The most famous logging receipt in VPN history: in 2011 HMA itself blogged that it had handed the FBI the connection logs that convicted a LulzSec member. Fourteen years, an Avast acquisition and a Gen Digital merger later, the no-log policy is stricter (never log IP/DNS/activity; only day + coarse time + volume for 35 days) - but it is still just a policy: no audit, no court test, plus a mobile app stack that runs Firebase and two more analytics SDKs by its own admission. Add the owner's record (Avast's Jumpshot clickstream-sale scandal, FTC $16.5M penalty 2024) and 36-month contracts renewing at full price, and HMA is a mainstream convenience VPN, not a privacy tool.
site reachable · checked 19 h ago · daily check
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 3 · prose updated 2026-10-07 · facts as of 2026-09-29 · how we verify
HideMyAss! (HMA) is a commercial VPN owned by Gen Digital, based in the UK - a Five Eyes jurisdiction. Once infamous for handing logs to the FBI in 2011, it now claims a strict no-logs policy. But its history and ownership under Avast (now Gen Digital), which was fined $16.5M by the FTC in 2024 for selling browsing data, make it a risky pick for privacy. This is a mainstream service with broad server coverage, not a privacy-first tool.
HMA claims it never collects your original IP, DNS queries, or activity logs, storing only the day, coarse time-of-day (morning/evening), and data volume rounded to 0.01 MB - deleted after 35 days. However, this claim is contradicted by its own 2011 blog post confirming it handed connection logs to the FBI that led to the arrest of a LulzSec member. No independent no-logs audit exists. The UK jurisdiction and lack of a warrant canary further weaken trust. Mobile apps use Google Firebase and two additional analytics SDKs, per HMA’s own disclosure.
HMA advertises an intro price of $3.40/month on a 36-month plan, but reverts to a renewal rate of $12.50/month - nearly 3.7x higher. The contract locks you in for 1,095 days (3 years), with a 30-day money-back guarantee. No anonymous payment options are confirmed. The site displays EUR only; USD figures are converted at ECB rates. There is no free tier. The long-term commitment at a steep renewal rate makes this a classic renewal trap.
HMA supports WireGuard and OpenVPN, includes a kill switch and split tunneling, and allows P2P and streaming. It operates 3,400 servers across 65 countries, with apps for Windows, macOS, Android, and iOS. Multihop and Tor over VPN are not offered. While users report decent speeds for casual use, performance for bandwidth-heavy tasks is reportedly lacking. No independent performance tests are available. Obfuscation is not documented, limiting usefulness in highly censored regions.
HMA is 100% owned by Gen Digital, following Avast’s acquisition in 2016 and the subsequent merger. Avast was fined $16.5M by the FTC in 2024 for selling browsing data via Jumpshot - a red flag for privacy. The 2011 incident, where HMA admitted to logging and handing over user data, remains a defining moment in VPN history. Reddit users remain skeptical about server architecture and logging practices. Data quality is reported, not independently verified.
HMA does not document any obfuscation methods like Shadowsocks or obfs4. Its apps do not claim to bypass deep packet inspection, and there is no evidence it serves users in highly censored countries like China or Iran. Given its UK jurisdiction, logging history, and lack of stealth technology, this tool is not suitable for users under repressive regimes. For censorship resistance, consider providers with documented obfuscation and a stronger privacy track record.
Avoid HMA if you have any real privacy threat model - the 2011 logging incident and Avast’s data-selling scandal are damning. It may work for streaming or casual use, but its ownership, jurisdiction, and renewal pricing make it a poor long-term choice. The provider likely pays affiliates (historical CJ links exist), but current program terms are unverifiable. For real privacy, look elsewhere.
| Intro price | $3.40 /mo · renews $12.50/mo |
|---|---|
| Renewal price | $12.50/mo 3.7x intro |
| Refund window | 30 days |
See the 3-year total next to the marketing number: true-cost calculator →
| Sign up at | hidemyass.com |
|---|---|
| Payment | fiat |
| Money-back window | 30 days |
| Apps | windows, macos, android, ios |
Check the renewal price above before any multi-year plan - true-cost calculator.
HideMyAss! is operated by gen-digital. Logging claim: 'We'll never collect, record, or see' your original IP, DNS queries, or activity; anonymous connection data (day + general time-of-day, volume rounded to 0.01 MB) kept 35 days - evidence class: CLAIM CONTRADICTED. Our incident log carries 2 documented incident(s) for this operator - see the record below. Facts reported (not fully verified) as of 2026-09-29 - read the sources below.
Evidence classes and scoring: methodology · user experiences: meta-review.
affiliate status not verified yet via unknown · published terms: not public - no rate we could fetch
hma.com times out from this server entirely; CJ affiliate links to hidemyass.com were captured by Wayback in 2019 ('utm_source=commissionjunction&utm_medium=affiliate') - the Gen Digital brand has run an affiliate program, but its current status is unverifiable from here.
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
Before you pay: check the renewal price, the refund window, and whether a cheaper or free path covers your use case - the honest checklist.
Based on our checks as of 2026-09-29: HideMyAss! (HMA) scores 1.7/10 in our weighted review. We logged 3 red flags (listed above). Its logging claim has been contradicted in a documented case - treat "no logs" marketing as marketing. User reports, ownership and the incident record are documented with dated sources in the meta-review below.
Comparable providers of the same kind only - a free app is never "an alternative" to a commercial VPN. Ranked by the same deterministic score.
A rare genuinely usable free plan (no card, P2P allowed on the 10 GB free tier) plus audited no-logs claims twice over - DefenseCode 2015 and Securitum 2024…
The most honest VPN on the internet, and in 2026 still the one this industry is measured against: numbered accounts, cash or Monero accepted, open-source…
The anti-affiliate champion candidate holds up: no affiliate program (stated out loud on the homepage), flat honest pricing, quarterly warrant canary, annual…
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.