Do VPNs Keep Logs? How to Read the Evidence

How to Judge a VPN’s No-Logs Claim in 5 Minutes

You’re looking at a VPN provider’s website. Big, bold text screams “NO LOGS!” in green letters. That sounds good—until you remember that every shady service says the same thing. The truth is, a no-logs policy is meaningless without proof. Anyone can write it. What matters is whether it holds up when tested.

Here’s how to assess a provider in under five minutes:

1. Check for real-world legal tests—has law enforcement ever seized their servers, and did they find anything?
2. Look for independent audits—are they recent, public, and do they cover server configuration and logging practices?
3. Read their transparency report—do they publish how often they get legal requests and how they respond?
4. Find their warrant canary—is it current, and does it clearly state when they’ve been compelled to log?
5. Avoid free apps—they almost always monetize your data because bandwidth isn’t free.

If a provider can’t answer these, assume they log. Your privacy depends on it.

Court-Tested No-Logs: When Police Raid and Find Nothing

The strongest evidence a VPN doesn’t log is when authorities try to get data—and get nothing.

In 2023, Swedish police raided Mullvad’s offices, demanding user data tied to a criminal investigation. They left empty-handed. Mullvad had no logs to hand over, not even account details beyond a randomly generated account number. The case was widely reported and confirmed by Mullvad’s own transparency report [3]. This is rare. Most companies fold or hand over something. Mullvad didn’t—because there was nothing to give.

Similarly, Private Internet Access (PIA) faced two major incidents. In 2016, an FBI investigation led to a server seizure. The provider claimed no logs—and forensic analysis of the seized server found no user activity data. Then in 2018, another server was compromised via a third-party provider, but again, no user logs were exposed because they weren’t stored. These cases are documented in PIA’s transparency disclosures and widely cited in privacy circles [3].

Then there’s OVPN, a Sweden-based provider. In 2021, they received a data request from U.S. authorities. They responded: no logs, no data to provide. Their transparency report details the request and their refusal to comply due to lack of data [3].

These are not hypotheticals. These are real legal pressures where the rubber met the road. Providers that survive these tests earn trust. You can find more of them in our court-proven list.

Audits: What They Cover (and What They Don’t)

An audit is better than nothing—but not all audits are equal.

Some providers pay firms to review their code or infrastructure. The best ones are independent, public, and technically deep. For example, IVPN has undergone multiple audits by Assured AB, a Swedish security firm. These audits checked server configurations, memory usage, and logging mechanisms. They confirmed IVPN’s servers run in RAM only, with no persistent storage—meaning logs can’t survive a reboot [3].

But audits have limits. Some only review apps, not servers. Others check for malware but ignore data retention policies. A 2020 audit of a major provider found their app didn’t leak IP addresses—but said nothing about whether the backend stored connection timestamps or bandwidth usage.

Always ask:

• Was the audit done by a known, independent firm?
• Does it cover server infrastructure, not just the app?
• Is the full report public, or just a summary?
• Does it test for actual logging, or just security flaws?

If the answer to any is “no,” treat it as marketing. Real audits are transparent. You can explore audited providers in our independent and audited comparisons.

Transparency Reports and Warrant Canaries: The Canary in the Coal Mine

A transparency report tells you how often a VPN gets legal requests and how they respond. It’s not proof—but it’s a signal.

IVPN, for example, publishes quarterly transparency reports. They list every government request, court order, or subpoena—and whether they complied. In most cases, they couldn’t comply because they had no data [3]. This consistency builds credibility.

Then there’s the warrant canary. It’s a statement that says, “We have never been forced to log user data.” If the canary disappears, it might mean they’ve been served with a secret warrant.

But canaries can be tricky. Some are vague. Others expire without explanation. A strong canary is specific, dated, and updated regularly. IVPN maintains a warrant canary that explicitly states they’ve never installed monitoring software or handed over logs [3]. You can monitor these in real time on our warrant-canary tracker.

Without these, you’re flying blind. A provider that refuses to publish transparency data likely has something to hide.

When No-Logs Claims Fail: HMA, IPVanish, and PureVPN

Not all providers pass the test. Some lie.

In 2011, Hidemyass (HMA) handed over logs to the FBI that led to the arrest of several individuals, including a hacker tied to LulzSec. Despite claiming “no logs,” they stored IP addresses, connection timestamps, and user activity. The logs existed. The claim was false [3].

In 2016, IPVanish was acquired by a U.S.-based company. Before the sale, they claimed no logs. Afterward, they admitted they did log connection records—including IP addresses and timestamps—and handed data to the FBI in a child exploitation case. The pre-sale claims were retroactively invalidated [3].

PureVPN is another case. In 2017, they provided logs to the FBI that helped identify a cyberstalker. Their support team confirmed they retained connection logs for up to five months. Again, their no-logs policy was exposed as false [3].

These aren’t edge cases. They’re warnings. A provider can change ownership, policy, or compliance stance overnight. That’s why you need ongoing proof—not a one-time promise.

(no providers match right now - see the full comparison table.)

Why Free VPNs Almost Always Log (and Sell) Your Data

Free VPNs have a business model problem: bandwidth costs money. If you’re not paying, someone else is—and that someone is usually you.

Many free apps log your browsing history, device info, and location. They sell this data to advertisers or data brokers. Some inject tracking headers. Others bundle malware.

Take Hola VPN, which in 2015 was found to be turning users’ devices into exit nodes for a paid proxy network, without consent. It wasn’t just logging—it was exploiting users as infrastructure [3].

Free mobile apps are especially risky. A 2016 study of 280 Android VPNs found that a third contained malware, and many leaked data or injected ads [1]. The Federal Trade Commission has taken action against several free VPNs for deceptive practices.

If a free service offers “unlimited” data, ask: what’s the real cost? Often, it’s your privacy. For alternatives, see our breakdown of the free VPN trap.