Which VPNs Actually Don't Log You

What Happened

In 2017, the FBI obtained IP logs from PureVPN 1 that directly linked a cyberstalker to his online activity. PureVPN's privacy policy at the time promised it kept 'no logs.' The company later clarified that while it didn't log 'browsing activity,' it did log connection timestamps and IP addresses — which was all law enforcement needed.

In an earlier case, HideMyAss 2 provided logs that helped the FBI identify a member of the hacking group LulzSec. And IPVanish, 3 despite an explicit 'zero-logs' policy, turned over connection logs to Homeland Security in a 2016 case.

These aren't ancient history — they're the foundation for understanding what a VPN does and doesn't protect. Every major 'no-logs' breach involved a provider making a marketing claim it couldn't or wouldn't uphold under legal pressure. The pattern is consistent: the promise is absolute, the reality is conditional.

A VPN is a tool, not a talisman. OPNorange helps you understand the difference — and build privacy architectures that don't depend on a single company keeping its word.

Why It Matters

You're replacing one trust relationship with another

Without a VPN, your internet service provider sees every website you visit, every IP you connect to, and every unencrypted packet you send. A VPN encrypts that traffic and routes it through the VPN provider's servers. Your ISP can no longer see the content — but your VPN provider now can. You haven't eliminated surveillance. You've moved it from your ISP to your VPN.

The question isn't 'does this VPN claim no logs?' The question is: 'what is the structural basis for trusting that claim?' There are three factors that matter: independent audits (has a third party verified the claim?), jurisdiction (where is the company incorporated, and what legal obligations does that create?)

, and infrastructure (is the system architecturally designed so that logging is difficult or impossible, like RAM-only servers that can't store data persistently?).

The providers that have earned some trust

Mullvad, a Swedish provider, accepts Bitcoin and cash payments, requires no email address to sign up, uses RAM-only servers, and has been independently audited multiple times. In April 2023, Swedish police raided Mullvad's offices; Mullvad 4 confirmed that no customer data was seized because none existed.

Proton VPN, headquartered in Switzerland, has also passed independent audits and benefits from strong Swiss privacy law. Neither provider is perfect — perfection doesn't exist in privacy — but both have structural incentives and architectural designs that make logging difficult.

Avoid any VPN that is incorporated in a Five Eyes country (US, UK, Canada, Australia, New Zealand) or a Fourteen Eyes partner. These jurisdictions have intelligence-sharing agreements that can compel data production regardless of the company's stated policy.

For Bitcoin specifically, Tor may be better

A VPN is a centralized service. Even a good one is a single point of trust. Tor decentralizes that trust across thousands of volunteer-operated nodes. When you route your Bitcoin node's traffic through Tor, no single entity can correlate your IP address with your transaction activity. The tradeoff is speed — Tor is slower — but for a Bitcoin node that runs 24/7, latency is rarely meaningful.

The ideal approach for most sovereignty-seekers: use a VPN for general browsing and daily internet activity; route your Bitcoin node traffic through Tor. This separates your general internet identity from your Bitcoin identity across different trust architectures.

What This Means for You

Stop treating your VPN as a privacy guarantee. Treat it as one layer in a defense-in-depth model. A VPN hides your traffic from your ISP and your local network. It does not make you anonymous. It does not protect you from a VPN provider that logs. It does not prevent a government from issuing a lawful intercept order to your VPN provider's jurisdiction.

If you're currently using a VPN you chose based on a YouTube sponsorship, Reddit recommendation, or price comparison — reevaluate. Check whether your provider has been independently audited, where it's incorporated, and whether it accepts anonymous payment. If it fails on two of those three, switch.

And remember: the VPN industry is a marketing industry first and a privacy industry second. The companies spending the most on advertising are rarely the ones spending the most on infrastructure and auditing.

What to Watch

The evolution of VPN-detection and VPN-blocking by governments. China, Russia, Iran, and increasingly other nations are deploying deep packet inspection to identify and block VPN traffic. WireGuard and other modern protocols offer some obfuscation, but the arms race is ongoing. Also watch for Dvpn (decentralized VPN) projects that aim to eliminate the single-point trust problem — though most are too immature for security-critical use today.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.