they have to disclose transparency reports, then it’s better to avoid those VPN providers.

Also, different VPN providers do different types of logging activities. So, before getting into which VPN providers are safe and which are not, let’s first cover the different types of VPN logs that VPN providers keep, as there’s a handful of VPN providers who have been put to the test and verified their Zero Log Policy claims. And, until an incident occurs such as a subpoena from the Government, no one can tell whether a VPN provider is entirely safe or not. It doesn’t mean that a VPN should not be used and some are even transparent about their logging activity, but you must be aware whether it’s a reliable product.

Generally, there are two different types of VPN logs, namely, Usage/Activity Logs which invades privacy and then Connection Logs which are quite harmless and are often deleted after one or two weeks.

Depending upon the VPN providers activity/usage logs vary, but the majority of Free VPNs keep track of these. Because, Free VPN services need to pay for expansion of their servers, updates of the software, website expenses, technical support, data centers and much more which are not free So, they likely sell the users information to third-party services.

Usually, these connection logs collect IP addresses, connection date, time, and location. However, VPN providers do not reveal your identity, location, connection time, and date directly. Some VPNs who collect connection logs, despite claiming to support Zero Log policy are TunnelBar, Betternet, Proton VPN, and PureVPN. Though the good part is that, it’s temporary like for one to two weeks, and like HideMyAss some goes up to 6 months, but after that it’s deleted. So, as per the perspective of privacy, to some extent it’s intrusive.

Here, Warrant Canaries come in, and it’s not related to logging any information regarding connection or activity. But they are the landing pages which are advertised by the VPN providers to maintain their privacy. It’s a published statement on a specific page which confirms that service has never received any secret warrant till date. However, if the page stops publishing a regular statement, it means the canary statement is removed, which means the subpoena is issued towards that VPN provider while prohibiting them from reporting it.

Though, the use of this “Warranty Canary” does have particular queries. For example, why a “Warranty Canary” is needed if a VPN provider claims to have a no logs policy. And, they are updated once a month which makes them a bit useless. However, it was essential for making the readers aware, so a little insight has been given in this post.

Troubleshooting is one of the common reasons for data logging. For example, while using a VPN, you may encounter connectivity issues, WebRTC leaks, or other related issues. If there’s a log of your data, it can prove beneficial in optimizing the VPN network as well as to solve the problems. Also, majority of the VPN troubleshooting, or maintenance does require little connection logs.

Moreover, the Government intelligence security organizations such as the GCHQ (Government Communications Headquarters) and the NSA (National Security Agency) spy on the UK and the USA based tech companies, as a part of surveillance program PRISM since 2010, which issues a “gag order” for demanding logging files of any tech company without disclosing it to the target user. And if the issued “gag order” is not followed, it can even be counted illegal.

Though Astril VPN is far away from the 5/9/14 Eyes alliances located in Seychelles, it still records individual connection logs. If you visit their Privacy Policy page, first you’ll find the claim which says, they keep as little information as possible. But, reading further you will find certain points, such as

As per these above statements, we can say that Astrill does collect the actual logs such as Connection timestamps, devices used, users’ country and even the IP address.

Also, the question of the FAQ section, “Does Astrill keep any logs?” states that it’s done only for the ACTIVE sessions for monitoring the simultaneous connection from one subscription. And, claims to remove the logs once the session is over. So, if you’re looking for any VPN with zero-log policy, then its better you look any other providers.

Anonymizer is considered as a part of an “Internet Enemy” country, as per the Reporters Without Borders. It follows the government laws which involve 5/9/14 Alliances. So, it’s legal to say that Anonymizer does keep user’s VPN logs and if the subpoena with a gag order gets issued to them, they won’t be able to say no and have to provide all the details. Moreover, the terms of service page have been removed. But luckily, I was able to find the statement written into it:

To be more precise, Anonymizer VPN logs whatever they can and if that’s not enough, on their website homepage they had even stated, “You’ll never have to worry about keeping track of your usage or connections”, which is quite contradicting.

Though Avira Phantom privacy policy claims about not storing any activity/usage logs, they do track VPN bandwidth and timestamps, which raises a concern as being under the 14 Eyes country.

Being headquartered in Malaysia, BolehVPN is entirely safe from the 5/9/14 Eyes jurisdiction. And it even claims that “BolehVPN does not keep logs of user activity or access. We do keep logs of general traffic throughput of our servers to ascertain loading and usage of our servers but not at an individual level. However if we do notice any unusual activity on our servers (high bandwidth loading, high number of connections or cpu usage) we may turn on logs temporarily to identify abuse of our services (such as DoS or spamming through our servers).”

But I like their openness. If you visit their TOC page, below lines are written:

By looking at these types of contradictory statements, we think it’s better to avoid such VPN providers and instead go for others.

