(Credit: Lily Yeh/PCMag/iStock/D3Damon)
When VPNs mention "logs," they’re talking about records of your online activity—like your personal info, browsing history, and data usage. Most websites and services, including your internet service provider, already collect this kind of data using cookies, trackers, and ads. These bits of information help build a digital fingerprint that can be used to identify you and target you with ads. While a VPN can help block this kind of tracking, it also has the ability to collect logs itself. Here’s how to find out if your VPN keeps logs—and why that matters for your privacy.
This article was made possible in part by Proton VPN. It was written and edited independently without partner oversight.
Does Every VPN Keep Logs?
It depends. Most make sufficient efforts to minimize data retention, but the majority retain some form of temporary data just so you can use the service. A good VPN won’t retain identifying information such as your IP address or browsing activity. However, some services do keep anonymized aggregate data for analytics. While it isn’t very likely for this information to be used in a malicious attack, it is still personal data, and it could theoretically be used to identify you.
You’ll see the term “no-log VPN” used by a lot of services. A service that uses this term claims that it doesn’t keep user data in any accessible form. However, some short-form retention is necessary for a network application to work properly. This information tends to consist of connection timestamps and bandwidth usage, and it's often kept in RAM-only servers that automatically get erased when you disconnect from the VPN, or on some regular schedule.
Some companies go one step further with privacy and use a zero-knowledge (ZK) approach. ZK, as a standard, has more weight behind it than simply claiming not to retain logs. To be considered a zero-knowledge VPN, a company cannot have access to user data in any readable form, including by employees. This obfuscation is often achieved with a combination of cryptographic keys, RAM-based servers, and strict security measures to ensure compliance.
How to Tell if Your VPN Keeps Logs
At first glance, it can be difficult to glean what information a VPN actually retains. It requires digging to get the fine details. You should skip all of the flashy landing page claims and go right to the privacy policy.
Recommended by Our Editors
When I test VPNs, I go through the policy in fine detail. It should outline exactly how the company handles user data. You’ll find out what a company really means when it says it is no-logs or zero-knowledge. There will be variance between VPNs that use the same terms, so it is worth scanning the privacy policy even if you see familiar claims being made.
Ultimately, you have to take all of these claims at face value unless they have been substantiated by a third party. One way that is done is through security audits. A company will work with firms such as Deloitte, KPMG, and Cure53 to independently verify its privacy policy, security claims, and compliance measures. If a report is available, I recommend reading it or the summary of findings. It will offer great insight into a VPN’s privacy practices. Pay attention to when the last audit was performed. An audit from a few years ago likely won’t be representative of the service today. VPNs that value privacy and transparency undergo frequent, annual audits to ensure consumers are informed.
Another good indicator of privacy compliance is a transparency report. This is often a self-published document that outlines the requests the VPN has received from copyright holders and law enforcement agencies.
What to Do if Your VPN Keeps Logs
Simply put, I recommend picking a different service if you find out that your preferred VPN keeps logs that you are uncomfortable with. You don’t have to compromise your privacy to get a good deal. There are plenty of affordable VPNs out there that don’t retain logs and deliver an excellent service.
On top of that, consider using an ad blocker, password manager, and private browser to build up a robust privacy toolkit that you can tailor to your needs.