When you install a VPN, you’re trusting another company with a large part of your internet traffic. Most people do this because they want more privacy, which makes Proton VPN’s latest findings pretty damning.
After examining more than 7,000 mobile VPN apps around the world, Proton says 85% of the VPNs in its US analysis contain trackers used for analytics, advertising, or profiling. Some of these apps can also access information such as your device ID, phone model, network type, mobile carrier, and even your physical location.
What is your VPN collecting?
For the analysis, Proton used Exodus Privacy, an open-source platform that searches Android apps for known tracker code. Finding one of these trackers does not necessarily tell us exactly what information a particular VPN is collecting or what it eventually does with that data.
Even so, putting extensive tracking inside a VPN is difficult to defend. Privacy is one of the main reasons people install these apps, so loading them with analytics, advertising, or profiling tools goes directly against what users expect.
Physical location is particularly concerning. Proton found 64 VPN apps capable of accessing GPS and other geolocation data. According to the company, these apps accounted for more than 3 million US downloads in June alone.
Proton’s warning is not the first sign of trouble either. Earlier this year, researchers testing 281 free Android VPN apps found 76 sending device identifiers such as Android’s Advertising ID to third parties, while another 29 leaked browser or DNS traffic outside their encrypted tunnels.
Do you know who owns your VPN?
Proton also looked at the companies behind these apps. It found that 64 of the 390 VPNs downloaded through US app stores were owned by Chinese companies, while 31 allegedly obscured that ownership behind companies registered elsewhere.
Apps containing trackers that sent data to companies in China accounted for 1.5 million US downloads in June. Another 1.4 million downloads involved apps with trackers sending data to Russia, according to Proton.
None of this means every VPN is secretly spying on its users. The earlier Android study focused specifically on free VPNs, while Proton’s findings also raise concerns around questionable services with unclear ownership and aggressive tracking.
Seeing “VPN” in an app’s name is not a reason to download it without looking into who made it and what data it collects. Otherwise, the app installed to improve your privacy could end up doing exactly the opposite.