On each VPN provider’s website, you will usually find the “no logging” notice prominently displayed in large print on the home page.
But by analyzing its privacy policy rules and paying attention to the information in the small print, you realize that in reality the provider often logs some of your information, even if it claims otherwise on its home page.
If a provider has a limited sense of morality, it can monetize your personal information as an ISP.
Government agencies can also put pressure on the VPN provider to provide customer information. Therefore it is important to read and understand a VPN’s privacy policy.
Don’t worry, we’ve read it all for you.
We have concluded that expressvpn only records information on the total amount of data transferred, the day the connection was established, and data on speed, connection failures or incident reports.
The provider explains that these data are completely anonymous. So there is no way of knowing from which customer a speed test result comes from. In addition, you have the possibility to select an option specifying that no telemetry data should be sent to expressvpn either at the time of installation of the application or even afterwards in the settings.
The recorded data never includes what the user does when connected to the server:
– No data on the content or destinations of VPN traffic.
– No DNS Queries
– No IP addresses.
The policy goes on to explain that it cannot associate a user with an IP address or other activity. That’s what we wanted to hear from a VPN provider.
ExpressVPN’s location is a positive point, as its headquarters in the British Virgin Islands offers enormous advantages in terms of privacy.
The country is not part of the 14 Eyes alliance (see article) and has signed no agreements on intelligence sharing.
Despite its small size, the British Virgin Islands regulates its own affairs and the United Kingdom or the United States has no jurisdiction to compel ExpressVPN to disclose data.
In order for ExpressVPN to compel the disclosure of a customer’s data, a plaintiff would have to apply to the High Court of the British Virgin Islands. In addition, the plaintiff would have to demonstrate that the records relate to a serious crime and explain how the data may provide relevant evidence. It is difficult to see how ExpressVPN’s minimal recordings could provide useful evidence.
We would still like to see ExpressVPN allow a specialized agency to audit and report on their systems and procedures as nordvpn has done.