• Broadcasters in France, Spain have submitted a formal complaint to FIFA
• Rightsholders labeled the partnership with ExpressVPN as "disastrous"
• ExpressVPN previously refused to implement sweeping anti-piracy blocking

FIFA’s decision to partner with ExpressVPN for the 2026 World Cup has sparked outrage among top European football broadcasters.

La Liga and French media giants, including LFP Media and Canal+, have formally submitted a complaint to football's governing body, slamming the new sponsorship as a "disastrous" message to the football ecosystem, according to reports from French sports newspaper L'Equipe.

"La Liga believes that this agreement is manifestly incompatible with the principles of protecting football's audiovisual rights that should govern the actions of world football's governing body," said La Liga president Javier Tebas.

Rightsholders are furious that FIFA would accept sponsorship money from a company they previously targeted with lawsuits for "facilitating access to pirated content," Tebas added.

In a statement to TechRadar, a spokesperson for ExpressVPN strongly denies such allegations.

"Any suggestion that ExpressVPN has been 'found guilty' of facilitating piracy is entirely inaccurate; we have not been convicted of any such conduct in any jurisdiction," the company told us.

While reiterating that a virtual private network (VPN) is a privacy and security tool — "not a loophole for illegal activities" — ExpressVPN also argues it has already presented a framework to national and EU authorithies to tackle the illegal distribution of copyrighted content, without breaking its no-logs VPN commitment.

For everyday football fans and privacy advocates, this corporate clash highlights the growing tension between rightsholders wanting total control over internet traffic and privacy companies defending open, unrestricted access.

If you are looking to secure your digital footprint, utilizing the best VPN is essential to bypassing unfair network restrictions and ensuring your online activity isn't monitored by your internet service provider (ISP) or third-party organizations.

A clash of privacy and anti-piracy

In France, organizations like the Association for the Protection of Sports Programs (APPS) have aggressively pursued court orders forcing ISPs and tech companies to block access to pirated streams.

ExpressVPN has historically resisted these demands, refusing to implement network-wide blocks. This staunch defense of an open internet led to the VPN provider being formally condemned in the country, making FIFA's sponsorship announcement a bitter pill for French broadcasters to swallow.

The situation has escalated similarly in Spain, where La Liga's president has spearheaded a controversial crusade against illegal streaming. La Liga’s heavy-handed tactics have been heavily criticized by digital rights groups, especially after a recent anti-piracy campaign backfired spectacularly, wrongly blocking over 500,000 legitimate websites in Spain.

The Spanish league has also previously attempted to fine individual users and pressure tech platforms into handing over user data. With La Liga’s war on piracy breaking the internet in Spain, privacy experts have warned that your VPN could be the next target.

Despite the immense legal pressure and the latest formal complaint to FIFA, top VPN providers have consistently argued that enforcing rightsholder site-blocks fundamentally compromises the security and architecture of a privacy service.

In fact, NordVPN recently won a crucial legal battle in Spain over La Liga piracy fines, establishing a major victory for user privacy against copyright holders.

Meanwhile, the climate in France remains incredibly hostile for privacy tools.

Earlier this year, a French court backed the LFP and ordered top VPNs to block illegal football streams. This sweeping injunction set a dangerous precedent, forcing the VPN industry to react to France’s aggressive order to block illegal streaming sites and defend the technical realities of zero-logs infrastructure.

• ExpressVPN has grown to 214 'distinct, app-selectable server locations'
• The 214-location count across 113 countries does not mean 214 cities
• ExpressVPN now covers around 196 cities, up from 189

ExpressVPN has rolled out the biggest network in its history, expanding to 214 distinct, app-selectable server locations across 113 countries.

It's a significant step up for a provider TechRadar last clocked at 189 locations, and it arrives as the fight to top our best VPN list increasingly turns on where you can connect, not how many servers hide behind the app.

