Darkest under the lamppost? Up to 8 out of 10 VPN apps break the GDPR

There has been a lot of talk about VPN clients in recent months, including thanks to numerous promotional campaigns with the participation of influencers who tout these tools as the perfect way to complete online privacy. Less is said about VPNs they are not a virtual invisibility cloak that provides us with full invisibility on the web,

Equally little is said about the fact that these guardians of privacy they themselves have a problem with taking care of the privacy of their users. A – – definitely something to talk about.

Up to 8 out of 10 VPN clients violate EU GDPR regulations

PrivacyTutor experts took a look at 144 VPN services. The results of their analysis are quite astonishing. It turns out that up to 8 out of 10 VPN clients violate the provisions of the GDPR. 76 percent web VPN clients and 79 percent. Android VPN apps analyzed tracks users using cookies.

What’s more, 72 percent of them do not ask us for permission at all, which is in complete contradiction with EU regulations.

If VPN providers use cookie-based web tracking and analysis services, such as Google Analytics, this is only permitted with the prior express and voluntary consent of the user

– explains Phil Salewski, a lawyer from the IT-Recht Kanzlei law firm.

VPN apps for Android smartphones are the most disturbing.

The application turned out to be the record holder here iTop VPN, in which as many as 17 trackers were sewn. In total, only 12 providers offer a completely tracker-free service (for both the web version and the Android application). This list included, among others: Mullvad, AirVPN and ProtonVPN.

Interestingly, while 80% of of surveyed services boast that they do not collect any information about users (including logs), only 17 percent. agreed to an external audit to verify these claims.

How does a VPN work?

VPN is short for virtual private network. As part of the VPN, a virtual tunnel is created that directly connects the recipient’s computer (internet users) with the sender’s network (the company responsible for the given VPN solution). This tunnel – although in fact located on the public network (Internet) – is a private connection between the receiver and the sender, therefore, theoretically, no one from the outside is able to see what data is transferred to it. Provided, of course, that the connection is properly secured (encrypted).

Only the VPN provider’s servers connect to the website’s servers on the network, which the user wants to visit on the Internet (this connection can also be encrypted with the HTTPS protocol). It is analogous the other way around. The data goes first to the provider of a given VPN solution, and then to the end user.