The point of installing a VPN, for most people, is to reduce the number of parties who can see what they do online. The uncomfortable finding in this research is that a meaningful share of the most-downloaded free and freemium apps in the US market do the opposite: they route your traffic through servers operated by companies legally required to hand user data to a foreign government on request. In June 2026 alone, Apple and Google approved more than 13.2 million downloads of the VPN apps in the study, including more than 3 million downloads of the Chinese-owned category. That’s the scale.
What the Investigation Actually Found
Researchers spent months analyzing more than 7,000 mobile VPN apps worldwide before zooming in on the 390 services actively downloaded through the Apple App Store and Google Play in the United States. They cross-referenced download volume from AppTweak, a mobile-app intelligence firm, with tracker-detection data from Exodus Privacy, an open-source project that scans Android apps for known analytics, advertising, and profiling code. The specific finding on ownership is direct: 64 of the 390 VPN apps analyzed trace back to Chinese companies. Of those, 31 conceal their ownership through offshore corporate structures in Singapore, Hong Kong, and the UK, which makes it functionally impossible for a US consumer to know who is actually operating the VPN they installed.
The research also flagged that 64 apps in the same dataset actively access the user’s GPS or other geolocation data, in addition to the standard tracker payload of advertising IDs, device model, network type, and mobile carrier information. The apps most frequently cited in the coverage include VPN Proxy Master, X-VPN, and VPN-Fast VPN Super, all of which have been among the most-downloaded free VPN apps in the US market for several years.
Why Chinese Ownership Is a Problem, Even If the App Actually Works
The concern here is not that these apps are technically broken. Many of them function well as basic proxies, encrypt traffic between the device and the exit server, and behave largely the way a VPN is supposed to. The problem is jurisdictional. Chinese corporate law compels companies to hand over user data to state authorities upon request, and there is no meaningful appeal process for foreign users of those services. That structural obligation runs directly against the entire promise of a no-logs VPN. A company can advertise that it does not store your activity, but if it is legally required to produce records of that activity when asked, the marketing claim becomes hard to take seriously.
The users who face the sharpest exposure are the ones for whom the VPN was supposed to matter most: journalists working with sources, activists living in or communicating with authoritarian regimes, dissidents inside China itself, and anyone whose personal safety depends on their location and browsing being genuinely unlinkable to their real identity. For those users, a VPN that quietly records the connection log defeats the entire operational purpose of installing it.
Get a VPN You Can Actually Verify
The Shell Company Problem
The finding that 31 of the 64 Chinese-owned VPNs concealed their ownership through shell entities is what elevates this from a general concern about free apps to something closer to a systematic pattern. Shell company structures registered in Singapore, Hong Kong, and the United Kingdom serve a specific purpose: they let the actual operator appear, in every consumer-facing document and app store listing, to be a small independent business based in a jurisdiction with strong privacy laws. The consumer sees a UK Ltd. or a Hong Kong branded page. The actual entity making decisions about the data lives somewhere else entirely.
That structure is legal in the abstract. It is also a significant tell. A privacy tool that requires you to dig through corporate registries to figure out who is running it is not a privacy tool at all. Both Apple and Google’s app store review processes rely heavily on self-reported information from developers, and neither has the resources to independently verify whether the corporate entity submitting a VPN app is actually the one operating it. That gap is what the shell company structure exists to exploit.
How to Actually Tell If a VPN Is Safe to Install
The practical filter is short. Look for a VPN that publishes the corporate identity of the actual operator on its main site, not buried in a legal footnote. Check whether the no-logs policy has been audited by an independent firm, and whether the audit report itself is publicly available. Verify the jurisdiction of the operating entity, because a VPN based in a country that is not part of the Five Eyes, Nine Eyes, or Fourteen Eyes intelligence-sharing agreements has fewer legal levers pushing it toward data disclosure. And confirm the ownership chain matches what the marketing says. A VPN that claims to be based in the UK but is actually operated by a company registered in Beijing is not offering the privacy protections the marketing suggests.
Free VPNs deserve extra scrutiny. Running a global VPN network is not cheap, and if the app is free to install and use without a subscription tier, the business model has to come from somewhere. In practice, that somewhere is usually advertising, analytics, or data resale. That’s where the tracker findings in this same investigation start to matter: 85% of the US-downloaded VPN apps in the sample contained active trackers, ranging from advertising IDs to GPS coordinates. The trackers do not require Chinese ownership to be a problem, but Chinese ownership makes the data destination worse.
Where NordVPN Fits
The reason NordVPN keeps appearing near the top of most credible best VPN comparisons has less to do with speeds and more to do with the fact that the service passes the ownership, jurisdiction, and audit tests that the Chinese-owned apps in this study do not. NordVPN operates under Nord Security, a company headquartered in Panama with publicly disclosed ownership and executive leadership. Panama is outside the Five, Nine, and Fourteen Eyes intelligence alliances and has no mandatory data retention law that would compel the operator to log user activity.
The no-logs policy itself has been independently audited multiple times by third-party firms, most recently by a Big Four accounting firm, with the audit summaries made public. On top of the core VPN, the service adds Threat Protection Pro, which blocks known trackers, ad networks, and phishing domains at the network layer, and Dark Web Monitor, which scans criminal marketplaces for stolen credentials and alerts you if your data appears in a dump. Both are the kind of features that stop mattering the moment your VPN itself is the entity harvesting the data.
Get NordVPN With Verified Privacy
NordVPN Basic at $3.49 per Month
NordVPN’s Basic plan is currently available at $3.49/month, which works out to $94.23 billed once for 27 months of service (24 + 3 free). That is a 69% discount off the standard rate. Annual renewal continues at $139.08/year, cancelable from the account dashboard at any time.
The plan covers the core VPN across up to 10 devices with applications for Windows, macOS, Linux, iOS, Android, browser extensions, and router installation for whole-household coverage. Threat Protection Pro and Dark Web Monitor sit in the higher Advanced and Ultra tiers rather than in Basic. If closing the tracker and data-broker pipelines described above is the main reason you’re moving away from a free VPN after reading this, the higher tiers are the ones that actually deliver on that promise.
Get NordVPN Basic at $3.49/month
30-Day Money-Back Guarantee
NordVPN backs every plan with a 30-day money-back guarantee. If the service doesn’t fit the way you use your devices, you can request a full refund within the first month. Refunds are processed through 24/7 chat support, and funds typically return within 5 to 10 business days depending on the payment method used.
Practically, that gives you a full month to install the apps, replace whatever free VPN was previously sitting on your phone, and verify that the connection actually holds up before the refund window closes. A note on the subscription: the $3.49/month rate applies to the first 27 months. Auto-renewal kicks in at the standard annual rate after that. If you would rather cancel or renegotiate before renewal, set a reminder in your calendar 7 to 10 days before the renewal date.