The fresh additions reach places the network had not touched before, including Nuuk in Greenland, Lagos in Nigeria, Doha in Qatar, Valencia in Spain, and Manchester in the UK. The move builds on ExpressVPN's rollout to all 50 US states earlier this year, bringing that same local-first approach to the wider world map.

It's worth noting, however, that what the provider refers to as a "server location" is a connection option in the app, rather than a guaranteed unique city. For example, ExpressVPN's UK entries bundle multiple London-area spots that each count separately toward the total.

If you strip those duplicates out, the real coverage is narrower. By TechRadar's own tracking, ExpressVPN now reaches roughly 196 cities, up from 189. It's a definite upgrade, but it still trails NordVPN, which covers around 224 cities and leads on country count, too.

A bigger, more local network

ExpressVPN is pitching this as a local-first expansion rather than a raw server-count boast. The new connection points span Europe, Africa, the Middle East, and North America, while established markets have been deepened rather than simply widened.

The UK line-up now runs from Docklands and Tottenham to Manchester and the Midlands, Australia stretches from Adelaide to Woolloomooloo, and Japan covers Osaka, Shibuya, Tokyo, and Yokohama.

More nearby options can cut latency, give you a backup when a route is busy, and let you match a specific city, state, or region to whatever you are doing, from streaming and gaming to banking or working while travelling.

Every new location runs on ExpressVPN's RAM-only TrustedServer tech, which wipes data on each reboot, alongside its no-logs policy and its record of independent audits.

How to switch to the new locations

Getting to the new spots is simple. Update to the latest version of the ExpressVPN app, open the location picker, and browse the expanded country and city list.

If you would rather not choose, Smart Location will pick the fastest option for you automatically, based on speed, latency, and distance.

You can preview the full network on ExpressVPN's server locations page before you connect. And if precise city-level control is what you are after, it is worth checking if the list covers the exact places you need, rather than trusting the headline figure alone.

• India is reportedly working on new VPN regulations
• Companies could be forced to establish an office in the country
• VPNs found workaround to previous restrictions

India is working on an expansive new legal framework to clamp down on virtual private networks (VPNs), with proposals reportedly including mandatory local offices, designated compliance officers, and even prison terms for non-compliance.

According to The Indian Express, the upcoming rules aim to make VPN providers legally liable when citizens use their tools to circumvent government-mandated content blocks.

"In the last few months, we have been observing that users are able to bypass content, accounts, and online services that have been blocked by the government on various grounds by using VPN services," an anonymous senior government official told reporters.

This new set of rules is also seen as necessary, officials admitted, as the controversial data retention law enforced in 2022 by the Indian Computer Emergency Response Team (CERT-In) has proved to be unsuccessful.

The directive legally requires VPN firms, data centers, and cloud providers to log sensitive user information — including real names, verified IP addresses, and usage patterns — for up to five years, and surrender it to authorities upon request.

Yet, major VPN companies, including the likes of ExpressVPN, NordVPN, Hide.me, Surfshark, and Proton VPN, found a simple way to avoid compliance — removing their physical servers from the country.

"They have simply refused to comply. So, the need for a full-fledged law is being felt," the senior official told The Indian Express.

What's at stake for India's VPN users?

Beyond encrypting user data to boost privacy and security, virtual private networks (VPNs) spoof IP addresses, allowing users to bypass local, state-enforced geo-restrictions.

This capability has become critical for local internet users. Last month, India experienced a massive spike in VPN downloads after the government temporarily blocked the messaging app Telegram due to concerns over exam fraud.

Just weeks earlier, the Ministry of Electronics and Information Technology (MeitY) ordered VPN firms to actively block access to the decentralized prediction platform Polymarket, threatening legal repercussions if they refused.

The proposed framework aims to hand New Delhi the necessary legal teeth to force VPN providers into enforcing these content bans on the government's behalf. Digital rights groups frequently criticize India's aggressive approach to censorship; according to data trackers, the country consistently leads the world in government-imposed internet shutdowns.

