No-logs policies explained: what "we don’t log you" really means

What "no logs" actually means (and what it doesn't)

Every VPN service claims they "don't log your data." Some print it in bold on their homepage. Others publish thousand-word privacy policies that essentially say the same thing. But when you're routing all your internet traffic through a third party, "trust us" isn't enough.

Here's what you need to know: logging isn't binary. VPNs collect different types of data for different reasons, and some of that collection is unavoidable if they want to run a functional service. The question isn't whether a VPN logs anything—it's what they log, why they log it, how long they keep it, and whether you can verify any of their claims.

The three types of logs that matter

When a VPN says "no logs," they're typically talking about activity logs—the record of what you actually do online. But there are two other categories of data collection you need to understand.

Activity logs track your browsing. This includes which websites you visit, what files you download, what services you connect to, timestamps of those connections, and the content of your traffic if it's unencrypted. This is the surveillance data you're trying to avoid. Any VPN that keeps detailed activity logs defeats the entire purpose of using a VPN.

Connection logs (sometimes called metadata or session logs) record that you connected to the VPN service, but not what you did afterward. This typically includes your real IP address, the VPN server IP you connected to, timestamps of when you connected and disconnected, and total bandwidth used during a session. Connection logs don't reveal what sites you visited, but they can connect your identity to a specific VPN session—which becomes a problem if that VPN is later compelled to hand over activity logs.

Account data is information you provide when you sign up: email address, payment details, username. This isn't logging in the traditional sense, but it's personally identifiable information the VPN holds about you. Some services require minimal account data (cryptocurrency payment with no email verification). Others collect the same information Netflix does.

A genuine "no logs" policy means no activity logs and minimal connection logs—ideally none, but at minimum, no data that could identify you or link your identity to your browsing sessions.

Why VPNs log anything at all

Running a VPN service without collecting some data is technically challenging. Legitimate operational needs include preventing abuse (one user shouldn't be able to DOS the network with unlimited connections), enforcing account limits (your "5 simultaneous devices" plan needs tracking), troubleshooting connection issues, and managing server load.

The difference between a privacy-respecting VPN and a data-harvesting one is how they solve these problems. Good services use techniques like storing data in RAM only (wiped on reboot), aggregating data so individual sessions can't be identified, or deleting logs on a very short cycle—sometimes within minutes.

For example, a VPN might temporarily log that someone connected to a specific server to manage capacity, but not who that person was or when exactly they connected. Or they might track total bandwidth per account over a billing period without logging individual sessions.

You'll also see VPNs argue they need some connection data to provide customer support. This is technically true but overstated. Many issues can be debugged without persistent logs—what matters is how long any diagnostic data survives after the problem is resolved.

What privacy policies actually say (and hide)

VPN privacy policies are legally binding documents, but they're written by lawyers to protect the company, not to make things clear to you. Here's how to read them.

Look for specificity. Vague statements like "we respect your privacy" or "we don't track your online activity" mean nothing. You want explicit lists: "We do not log browsing history, traffic destinations, data content, or DNS queries."

Check for exceptions. Policies often include carve-outs—"We do not log user activity except as required by law" or "We may collect data to improve our service." These exceptions can be large enough to drive a logging operation through. Pay particular attention to phrases like "aggregate statistics," "performance monitoring," or "service improvement"—all can justify collecting more data than you'd expect.

Watch for the passive voice. "Data may be collected" is different from "We collect data." The passive construction obscures who's doing what. Same with "could be shared with third parties" versus "We share data with advertising partners." The more passive voice, the less transparency.

Compare the privacy policy to the marketing site. If the homepage shouts "ZERO LOGS" but the privacy policy lists six types of connection data they store, you've found a red flag. Companies confident in their privacy practices tend to align these documents. Companies trying to have it both ways don't.

Jurisdiction: where the company is matters

A VPN provider's legal jurisdiction determines what data they can be forced to collect and hand over. This matters more than almost anything in the privacy policy.

Countries with mandatory data retention laws can require VPNs to log connection data for law enforcement access. The EU's Privacy and Electronic Communications Directive, various national implementations, and intelligence-sharing agreements like Five Eyes (US, UK, Canada, Australia, New Zealand) create legal pressure to log.

That's why many privacy-focused VPNs incorporate in places like Panama, British Virgin Islands, or Switzerland—jurisdictions with strong privacy laws and no mandatory data retention for VPN services. But jurisdiction isn't a silver bullet. A company based in Panama can still log everything and sell it. Location matters most when paired with a verified no-logs policy.

One practical consideration: if a VPN has servers in a country with aggressive surveillance laws, those specific servers might be legally required to log even if the company's home jurisdiction doesn't require it. Some VPNs address this by running diskless servers (no local storage) or using RAM-only configurations that physically can't store persistent logs.

Third-party audits: trust but verify

A VPN can write anything in its privacy policy. The only way to verify their claims is through independent third-party audits. These aren't perfect, but they're significantly better than taking a company's word.

Legitimate audits are performed by cybersecurity firms with no financial stake in the result. The auditor reviews the VPN's infrastructure, examines server configurations, inspects code, reviews data handling procedures, and attempts to find logs that shouldn't exist according to the policy. Then they publish a report—ideally public, at minimum summarized.

