Popular VPN Apps Could Be ‘Spying’ On Millions, Proton Warns

Zak Doffman, Contributor

Updated Fri, August 28, 2026 at 6:29 AM UTC

VPN apps may pose privacy risks of their own.
getty

It's the "ultimate act of betrayal," Proton warns. Even some of "the most popular VPNs in the U.S." could be secretly "spying on millions" of users, "likely the very thing you installed a VPN to prevent." This affects iPhone and Android users, with installs directly from the App Store and Play Store.

As a VPN developer, Proton has a vested interest in flagging such risks, but it's not alone. We have seen multiple warnings over multiple years. But as the popularity of VPNs continues to surge, so does the threat. It's very simple — installing a VPN that contains hidden location and data trackers is worse than running no VPN at all. But there are "no warning labels," and so it's not easy to tell.

Microsoft Issues Hotel Wi-Fi Warning For Windows PC Users

If you do want to use a VPN — for whatever reason, then paid is best. Proton is one such legitimate VPN supplier, but there are many others, including Nord, Surfshark and ExpressVPN. There's too much risk in free apps or those with links to China . After surveying "over 7,000 mobile VPN apps around the world," Proton says "85% of those downloaded in the U.S. contain trackers, and around a quarter of those actively track users' physical location."

Proton says "64 of the 390 VPNs downloaded from the Apple App Store and Google Play in the U.S. are owned by Chinese companies." Chinese law can compel companies to cooperate with intelligence authorities, raising additional concerns about how VPN user data could potentially be accessed. These "suspect VPNs" were downloaded more than 13.2 million times in June alone.

Proton used third-party app analysis platforms to detect code signatures within apps that flag "analytics, advertising, and profiling trackers." The analysis "found that 85% of VPNs available in the U.S. contain trackers designed to collect and share highly personal user data. This can include your unique device ID (GAID), device model, network type, mobile carrier name, and more."

That suggests a vast number of VPNs do more harm than good, and should be avoided. Where those VPNs are based in China, y our data may be vulnerable to collection or misuse.

Of the apps analysed, 64 "actively track your physical location using GPS and other geolocation data. Anyone with access to this data can see if you are at a protest or meeting with a journalist, lawyer, or source, and ultimately share that information with law enforcement or intelligence services. These apps include some of the most popular VPNs in the U.S."

Who Owns Trust—Zero Trust Is About To Fail Its AI Test

Here's my advice if you want to install and use a VPN on your smartphone:

Only install VPNs from Play Store or App Store.
Only use paid VPNs on an open subscription for a sensible amount, never with obfuscated in-app purchases.
Only use VPNs from well-known developers that you can easily research and find on mainstream websites, and never from any based in China.
Always ensure Play Protect is enabled if you're using Android, and never disable or pause Play Protect to install a VPN it flags as risky.
Check the privacy and permission settings on your phone and pay particular attention to the VPN(s) you have installed. Remember, they're tunnelling all your traffic.

This article was originally published on Forbes.com

Check out Yahoo's latest VPN advice, based on hands-on testing.

About our ads

Recommended articles