While specific details of the draft framework remain scarce, leaked proposals suggest that offshore VPN companies will be required to establish a physical corporate presence in India and appoint local compliance officers to act as direct government liaisons.

Criminal penalties for non-compliance are also on the table, including potential prison sentences for local employees if an order is ignored.

However, serious questions remain over how authorities plan to enforce these rules. For many global VPN providers, simply keeping their physical servers outside of Indian borders has previously been enough to circumvent local jurisdiction.

It is also unlikely that premium, strict no-logs services will fundamentally alter their server infrastructure to comply with New Delhi's demands — especially after resisting a similar ultimatum four years ago.

Dr. Pete Membrey, Chief Research Officer at ExpressVPN, pointed back to the company's 2022 decision to become the first major provider to pull its physical servers from India, confirming that its stance remains.

"We’ll evaluate when a proposal is published," Membrey told TechRadar, adding that "ExpressVPN will continue to work hard to keep users connected to the open and free internet, no matter where they are located."

A Surfshark spokesperson also said that the company remains committed to upholding the privacy of its users.

TechRadar reached out to India's Ministry of Electronics and Information Technology (MeitY) and CERT-In for further clarification on the draft framework and an expected enforcement timeline. Neither agency responded prior to publication.

The World Cup's extortionate prices are well documented, but what if you could avoid the highest cost of them all, the ticket?

To access the pivotal stages of this year's tournament, tickets start at over $ 1,000, with some reaching up to $9,000. Luckily, ExpressVPN is giving you the chance to avoid this cost altogether.

Sign up for an ExpressVPN plan between now and July 11, and you'll be entered into a raffle for a chance to win tickets to the quarterfinals, semifinals, or the grand finale.

The longer the plan you choose, the more entries you get. 1-month plans get 1 entry, 1-year plans get 5 entries, and 2-year plans get 10 entries.

It's worth noting that the raffle is only for the ticket. However, the thousands you'll save on the ticket should cover the majority of other expenses you need for this once-in-a-lifetime game.

For the best value, I'd recommend a two-year Basic or Advanced plan. While the 'low' price of a one-month plan might be appealing, it only gets you one raffle entry, and it's a more expensive monthly plan than you'd find from other VPNs.

Picking an Advanced plan is probably the better choice if you fancy your odds of winning.

The 3 days of Holiday.com eSIM access included in Advanced plans means you shouldn't struggle to stay connected while you're out there. Plus you can use ExpressVPN across more devices, and gain access to features such as ExpressKeys, MailGuard and more.

If you're new to VPNs, don't worry. We rate ExpressVPN among the best VPNs for beginners, and it's also the most secure VPN we've tested this year. This means you should be able to get started quickly and never need to worry about your connection again.

Not convinced? Some of the best VPNs are also running superb deals right now, so long as you're willing to sacrifice your chance at a seat at the World Cup. Check out the best VPN deals right now below.

Travelling to World Cup matches shouldn't mean paying huge sums to keep your phone working.

While some domestic add-ons will serve you well enough, what if there was a way to access unlimited data and secure your internet traffic in the process while you watch the World Cup?

An ExpressVPN Advanced plan encompasses five main tools. A VPN, eSIM, password management, Identity protection, and private emails – all for only $3 per month.

That means avoiding US roaming charges and it's also perfect if you want to watch the World Cup matches you're missing from your hotel room without paying for US streaming services because you can tune into BBC and ITV for free, just as you would at home.

ExpressVPN remains the most secure VPN I've tested. Its eSIM, provided by holiday.com, covers 150 countries with unlimited data for 3 days.

ExpressKeys offers unlimited password storage and generation, credit card storage, password health checks, and 2FA. Identity Defender gives you up to $3 million in identity theft insurance, and MailGuard comes with unlimited aliases.

In short, it comes with everything you need to travel to the World Cup this summer without overpaying for your phone.

