VPN “No-Logs” Policies Tested in Court: Who Can You Trust?

Every VPN claims “no logs.” Most have never been tested. This page tracks the providers whose no-logs claims have been tested by law enforcement, courts, or server seizures – not by marketing departments or hired auditors.

The gap between marketing claims and verified reality is the single most important factor in choosing a VPN. A provider can write anything on its website. What matters is what happens when someone with a warrant shows up and demands data.

What Does “No Logs” Actually Mean?

Not all logging is the same. VPN providers use the phrase “no logs” to mean different things, and the distinction matters – it’s exactly what tripped up PureVPN in 2017.

There are three types of data a VPN could record:

When we say a provider’s no-logs policy has been “verified,” we mean they could not produce connection logs or usage logs – the types that identify individual users – when compelled by law enforcement.

What Counts as “Court-Tested”?

We track three categories of adversarial verification:

1. Law enforcement compelled production. A government agency served a subpoena, court order, or warrant demanding user data. The VPN either produced data or demonstrated it had none.
2. Server seizures. Authorities physically seized VPN servers and examined their contents.
3. Criminal prosecutions. A VPN provider or its executives were charged in connection with activity on their network.

We do not count third-party audits here. Audits are useful – we cover them separately below – but they are fundamentally different. An audit is a controlled exercise where the VPN chooses the auditor, defines the scope, and cooperates throughout. A law enforcement action is adversarial. The provider does not get to choose the timing, scope, or outcome.

Five incidents across four providers. That is the entire body of court-tested evidence for VPN no-logs claims worldwide.

Copy
Tweet

Verified: No Logs Found

These providers had their no-logs claims tested under adversarial conditions. In each case, the provider could not produce user-identifying data because it did not exist.

Two providers advertised no-logs policies and provided user logs when compelled. Both have changed ownership since.

Copy
Tweet

Contradicted: Logs Were Provided

These providers advertised no-logs policies but provided user-identifying data to law enforcement when compelled. Both incidents occurred before ownership changes, and both providers have since commissioned independent audits. The incidents remain part of the public record.

Timeline: Every Known Court Test

Seven incidents across nine years. This is the complete public record of VPN no-logs claims being tested by law enforcement.

RAM-Only Servers: Hardware-Level Protection

Some VPN providers run their entire server infrastructure in volatile memory (RAM) with no hard drives. If a server is seized or rebooted, all data is wiped automatically. This is a meaningful technical safeguard – it means even if authorities physically take a server (as Turkish police did with ExpressVPN in 2017), there is nothing persistent to examine.

Why Proton VPN says no. Proton VPN has publicly argued that RAM-only is “marketing hype” because a running server’s memory is equally accessible to an attacker with root access. Their position: full-disk encryption on a powered-off server provides equivalent protection to RAM-only, and RAM-only only matters if a server is physically seized while powered off – a narrow scenario. It’s a legitimate technical argument, even though most of the industry has gone the other direction.

Third-Party Audits: Useful but Different

Many VPN providers have commissioned independent audits to verify their no-logs claims. These are valuable but fundamentally different from the court-tested cases above. An audit is a point-in-time assessment where the provider selects the auditing firm, agrees on the scope, and cooperates throughout. That is why we track the two categories separately.

Regular audits by reputable firms are a meaningful signal – especially when the reports are published in full.

On audit report availability: Most VPN no-logs audits are not published in full. The provider typically issues a summary or press release. Proton VPN and TunnelBear are notable exceptions – both publish full audit reports publicly. We link to official published reports where available but do not host copies, because audit reports are living documents and a hosted copy risks becoming stale.

Warrant Canaries and Transparency Reports

A warrant canary is a regularly published statement saying “we have not received any secret government subpoenas.” If the statement disappears, the implication is that a gag order was received. Transparency reports go further, disclosing the number and type of data requests received.

The industry is splitting into two camps: some providers maintain traditional warrant canaries, others have moved to detailed transparency reports, arguing they provide more useful information.

What This Means for You

A practical framework for evaluating no-logs claims:

Court-tested (strongest evidence). The provider was compelled to produce data by a government agency or court and could not. Five incidents across four providers – ExpressVPN, Private Internet Access, Mullvad, and Windscribe – fall into this category.

Audit-verified (good but weaker). A reputable third-party firm examined the provider’s infrastructure at a specific point in time and found no logging. Meaningful signal, especially when audits are repeated annually and published in full. But the provider chose the auditor, the timing, and the scope.

Marketing-only (unverified). The provider claims “no logs” on its website but has never been tested by law enforcement and has never commissioned an independent audit. Most VPN providers fall into this category. The claim may be true – it is simply unverified.

Contradicted (proceed with caution). IPVanish and PureVPN had their no-logs claims directly contradicted by court evidence. Both have changed ownership and commissioned audits since. Whether those audits are sufficient to restore trust is a judgment call.

One important caveat: no external test can definitively prove what a company does with its server logs at all times. Our VPN leak test verifies whether your VPN is providing technical protection right now (IP leaks, DNS leaks, WebRTC leaks). This page tracks policy verification – whether claims about data retention have held up under scrutiny. Both matter.

What We Don’t Do

We don’t accept payment from VPN providers to appear on this page. We don’t remove negative entries. We don’t count marketing claims as evidence. We don’t host audit reports (they go stale). We don’t speculate about providers that haven’t been tested – “not tested” is its own honest category.

If a new court case, server seizure, or prosecution involving a VPN provider’s no-logs claims becomes public, we will add it here.

Test Your VPN Now

Knowing your VPN provider’s logging policy is one half of the equation. The other half is confirming your VPN is actually working – that your real IP address, DNS requests, and WebRTC connections are not leaking outside the tunnel.

Our free VPN leak test checks all three in about 30 seconds. No signup required.