How Governments Track VPN Users and What You Can Do

A VPN encrypts your traffic between your device and the VPN server, hiding what you do from your internet provider and local network. It doesn't make you invisible. Governments have several ways to see that you use a VPN, and sometimes what you do with it.

What your internet provider can still see

• That you're connected to a VPN server, from its address.
• When you connect, for how long, and how much data you send.
• Often, which VPN protocol you're using.

It can't see the websites you visit or what you do on them, as long as the VPN works properly.

How VPN use is detected and blocked

• Known server addresses: lists of VPN servers can be blocked or flagged.
• Deep packet inspection: analyzing traffic patterns to recognize VPN protocols, even when contents are encrypted. Countries including China, Iran and Russia use this to block VPNs.
• App store removals: some governments require VPN apps to be removed from local app stores.

Some VPNs offer "obfuscated" or "stealth" modes that disguise VPN traffic as ordinary web traffic. See how VPN traffic is detected.

Requests to VPN providers

Authorities can ask, or order, a VPN company to hand over records. What exists to hand over depends on what the company keeps. In US court cases, records from PureVPN (2017) and IPVanish (2018) helped identify users, despite privacy claims. See checking no-logs claims.

Leaks and mistakes

The most common way VPN users are identified is something outside the VPN:

• Signing in to accounts tied to your real identity.
• Browser leaks, such as WebRTC revealing your real IP address. WebRTC Privacy Shield stops this.
• DNS leaks, where lookups go to your provider instead of the VPN. See DNS leak tests.
• Payments linking your name to a VPN account.
• The connection dropping without a kill switch. See kill switches.

What you can do

1. Choose a provider with an independently audited no-logs policy.
2. Turn on the kill switch and leak protection.
3. Test for IP, WebRTC and DNS leaks regularly. See leak tests.
4. Keep identity-linked accounts separate from activity you want private.
5. Ghost Browser adds random background visits, making browsing profiles less accurate.

Know the law where you are

VPNs are legal in most countries, but restricted or banned in some. Using one doesn't make illegal activity legal. Check local rules, especially when travelling.