If, however, you're at the game, you can use the VPN to dodge awful stadium Wi-Fi speeds thanks to separate, encrypted traffic tunneling. You'll also be protected against identity theft in the process, thanks to Identity Defender.

Normally, an Advanced plan would set you back much closer to $4.50 per month, which would then be paid upfront as anything up to $108. Now, it's only $83.72, and it throws in 4 extra months of protection with that cost.

ExpressVPN offers US locations in all 50 states, three Canadian cities, and one in Mexico City. This means no matter the game you're headed to, you can always be protected.

That said, several other VPNs could suit you better. NordVPN and Norton VPN both offer better streaming performance if you want to stream another game while you're travelling, and Surfshark is a cheaper option if you're just after a VPN.

ExpressVPN is, however, the only VPN offering the chance to win tickets to a World Cup match. The promotion has one more day before entries close, and gives you a chance to win tickets to a quarterfinal, semi-final, or even the final.

Be aware, though, that the promotion comes at the expense of ExpressVPN's 30-day money-back guarantee. So, if you sign up, you're locked in.

• Past breach data show over 1.1 million soccer-related passwords
• ExpressVPN found that nearly 1 in 4 football fans use this info in their logins
• Experts urge to delete any sports references from account logins' details

As the FIFA World Cup kicks into high gear, millions of fans are displaying their loyalty online. While you might already be using the best VPN to secure your browsing, ExpressVPN — now an official supporter of the 2026 tournament — is warning that this very public fandom can translate into a major cybersecurity vulnerability.

In a new research report, cybersecurity researcher Jeremiah Fowler partnered with ExpressVPN to examine how soccer obsession influences our password choices. The results suggest that fans are openly handing hackers the keys to their digital lives by using highly predictable phrases.

Fowler's analysis of historical data breaches revealed more than 1.1 million soccer-related passwords. Words like "soccer," alongside massive club names such as "Liverpool," "Chelsea," "Arsenal," and "Barcelona," appeared repeatedly throughout the dataset.

Because fan loyalty is incredibly public, plastered across social media profiles, usernames, and group chats, these passwords are far easier to crack than a random string of characters.

"As a cybersecurity researcher, I've seen criminals target people through the interests they share most openly," Fowler explained. "A club name, player nickname, shirt number, stadium, city, or tournament year may look harmless on its own, but together those details can help someone guess how a fan might build a password or craft a message they're more likely to trust."

An open goal for cybercriminals

To determine if this behavior remains common today, ExpressVPN surveyed 6,000 football fans across six countries. The findings confirm that bad password hygiene is still widespread.

Nearly one in four surveyed fans admitted to having used soccer-related information to secure an account.

Among these fans, the most common choices included their favorite team names, player names or nicknames, and jersey numbers. These easily searchable statistics are exactly what malicious actors look for when compiling custom dictionaries to breach an account.

The fans themselves are surprisingly aware of the risk. In the US, a massive 73.1% of those using soccer-themed passwords acknowledged that someone familiar with their sporting interests could likely guess their login.

This vulnerability is compounded by the fact that many fans are already putting their digital privacy at risk through other careless online behaviors during the tournament.

How to protect your accounts

Using a weak password becomes catastrophic when you consider password reuse. According to Aaron Engel, Chief Information Security Officer at ExpressVPN, the habit of using the same login across multiple services is what turns a minor breach into a full-scale privacy crisis.

"Password reuse is what allows one exposed credential to become a wider account-security problem," warned Engel.

He also noted that fans who share streaming logins put their personal data in further jeopardy: "Sharing passwords increases the number of people and devices that may hold that password; in doing so, users are putting their security into the hands of others. Multi-factor authentication doesn't undo reuse, but it can prevent a stolen password from being enough on its own."

If you want to stay safe while streaming the tournament, you should immediately strip any sports references out of your logins. Instead, use a dedicated password manager to generate complex, unique credentials for every account.

It is also a great time to ensure your overall connection is encrypted, particularly if you are wondering whether to use a VPN to watch the World Cup.

