Supposedly protecting your privacy, are VPNs really?

The purpose of VPNs is to strengthen the security and confidentiality of your online data. A noble cause, but not always respected. To know which publishers are trustworthy, one characteristic should catch your attention: activity logs.

These files contain sensitive information about your identity, history, and browsing habits. Their collection and storage is therefore contrary to the protection of your privacy, even though the primary role of VPNs is to help you preserve it.

In this context, services that establish a “no-log” policy, such as NordVPN, are to be favored. A look back at this term and its limits.

There is no such thing as “zero log”

A “no-log” banner proudly displayed on a VPN website inspires confidence. Should we therefore conclude that the company does not collect any personal data? No, because certain information is essential to provide such a service.

And it all starts right from the subscription, with the communication of your name, your email address and your payment method. Up to this point, nothing more standard. But from the first use of the VPN, the line between the useful and abusive recording of your data becomes more blurred.

Knowing the number of people connected to their servers simultaneously, the overall amount of data passing through them and any malfunctions, contributes to improving the quality of service. This collection does not represent any danger in itself, provided that the data is properly anonymized, i.e. not linked to your identifier or your IP address. What about other information collected by VPNs?

Activity logs: sometimes a necessity

The most sensitive data, the kind that puts your privacy at risk if compromised, associates your identity with your digital activity. Some VPNs temporarily log your data for useful purposes, and less scrupulous ones resell it to third parties.

Only VPNs that truly have a “no-log” policy do not keep activity logs. But here again, beware of scams, as some providers misuse this term. The most reliable ones, such as NordVPN, indicate on their website whether this point has been verified by an independent auditor.

Although these activity logs are criticized, publishers offering subscriptions limited in terms of bandwidth or number of devices supported need them. They then collect:

• your original IP address and the one assigned by the VPN;
• timestamp of connections and disconnections to VPN servers;
• the volume of data exchanged daily on their network;
• the number of devices connected to the service.

The most serious VPNs erase them quickly, once the subscription terms and limitations have been verified. The panel of aggregated data is certainly massive, but anonymized. This practice therefore represents no risk for the user.

Logs: the stock-in-trade of free VPNs

Free VPNs are generally the worst performers and collect absolutely all the information they can about your activity. Brand and type of devices used, operating system, location, URLs of sites visited, time spent on each page, nothing escapes them. This data is resold at a high price on the targeted advertising market (or even on the dark web for the most dishonest VPNs).

On this point, even if the design of free VPNs is sometimes laudable, the risk of compromise is high. Cyberattacks have been intensifying for several years and no company is truly safe. Placed in the wrong hands, this data can have serious consequences: phishing, hacking, or worse, identity theft.

A study conducted last January by The Best VPN indicates that out of 118 VPNs analyzed, 26 collect problematic data. Hence the importance of checking the service’s privacy policy before subscribing to it and of favoring VPNs that promote “no-log”.

Beware of the laws in force in each country

The personal data collection policy is not always at the sole discretion of the publisher. Since 2018, the GDPR requires European companies to record as little sensitive information as possible, and to expressly notify users of this.

Across the Channel and across the Atlantic, privacy is not as protected. Authorities can require VPN providers to keep activity logs and request their consultation in the event of an investigation. In 2011, hacker Cody Kretsinger was arrested in this way.

As a law-abiding person, you probably don’t care about this open communication with government agencies. While you’re not at risk from a legal standpoint, these recordings still pose a danger to your digital identity and finances if they’re compromised.

NordVPN: a premium service guaranteed “no-log” »

In the vast VPN market, NordVPN stands out as one of the best performers. And for good reason, its solution is highly secure and respectful of privacy.

NordVPN does not record any activity logs, as evidenced by the latest audit conducted in December 2023 by the Deloitte firm. In addition, the firm promises optimal data encryption, based on the AES-256 bit algorithm. With its kill-switch feature alerting you in the event of a disconnection to the VPN server, there is no risk of your information being exposed without your knowledge.

With 6,392 servers in 111 countries, NordVPN routes your IP address to the geographic region of your choice. Since each of them is obfuscated, when you connect in the most restrictive states like China and Iran, the authorities can’t detect that you’re using a VPN.

To go even further in terms of security, NordVPN protects up to 10 of your devices against major cyber threats (including malware), tracking and unwanted ads. All with the promise of an ultra-fast connection and without ever limiting your bandwidth. The program continuously scans the dark web and alerts you as soon as your personal data is compromised (option reserved for NordVPN Advanced or Ultimate offers).

And to help you secure your online accounts even more, the publisher provides you with its NordPass password manager.

All these features make NordVPN one of the most comprehensive and affordable in the industry, with prices starting at just €3.09 per month with three months free for a 2-year subscription.