For example, ExpressVPN and NordVPN have both published third-party audits of their no-logs claims. You can read the audit reports yourself and decide if you find them convincing. Look for details: Did the auditor have full access to production systems, or just a demo environment? Did they verify log deletion practices or just check that no logs existed at the moment of the audit?

Be skeptical of "certifications" and "awards." A TrustPilot rating or a "Best VPN 2024" badge from a review site tells you nothing about logging practices. You want audits from firms like Cure53, Deloitte, or PricewaterhouseCoopers—companies that stake their reputation on accurate security assessments.

Frequency matters too. A one-time audit five years ago doesn't mean much if the company has since changed infrastructure, ownership, or policies. Annual or biennial audits are the standard for services serious about transparency.

When "no logs" fails: real-world cases

The gap between policy and practice becomes visible when VPNs are forced to hand over data—and discover they've been logging more than they claimed.

In 2017, PureVPN claimed a strict no-logs policy but provided FBI investigators with connection logs, timestamps, and originating IP addresses that helped identify a cyberstalker. The company later clarified they keep connection logs for "troubleshooting"—information absent from their marketing materials.

HideMyAss (owned by Avast) handed over logs to UK law enforcement in 2011 that led to the arrest of a hacker. The company was logging comprehensive connection data despite privacy-focused branding. They've since revised their policies to be more transparent about what they collect.

These cases don't necessarily mean the VPNs lied—sometimes privacy policies are genuinely unclear, or operational practices drift from written policy. But they demonstrate why verification matters. A service that's never been tested in court or by auditors might have excellent privacy practices or terrible ones. You won't know until it's too late.

What you can verify yourself

You can't audit a VPN's backend yourself, but you can check some claims.

Test for DNS leaks. When connected to the VPN, visit a DNS leak test site and confirm your queries go through the VPN's DNS servers, not your ISP's. If you see your ISP's DNS, the VPN is leaking identifying information even if they're not explicitly "logging" it.

Check your real IP. With the VPN connected, search "what is my IP" and confirm you see the VPN server's IP, not your own. Test on multiple sites—some VPNs have worked out arrangements with certain IP-checking services to show favorable results.

Review the company's transparency reports. Some VPNs publish annual reports detailing law enforcement requests they've received and how they responded. If a VPN receives 1,000 requests and hands over "no data because we don't have any," that's meaningful evidence their no-logs policy is real.

Research the company's history. Has the VPN ever been caught logging when they claimed not to? Have they changed ownership recently (new owners often change data practices)? Are there credible reports from security researchers about logging concerns?

Practical assessment checklist

When evaluating a VPN's no-logs claims, work through these questions:

Does the privacy policy explicitly state they don't log browsing history, traffic destinations, DNS queries, and timestamps? Vague language like "we respect privacy" doesn't count.

If they collect connection logs, what specifically, and for how long? "We delete logs daily" is very different from "We delete logs after 90 days."

Has the policy been audited by a reputable third party in the last two years? Can you read the audit report?

What's the company's legal jurisdiction? Are they subject to mandatory data retention laws?

Does the service accept anonymous payment methods (cryptocurrency, cash) and allow account creation without email verification? This isn't about logging per se, but it shows they're thinking about privacy holistically.

Has the company ever been tested in court or by law enforcement requests? What data, if any, were they able to provide?

Are there technical implementations that make logging difficult (RAM-only servers, diskless infrastructure)?

If comparing multiple services, check out our VPN comparisons to see how different providers stack up on logging policies and verification.

When "no logs" isn't enough

Even a perfectly implemented no-logs policy doesn't guarantee privacy. If you're using the VPN with your real email and credit card, logging in from your home IP, and never using Tor or other privacy tools, the VPN provider can still identify you from account data alone.

Similarly, if the VPN has poor security practices and gets breached, attackers might access real-time connection data even if nothing's stored long-term. Or if you're using a VPN on a compromised device, logging becomes irrelevant—the malware sees everything before it hits the encrypted tunnel.

No-logs policies protect you from the VPN provider itself becoming a surveillance point. They don't protect you from government-level traffic analysis, timing attacks, browser fingerprinting, or the hundreds of other ways you can be tracked online. A VPN is one tool in a privacy stack, not a complete solution.

For maximum privacy, combine your VPN with other tools: use Mullvad Browser or Tor Browser to resist fingerprinting, pay with cryptocurrency through a mixing service, create accounts with aliased emails, and rotate between different VPN servers. The more layers between your identity and your activity, the less any single point of logging matters.

Key takeaways

• "No logs" should mean no activity logs (browsing history, traffic) and minimal to no connection logs (session times, IPs). Account data is separate—some collection is unavoidable, but you can minimize it.
• Privacy policies hide details in exceptions and passive voice. Read them critically and compare to marketing claims—mismatches are red flags.
• Third-party audits from reputable security firms are the only meaningful verification. Look for recent, comprehensive audits with published reports.
• Jurisdiction affects what a VPN can be legally forced to log. Panama, BVI, and Switzerland are popular for a reason, but location alone doesn't guarantee privacy.
• Real-world test cases—court orders, transparency reports, security breaches—reveal whether "no logs" is policy or practice.
• Even perfect no-logs policies have limits. VPNs prevent one type of surveillance; you need additional tools for comprehensive privacy.