Just keep in mind that new ExpressVPN users still have a chance to win a premium ticket for the World Cup, but you won't get its usual 30-day money-back guarantee.

Traveling today comes with a hidden bill that catches many off guard. It isn’t just the price of the flight or the hotel; it’s the steady drain of international roaming fees. Take Verizon’s TravelPass for instance. At $12 a day, this quickly adds up and can turn an exciting 2026 FIFA World Cup trip into an unexpectedly expensive one.

While some travelers rely on public wifi to save, this often means battling sluggish speeds and insecure networks that risk your data. Fortunately, the way we stay connected while abroad is changing. The world’s best VPN services are no longer just encryption tools; they’ve evolved into direct mobile data providers.

By bundling secure VPN access with an affordable eSIM plan, you can skip sky-high carrier fees and stream your favorite shows without geo-blocks. This ensures a secure, seamless connection throughout the tournament without having to worry about surprise bills.

Saily: NordVPN's highly flexible, pay-as-you-go traveler

Saily, NordVPN’s flexible eSIM platform, is ideal for travelers who prefer pay-as-you-go control over their data spending.

Instead of committing to a single monthly plan, you can purchase small 1GB or 5GB allowances exactly when you need them. The setup is refreshingly simple: you install just one eSIM profile on your phone. Once installed, it handles all of your data without cluttering your device with extra apps.

It’s worth keeping in mind that NordVPN and Saily remain separate subscriptions. Though you can link your logins, they don’t merge into a single bill. Instead, you’ll manage them independently, paying strictly for the data you use and the VPN access you need.

Holiday.com: ExpressVPN’s unlimited data premium tier

Subscribing to an ExpressVPN one or two-year Advanced or Pro plans gives you a coupon for Holiday.com, their eSIM partner. This partnership effectively bundles unlimited mobile data into your existing subscription.

However, the setup isn’t fully integrated. You still need to download a separate Holiday.com app to activate and manage your eSIM plan, meaning you’ll be switching between two different apps to stay secure and connected.

Plus, these unlimited data offers are time-capped, at three or five days. If you need more data, you can conveniently top up via the ExpressVPN dashboard.

What if your VPN doesn't do data?

Not everyone wants to switch providers just for a trip. If you’re already loyal to a traditional security suite, you might be disappointed to find they don’t offer cellular data themselves, preventing you from enjoying the convenience of an all-in-one solution.

The process is simple enough but requires a little more legwork. You’d need to purchase a standalone eSIM from a provider like Airalo – one of the best eSIMs for global travel –then manually toggle your VPN app on top of it when you need encryption.

This lets you shop around for the cheapest data plans but with the caveat that you’ll be juggling two separate apps.

Verdict

Choosing the right setup depends entirely on your travel style. Saily takes the crown for budget-conscious fans who want total flexibility; its pay-as-you-go model lets you buy exactly what you need without overcommitting.

On the other end of the spectrum, Holiday.com (via ExpressVPN) is the superior choice if you need a lot of data for streaming World Cup matches.

Other VPNs remain a robust option if device security is your top priority, offering complete control to shop for the best eSIM deals. However, this comes with a trade-off: you’ll be managing two separate subscriptions and apps. For most travelers, this DIY approach isn’t worth the hassle unless you have a specific security preference.

• ExpressVPN has pushed version 14.2.0 to its Mac, Windows, and Linux apps,
• The update opens the app in compact mode by default, with a cleaner look
• A new MCP server lets AI coding tools read and control your VPN connection

ExpressVPN has just rolled out version 14.2.0 across all three of its desktop apps, and the headline change is a polished new coat of paint.

Released on June 17, 2026, the ExpressVPN update lands simultaneously on Mac, Windows, and Linux, keeping the experience consistent no matter which platform you're on.

