Chinese VPNs under fire again.
getty
It’s the “ultimate act of betrayal,” Proton says, warning that “some of the most popular VPNs in the U.S.” are now secretly tracking users, “likely the very thing you installed a VPN to prevent.” This affects both iPhone and Android users, with installs directly from the App Store and Play Store.
As a VPN developer, Proton has a vested interest in flagging such risks, but it’s not alone. We have seen multiple warnings over multiple years. But as the popularity of VPNs continues to surge, so does the threat. It’s very simple — installing a VPN that contains hidden location and data trackers is worse than running no VPN at all. But there are “no warning labels,” and so it’s not easy to tell.
If you do want to use a VPN — for whatever reason, then paid is best. Proton is one such legitimate VPN supplier, but there are many others, including Nord, Surfshark and ExpressVPN. There’s too much risk in free apps or those with links to China. After surveying “over 7,000 mobile VPN apps around the world,” Proton says “85% of those downloaded in the U.S. contain trackers, and around a quarter of those actively track users’ physical location.”
Proton says “64 of the 390 VPNs downloaded from the Apple App Store and Google Play in the U.S. are owned by Chinese companies, which are legally bound to share data with their authoritarian government.” These “suspect VPNs” were downloaded more than 13.2 million times in June alone.
Proton used third-party app analysis platforms to detect code signatures within apps that flag “analytics, advertising, and profiling trackers.” The analysis “found that 85% of VPNs available in the U.S. contain trackers designed to collect and share highly personal user data. This can include your unique device ID (GAID), device model, network type, mobile carrier name, and more.”
That suggests a vast number of VPNs do more harm than good, and should be avoided. Where those VPNs are based in China, the risks are clearly amplified. Your data is being sold — the question is who’s buying it, and who might be accessing it by other means.
Of the apps analysed, 64 “actively track your physical location using GPS and other geolocation data. Anyone with access to this data can see if you are at a protest or meeting with a journalist, lawyer, or source, and ultimately share that information with law enforcement or intelligence services. These apps include some of the most popular VPNs in the U.S.”
Here’s my advice if you want to install and use a VPN on your smartphone:
- Only install VPNs from Play Store or App Store.
- Only use paid VPNs on an open subscription for a sensible amount, never with obfuscated in-app purchases.
- Only use VPNs from well-known developers that you can easily research and find on mainstream websites, and never from any based in China.
- Always ensure Play Protect is enabled if you’re using Android, and never disable or pause Play Protect to install a VPN it flags as risky.
- Check the privacy and permission settings on your phone and pay particular attention to the VPN(s) you have installed. Remember, they’re tunnelling all your traffic.
