What the Proton investigation actually found
Proton’s research team spent months analyzing more than 7,000 mobile VPN apps worldwide, then focused on the 390 VPN services actively downloaded through the Apple App Store and Google Play in the United States. They cross-referenced download volume data from AppTweak, a mobile-app intelligence firm, with tracker-detection data from Exodus Privacy, an open-source project that scans Android apps for known analytics, advertising, and profiling code. The headline number: 85% of the US-downloaded VPN apps in that sample contained trackers.
The trackers can collect a range of information, including your unique advertising ID (GAID on Android), device model, network type, and mobile carrier. In 64 of the 390 apps, the tracking goes further: they actively access your GPS location. Those 64 location-tracking VPN apps were downloaded around 3 million times in June 2026 alone, roughly 20% of all VPN downloads in the dataset. In total, Apple and Google allowed the flagged apps to be downloaded more than 13.2 million times in the US in a single month.
Forbes covered the report with a blunt framing, calling it “the ultimate act of betrayal” for users who installed a VPN specifically to avoid this kind of surveillance.
The Chinese-ownership piece nobody talks about
Ownership is the other half of the story. Of the 390 VPN services Proton examined in the US market, 64 are owned by Chinese companies. Chinese corporate law requires companies to hand over user data to state authorities on request, which means these apps are structurally incapable of guaranteeing the privacy their marketing promises. Worse, 31 of those Chinese-owned apps hide their ownership behind shell companies registered in Singapore, Hong Kong, and the United Kingdom, making it nearly impossible for a US consumer to know who is actually operating the VPN they installed.
The apps involved include some of the most-downloaded names in the free and freemium VPN category. Proton specifically named VPN Proxy Master, VPN-Fast VPN Super, and X-VPN, which collectively accounted for over 3 million US downloads in June 2026, or about 20% of the entire dataset.
Why this happens: the mobile VPN business model
The reason so many VPN apps track their users comes down to how the mobile app economy is structured. Apple and Google take roughly 30% of every in-app purchase. Free VPN apps have to monetize somehow, and the same advertising and data-broker ecosystem that funds mobile games and utilities is available to fund VPN apps too. Many of the US-owned apps in Proton’s dataset entered commercial agreements with foreign companies that embedded tracking software as part of the deal, treating VPNs as just another off-the-shelf mobile category to monetize through advertising.
App store review processes do not currently catch this, because Apple and Google rely heavily on developers’ self-reported privacy declarations rather than independently verifying whether an app behaves the way its privacy policy claims. Proton is calling on both companies to conduct more rigorous technical vetting of VPN apps, and to require transparent ownership disclosure. For now, none of that verification is happening at the store level. It’s on the user to check.
How to tell a real VPN from a tracker in disguise
The signal that separates a trustworthy VPN from one that treats you as inventory is independent third-party audits. A serious VPN provider publishes findings from a major auditing firm confirming that no logs are retained, and repeats the exercise on a recurring basis. Everything else, no matter how confidently the marketing claims “no logs” or “private,” is unverifiable from the outside. Gizmodo’s best VPN guide only ranks services that have submitted to this kind of external scrutiny, which is the practical shortcut for anyone who doesn’t want to spend an afternoon reading transparency reports.
The other signal is ownership. A VPN based in a jurisdiction with strong privacy law, operated by a company that is transparent about who runs it and where the servers physically live, is structurally safer than one hidden behind a shell company. That combination, audit plus transparent ownership, is rarer than it should be in the mobile VPN category.
Where Proton VPN fits, and why it published this report in the first place
Proton is a Swiss company that has been building privacy tools since 2014, starting with Proton Mail and expanding into Proton VPN, Proton Drive, and Proton Pass. Its no-logs policy has been independently audited, and the company operates under Swiss data protection law, which is among the strictest in the world and sits outside the 5, 9, and 14 Eyes intelligence-sharing alliances. Proton VPN has also open-sourced its client applications, which lets external researchers inspect the code for exactly the kind of tracking behavior the report exposes elsewhere.
The report itself is a form of competitive positioning, obviously. Proton makes a paid VPN and benefits when users learn that free VPN apps come with hidden costs. But the underlying findings are verifiable through independent tools (Exodus Privacy is open source, AppTweak is a commercial third party), and the full report has been picked up by Forbes and other outlets that have no stake in Proton’s business. The methodology holds up on its own.
What to do right now if you’re using a mobile VPN
Start by checking which VPN app you actually have installed. If it’s one of the apps Proton flagged (VPN Proxy Master, VPN-Fast VPN Super, X-VPN), or any other free VPN with vague ownership and no published audit, uninstall it. The tracking damage from the past is already done, but at least the ongoing collection stops.
Then decide whether you actually need a VPN, and if you do, choose one that’s audited and transparent about who runs it. That’s a small list, and Proton VPN is on it. The company runs a free tier for users who want to try it before paying, and the paid plans unlock more servers, faster speeds, and features like Secure Core (which routes traffic through multiple servers in privacy-friendly jurisdictions) and NetShield (which blocks trackers and malicious domains at the network level).