It isn't the kind of ground-up overhaul we saw earlier this year, but it's a tidy round of refinements that should make day-to-day use feel that bit smoother. Most of the work is visual, with the layout tightened up and several sections given a cleaner design, with accessibility also getting a mention.

The provider, which we rate as one of the best VPN services around, has officially added an MCP server to all its desktop apps after a successful beta release. This gives AI coding tools a way to control your VPN connection directly from inside your development environment.

A fresh look across the board

The most noticeable change is the redesign. The app now opens in compact mode by default, and the layout has been polished for better readability and spacing. The Add-ons section gets a cleaner card design that makes each add-on easier to find and use, while Advanced Protection has been visually updated for a clearer, more consistent appearance.

The Dedicated IP setup pages have also been redesigned to match the latest visual style, with a few small layout issues in compact mode ironed out at the same time.

These tweaks build on the larger redesign ExpressVPN introduced earlier in the year, when it moved away from its super-simple approach toward a home screen that surfaces more information and gives instant access to key settings. The iconic giant 'Connect' button is still front and center, just with more to look at around it.

There's a practical addition under the hood, too. A new background latency switch lets you turn off the latency checks that feed the on-screen map, and if you disable them, you can simply refresh locations manually instead.

In a step forward for accessibility, ExpressVPN also lists improved keyboard focus and better screen-reader support among the changes in this release. That's a welcome fix considering that, in our latest ExpressVPN review, we pointed out how keyboard navigation has actually become worse due to the new layout.

A bigger push into AI

The standout functional change is the arrival of the MCP server.

ExpressVPN first gave AI agents the power to control your connection in March, but only as a beta release. The new update seems to be including the official stable release.

In short, the Model Context Protocol server acts as a local bridge between your AI tools and your VPN. It works with MCP-compatible clients, including Claude Code from Anthropic, OpenAI's Codex, and Cursor, letting an AI assistant read and control your connection without you ever leaving your coding environment.

For developers who already lean on AI tooling, the appeal is obvious: VPN controls have traditionally sat outside these workflows, so being able to manage your connection through natural-language prompts removes a fiddly bit of context-switching.

Should you update?

Yes.

While there's nothing here that fundamentally changes how the app behaves, the cleaner layout, tidier Add-ons and Advanced Protection sections, and the new background latency control all add up to a more comfortable experience.

The MCP server, meanwhile, is a genuinely forward-looking addition for anyone working alongside AI coding tools.

ExpressVPN has removed its 30-day money-back guarantee for new subscribers following its recently announced 2026 World Cup sponsorship and ticket draw.

In its updated terms of service, the company says the "promotional benefit" of the raffle "cannot be combined with the money-back guarantee".

Removing the money-back guarantee while hosting a World Cup raffle makes sense, given that people could repeatedly sign up in a bid to boost their chances of winning a ticket before canceling their subscriptions after the winner is announced.

However, if you're new to VPNs, we always recommend using a service with a money-back guarantee. It gives you the time you need to get used to a VPN, install it on all your devices, and be 100% sure you're happy before committing your funds.

So, if this has put you off ExpressVPN for now, which VPNs should you choose? More importantly in this instance, which VPNs go above and beyond, offering bigger guarantees than most.

The best VPN money-back guarantees

I've scoured the web, and these are currently the best 3 VPN money-back guarantees you'll find:

World Cup 2026 has kicked off — and if you’re looking to keep up with the latest matches wherever you are, or just keep your connection secure, it’s a good idea to use one of the best VPNs while streaming.

It’s well known that most major VPN providers offer apps for desktop, mobile, and tablets, but some go a step further with apps that you can install straight onto your TV.

Having a VPN app on your TV means skipping the hassle of connecting via a phone or laptop and allows you to keep your streaming activity and personal data private.

However, not all TV operating systems are alike when it comes to VPN availability — while Android TV, Google TV, Amazon Fire OS TVs and Apple TVs support native VPN apps, Samsung’s Tizen OS and LG’s webOS don’t. But don't worry, we’ll cover a workaround below.

