A new Proton report has exposed significant privacy failings across popular VPN apps, revealing that a large share of them track user location and harvest personal data. A virtual private network is designed to encrypt internet activity and hide your IP address and physical location, with the aim of keeping your identity and identifying details secure. The findings suggest that many apps do the opposite of what they promise.
Proton found that 64 of the VPN apps downloaded in the US are owned by Chinese companies and contain trackers that collect a wide range of user information, including device IDs, network information, device models and mobile carrier data. Around 25% of the apps in question were found to actively track a user’s location.
Data from millions of users heading to China
In June alone, these apps were downloaded more than 13 million times. Proton further identified that 31 of the Chinese-owned VPNs use shell companies registered in jurisdictions such as Singapore, Hong Kong and the UK to conceal their identities.
An authoritarian government could use this information to track a person’s location. A public official, someone in law enforcement, a journalist or an individual attending a protest relying on one of these VPNs for safety could be exposed to potential threats. China is not the only country where companies harvest such data. Israel, Russia and the Five Eyes nations, comprising Australia, Canada, New Zealand, the UK and the US, all have companies collecting tracking data from millions of people.
Stronger privacy guardrails required
Transparency remains a central concern, with numerous poorly designed VPN apps readily available for download through Apple and Google. Both companies require developers to submit their own paperwork to verify their apps, with little verification and no independent audits carried out on Apple’s or Google’s part. This lack of scrutiny in the verification process makes it difficult to determine which apps genuinely protect user privacy and which do not.
Users seeking a reliable option are pointed towards services such as Proton and ExpressVPN, which regularly rank near the top of independent VPN recommendations after undergoing rigorous testing. The guidance is to avoid any VPN that is unclear about its ownership, base of operations or approach to privacy, and instead choose a provider that is transparent about where it is based, who runs it and how it protects user data.
The 64 flagged apps were downloaded over 13 million times in June, according to the report.