Canada being part of Five Eyes Alliance, makes FlowVPN bit questionable. Furthermore, the statement made by Flow VPN is also something making it more doubtful.

For instance, if you look through TOC page of the provider, it says “Upon installation of the client application all users are allocated an Account Name against which we reserve the rights to log subscription information (including transaction references), connecting IP address, authentication requests, session data (allocated IP, connection date, time, duration, etc).” It has a hidden message in it, through which users can be fooled.

Further, it even goes on stating, “To comply with the requirements of our bandwidth providers we reserve the right to log activity across our network and use automated systems to monitor network activity for abuse (such as use of BitTorrent and similar peer-to-peer file sharing).”

Likewise, most users that are also looking for safe Torrenting or log-free VPN connections, you’ve to look somewhere else.

Also, their logging policy (for which they are quite frank), gives alarming information that users can be traced back, though it doesn’t record the content of the communications. For example, in their privacy page, it has stated:

Likewise many VPN providers, HideMyAss also claims the same thing, “We do not collect or store your IP address, your DNS requests, your application or online services use, or the websites you visit.”

However, in the past HideMyAss was involved in an FBI case, where they had handed over the details such as bandwidth data, real IP address, VPN address, timestamps to the intelligence agency for tracking down LulzSec Hacker. The same information has also been posted on their website’s blog, though it has been deleted. Also, we’ve found through internet archives that despite of no-log policy claims they do maintain the logs and user privacy is not 100% or else it wouldn’t have been possible to provide any information if they weren’t.

Headquartered in Cyprus, it’s safe to say that retention laws are not mandatory on IPredator and their belief for users’ rights to their privacy even help them gain a bit of fame in the market. However, according to their “Legal” page, it does collect users data at a certain level. For instance, it claims, “We minimize the use of logs within our systems and only grant access to them to a selected number of staff for debugging when service quality is an issue.” Here, the collected information includes users’ name, email address, payment data and telephone number.

Likewise, they share the legal Canary statement, which says that the data can be collected and can be given to a law-abiding agency if it’s demanded, without informing the targeted user.

Also, when you go further down the page, you will find that their claim contradicts itself, as they do collect session information though only for 72 hours, which includes:

• Date and Time of the connection and disconnection.
• Real IP Address and the assigned VPN Server of the user.
• Bandwidth consumption per session in a numerical representation.

Granted, Sweden is a bit lenient towards terms of user privacy and even PrivateVPN claims that they don’t log any user information, but being from the country with data retention laws it might backfire, as they have to provide the user information, upon receiveing a subpoena with a gag order from the Government.

And, here our curiosity turns out true. Currently, ProtonVPN is fighting with the accusations put on them being related with “Tesonet” a data mining company, that has even signed their Google Play Store Android application.

Moreover, it’s even been claimed that ProtonVPN does maintain connection timestamps, which can be linked with real IP addresses or accounts of the users.

No doubt, they are doing a great job with their anti-virus software, but when it comes to VPN service, it is not something which can be considered. Despite giving good customer support and other essential features like No IP or DNS Leaks, they miss one of the crucial elements of VPN, which is logging users’ information.

If you go through their Policy, it has claimed right off the bat that AVG Secure VPN does collect user’s data which is kept stored from one month. Also, the information collected by them is your connection timestamps, your original IP address subnet, IP address of the VPN server you connected, amount of data being transmitted. Moreover, they have also claimed

By going through their Privacy Policy page, their claim, “Hotspot Shield replaces your IP address with an anonymous proxy IP address associated with one of our servers so that your actual IP address is not shared with the websites you visit.” It looks all good, as expected from any VPN provider.

However, the recent study of CSIRO says a different story. As per them, Hotspot Shield has used tracking codes which gather and sell the information of their users to third-party advertisers. Also, Hotspot Shield has been charged with a complaint by a non-profit advocacy group of digital rights, the Centre for Democracy and Technology (CDT), regarding this activity of spying on their users and collecting their data.

Based in Canada, Betternet already comes under the Five Eyes Alliance, making them questionable. Further, they also provide “FREE VPN,” which makes it questionable if they might be logging users’ data. Also, they store information like your actual IP address and browsing activity. Though, their FAQs claim, “Betternet does not collect, log, store, share any data log belonging to users.” But they have also been found collecting users’ browser logs.

Also, we are judging based upon the Free VPN service provided by them, which is mostly run on an ad-revenue model and even sold to third parties.

Finally, we would say all VPN providers differ from each other and it’s same for the data retention law as well Different countries will have different laws to follow, even if they come under 5//9/14 eye jurisdiction.

As a user, your major concern should be about the type of data is logged and how long it’s kept in their database. If it’s under data retention law-abiding country and also logs a lot of information, then it’s better to go with another one. Lastly, it’s recommended you go through their privacy policy, before deciding to purchase a VPN. So, you can have a clear idea what you’re up to.