Can a VPN Steal Your Data? What Providers See

A VPN service can collect information about your connections and share it with third parties. With split tunneling, only selected traffic passes through the VPN. A correctly established HTTPS connection protects page content and passwords from being read by the VPN server.

Short Answer

Evaluate a VPN's data collection rules and the evidence supporting them. Read its privacy policy to find out what data it collects, how long it keeps it, and who receives it. If the service publishes an independent audit, check its date and scope.

What a VPN Sees Technically

For connections passing through a VPN server, its operator can see:

• The IP address you connected from
• Connection times and durations
• The volume of traffic transferred
• Website names, if they are visible in DNS requests or other unencrypted connection data
• The contents of unencrypted HTTP traffic

With a correctly established HTTPS connection, the VPN server does not receive page content or passwords in plaintext. Its operator can see connection information, such as timing and traffic volume. Learn more: what your internet provider sees when you use a VPN.

“Seeing” and “Stealing” Are Not the Same

Accessing, recording, and sharing data are different actions:

A 2016 study of Android VPN apps examined third-party tracking libraries.

In everyday language, “theft” can mean a service secretly collecting more than it promises and using the data against your interests: selling it, leaking it, or handing it over in response to requests without transparency.

When a VPN Is Actually Dangerous for Your Data

Free VPNs With an Unclear Business Model

A free VPN can have different sources of funding, including advertising, donations, or paid plans offered by the same service. Check its privacy policy and app description for:

• What connection information it stores
• Whether it includes advertising or third-party analytics components
• Whether it shares collected data with other recipients
• Whether it uses your device to carry other people's traffic

See the risks of free VPN services and free vs paid VPNs.

Apps With Excessive Permissions

Warning signs include:

• Access to contacts, SMS, or files without an explanation of which feature needs it
• Background location access without an explanation of its purpose
• Additional modules whose purpose and data access the developer does not describe

The need for additional permissions depends on the app's features. For each permission, check which action requires it and whether the developer explains that access.

No Transparent Policy

Check the privacy policy for:

• What data is collected
• What it is used for
• How long it is kept
• Who it may be shared with
• Who operates the service and where the company is registered

If the collection or sharing terms are unclear, ask support for an explanation before connecting. See what happens to your data after signup.

Server Compromise

In October 2019, NordVPN reported unauthorized access to one server in Finland in March 2018. The company said that users' login credentials were not affected.

When evaluating a service, check:

• What data it stores and what could become accessible in a breach
• Which systems an independent audit examined and when
• How it reports incidents and fixes discovered vulnerabilities

How a VPN Protects Traffic

A VPN reduces the visibility of your traffic to your local network and internet provider. It:

• Encrypts the connection to the VPN server
• Hides your real IP address from websites, which see the server's IP instead
• Helps protect connections on public Wi-Fi; see public Wi-Fi security risks

Phishing, weak passwords, and malicious apps remain threats when you use a VPN.

How to Tell Whether You Can Trust a VPN

Check these five points:

1. Open the privacy policy. Find which data the no-logs claim covers: connection logs or activity logs.
2. Find the service operator's name and country of registration on its website or in its company documents.
3. If an independent audit is published, open the report. Check the date, the auditor, and the systems and claims examined.
4. Find the service's reports about incidents and requests for data. Compare them with independent reporting, if available.
5. Find the app link on the developer's official website. If it leads to an app store, check the app name and developer before installing it.

Also see: can your internet provider see your browser history.

HTTPS and Account Security When Using a VPN

With a correctly established HTTPS connection, the VPN server cannot read page content or transmitted passwords. The VPN operator can see the connection data listed above. If you sign in to an account on a website, that website can associate your actions with the account even when you connect through a VPN.

Use two-factor authentication to protect your accounts. Do not enter passwords on suspicious pages. Before installing a VPN client, check its developer and requested permissions.

Practical Rules

1. Before connecting, check your chosen service using the “How to Tell Whether You Can Trust a VPN” checklist. This applies to both free and paid VPNs.
2. Read the privacy policy as well as the app store rating.
3. If your VPN client supports a Kill Switch, which blocks traffic when the VPN connection drops, find the feature in its settings. Enable it using the developer's instructions for your platform. Check those instructions for which traffic it blocks and under what conditions.
4. Open the IP check page on BrowserLeaks without a VPN. Record the IP Address value. Click Run DNS Leak Test and save the Your DNS Servers list.
   Connect the VPN and repeat the check in the same browser. Compare the displayed IP address and DNS servers with your VPN client's expected settings.
   If the result is unclear, send it to support. This test covers browser connections and does not show what data the VPN service stores or shares.

What to Check Before Connecting to a VPN

A VPN service has access to connection data passing through its servers. Before connecting, check what it collects, how long it keeps it, and who receives it.

Compare those terms with published audits and incident reports. The subscription price and a no-logs claim alone do not confirm that the service follows those terms.

To test a VPN in real conditions without a long subscription, use trial access for $1.50.

FAQ

Can a VPN steal your data?

A VPN service can collect connection data and share it with other recipients. Check its privacy policy, published audits, and incident reports to find out what it collects and how it uses it. Connecting to a VPN does not by itself prove data theft.

Can a VPN owner see your search history and the sites you visit?

The VPN server's operator can see website names if they are visible in DNS requests or other unencrypted connection data. With a correctly established HTTPS connection, search query text and page content are protected from being read by the VPN server. This differs from history saved in your browser or search service account.

Can a VPN steal passwords?

With a correctly established HTTPS connection, the VPN server does not receive transmitted passwords in plaintext. Unencrypted HTTP traffic lacks that protection. Assess the VPN app's access on your device separately by checking its developer and requested permissions.

How can you tell whether a VPN collects data?

Check what data its privacy policy lists and what an independent audit covers, if one is published. Ask support to explain unclear terms. An IP and DNS test does not show whether the service stores data; passing a leak test does not confirm the absence of logs.