You downloaded a VPN to stop companies from watching your browsing. Statistically, you handed that job to a different company instead — much like apps secretly tracking users without their knowledge. Proton’s analysis of 390 VPN apps available in US app stores — part of a broader sweep of 7,000+ mobile VPN apps worldwide — found that the privacy tool category has a serious privacy problem.
Here’s what the data actually shows:
- 85% of VPN apps in US stores embed trackers that collect device IDs, carrier details, and network data
- About 1 in 4 of those apps collect your GPS location
- 64 apps are Chinese-owned; 31 conceal that fact behind offshore shell companies in Singapore, Hong Kong, and the UK
- These apps racked up 13.2 million US downloads in June alone
- Under Chinese national security law, that data can be handed to Chinese authorities on demand
The App Knows Where You Are
A quarter of tracked VPN apps collect GPS location — data that can place you at a hospital, a courthouse, or a political rally, whether you meant to share that or not.
Physical location data isn’t abstract metadata. A timestamp at a protest. A check-in near a lawyer’s office. An evening at a medical clinic. Reporting on Proton’s findings describes these apps as doing “likely the very thing you installed a VPN to prevent.” That framing lands harder when you consider how many users downloaded these apps specifically because they wanted less surveillance — not a different landlord for it.
Hidden Ownership, Real Consequences
Thirty-one Chinese-owned VPN apps concealed their origins behind shell companies — and Chinese law makes that a much bigger problem than a missing disclosure checkbox.
This is where it gets geopolitical fast. The Tech Transparency Project has documented that Chinese-owned surveillance app tactics are “obliged to hand over their users’ browsing data to the Chinese government under the country’s national security laws.” Shell companies registered in the UK or Singapore don’t change that legal obligation — they just make the ownership harder to trace.
The pattern isn’t new. In 2024, the Tech Transparency Project found 1 in 5 of the top 100 free VPN apps in the US App Store had undisclosed Chinese ownership, and 20 of those apps had accumulated over 70 million US downloads. Several apps have previously been linked to Qihoo 360, a Beijing-based cybersecurity firm on the US Department of Defense’s list of designated Chinese military companies.
Publishers sometimes argue that trackers serve legitimate diagnostics or monetization purposes. That may be true in some cases. But multiple independent investigations have documented location data collected contrary to stated privacy policies, alongside ownership structures deliberately concealed through offshore shells. It’s also worth noting that Proton, which produced this report, is itself a VPN provider — a commercial interest that’s relevant context when weighing its conclusions.
Before you connect to the coffee shop Wi-Fi again, spend three minutes finding out who actually owns the VPN on your phone. Paid providers with independent audits and clear jurisdictional transparency exist. The free alternative, it turns out, may be costing you considerably more than you think. Learn how to stay safe when using public networks and devices.
