A VPN no-logs policy is a provider’s statement that it does not keep records of what you do while connected, such as the sites you visit or the content you send. It matters because a VPN moves trust from your internet provider to the VPN operator, so what that operator records decides how much privacy you really gain. The promise is only as good as its wording, the company behind it and how well it can be checked.
What “logs” can mean
“Logs” is a broad word, and different services use it differently. It helps to separate the main types of data a VPN could record.
Activity logs
These record what you do online: websites visited, DNS requests, files downloaded or the content of traffic. This is the most sensitive category, and a privacy-focused service should say clearly that it does not collect it.
Connection logs
Sometimes called metadata, these describe the connection itself rather than what you did. They might include when you connected and disconnected, how much data you used, which server you used, and the IP address you connected from. Even without browsing history, connection logs can sometimes be used to link a person to a time and a server.
Account and payment data
Providers typically hold an email address or account number and billing details. This is not a traffic log, but it is personal information, and it affects how anonymous you can be with the service. Policies should explain what is kept and for how long.
Operational and diagnostic data
Some services collect limited technical data to fix bugs or count simultaneous connections. This can be reasonable if it is minimal, described openly and not tied to individual browsing.
How to read a VPN no-logs policy
A headline saying “zero logs” tells you little. Read the full policy and look for specifics.
- A defined list: a good policy says what is collected and what is not, not just that “we value your privacy”.
- Retention periods: if anything is kept, for how long, and is it deleted automatically?
- The word “personally identifiable”: a promise not to log “personally identifiable information” can leave room for data that could still identify you in combination.
- Third parties: does the policy allow sharing data with partners, advertisers or analytics services?
- Jurisdiction: where is the company based, and what legal requests could it receive? Laws differ widely, so look up how they apply to the services you use.
- Legal requests: does the provider explain what it does when it receives a lawful demand for data? What it does not have, it cannot hand over, but what it does keep it may have to.
| Policy wording | What to ask |
|---|---|
| “We keep no logs” | Which logs, exactly? Does that include connection data? |
| “We do not log identifying information” | What counts as identifying, and can it be combined? |
| “We may share data with trusted partners” | Who are they and why do they need it? |
| “Logs are deleted after a period” | How long, and what is stored in the meantime? |
Can a no-logs claim be verified?
Not completely. Because you cannot look inside a provider’s servers, you are always relying on some level of evidence. There are several kinds, each with limits.
- Independent audits: an outside firm reviews the systems or policies and publishes a report. This is valuable, but an audit covers a particular time and scope. Read what was actually examined, who commissioned it, and whether the findings were published in full.
- Technical design: some services describe setups that make logging hard, such as servers that run only from memory and are wiped on restart. This can reduce risk, though you are still trusting the description.
- Track record: a history of transparent behaviour when facing legal or security incidents counts for something, as does regular publication of how the provider handles requests.
- Open-source apps: published code lets researchers examine the client software, although not what happens on the servers.
What no-logs does not mean
Even a trustworthy policy does not make you invisible. Websites can still identify you through logins, cookies and browser characteristics, and other parties could observe traffic at both ends of the connection. We cover that in our anonymity explainer. A no-logs policy also says nothing about whether the service blocks leaks or keeps its software secure, so it should be one factor among many in choosing a VPN.
Warning signs
- A policy that is missing, very short or buried.
- Claims that contradict one another, such as “no logs” alongside a long description of data collected.
- No named company or unclear location.
- Marketing that equates no logs with total anonymity.
- A free service with no explained income, a point we explore in free vs paid VPN services.
Where to start
Before you subscribe, open the privacy policy and find three things: the list of data collected, the retention period and the third parties involved. Note the company’s name and location, then check whether it has published independent audits and read what they covered. If the wording is vague, ask the provider’s support directly, as a transparent service should answer plainly. For other topics worth checking before you commit, see our VPN basics articles.
Frequently asked questions
Does no-logs mean the VPN keeps nothing at all?
Not necessarily. Most services still hold account details, and some keep limited technical data. The policy should state exactly what is and is not kept.
Can a VPN prove it keeps no logs?
Not absolutely. Independent audits, technical design and a transparent track record provide evidence, but each has limits on scope and timing.
Does the provider's country matter?
It can, because laws about data retention and legal requests differ between countries. Check how the relevant rules apply to you and to the service.
Is a no-logs VPN completely private?
No. Accounts you log in to, cookies and browser characteristics can still identify you, regardless of the provider's logging practices.