Which VPNs work on TVs?

Which VPN will work on your TV depends on which platforms your VPN service is available on and whether your TV allows VPNs to run on its operating system.

Some VPNs are widely available across platforms. Norton VPN has a native app on Apple TV and Amazon Fire TV, and Android or Google TVs can run the Google Play version of the app natively.

The same is true for NordVPN and ExpressVPN, which both support all four platforms. However, it’s worth checking your VPN service’s specific device support information. Amazon’s latest Vega OS Fire Sticks, for example, is not compatible with ExpressVPN or Norton VPN.

For more details on the operating systems supported by different VPNs, it's worth checking out our roundup of best smart TV VPNs.

As for Samsung TVs running Tizen OS and LG TVs running WebOS, VPN apps are not natively supported — but this doesn’t mean you’re out of luck if you’re looking to watch the World Cup securely.

How to use a VPN with a Samsung or LG TV

To access VPN-like functionality on a Samsung or LG TV, you'll need to use Smart DNS. This effectively reroutes your Domain Name System (DNS) queries, so you can access your favorite shows from home. However, it won't mask your IP address or encrypt your traffic like a VPN does.

It’s not a given that a VPN service will offer a SmartDNS feature. Of the best VPNs, ExpressVPN comes with its MediaStreamer SmartDNS tool, while NordVPN also has a SmartDNS capability. CyberGhost, which features in our best smart TV VPN list, also offers this functionality.

Using this method isn't always that easy and success isn't guaranteed. The simpler solution s to run a VPN on a laptop or mobile device, stream the World Cup (or whatever you’d like to watch) on that device, and then connect to your TV with a HDMI cable.

Can I cast a VPN stream to my TV with AirPlay or Chromecast?

Unfortunately, casting from a phone running a VPN to a TV not running a VPN usually doesn’t work, because the two devices aren’t part of the same network environment.

Casting relies on communication between devices on the same network, so using a VPN on only one device can interrupt the connection between them.

If you link both your TV and phone to the same network — either behind the VPN or with SmartDNS — you’ll have a better chance of casting, but it’s still not as reliable as using a native VPN on your TV, or even using SmartDNS.

So the tip worth remembering: if you're TVs operating system allows it, download a VPN direct to your device. If it doesn't, you can always use your laptop and connect to your TV using a standard HDMI cable.

This year, London Tech Week is set to be remembered for an 'innovation' in how we use our devices — but not one that tech fans would expect or, perhaps, want.

On its opening day on Monday, British Prime Minister Keir Starmer took the stage at the Olympia event and gave Big Tech an ultimatum: Apple and Google have three months to implement on-device scanning technology to prevent children from accessing explicit images.

"If we are serious about unlocking the opportunities that tech can bring, then we must also be serious about protecting our children from those who look to abuse it," said Starmer in his speech.

For the government, the move is non-negotiable to stop the rise in online child sexual abuse material (CSAM) and grooming incidents. It's also a feasible task, according to Starmer.

"This is not an impossible challenge," he said, threatening to "change the law" if tech companies don't comply.

A wave of privacy backlash was quick to follow online, especially among privacy tech providers and advocates.

Talking to Bloomberg, President of the encrypted messaging app Signal, Meredith Whittaker, went as far as to say that her company "would rather exit a market than undermine the technical guarantees that people trust for their privacy".

So, is on-device scanning the solution to children's safety that we were waiting for, or a disproportionate response set to erode privacy and security and expose confidential communications? Let's lay out all we know.

How on-device scanning could work

Right now, we know very little about how these scanning technologies will work in practice. But we do know that Apple, Google, and other companies have been making progress with on-device detection functionalities and children's safety.

After introducing broader child safety features and age checks for UK iPhone users, this week Apple unveiled some new tools to help parents protect kids and teens online. These include a simpler way for guardians to manage child accounts and age ratings in the App Store, alongside a SensitiveContentAnalysis framework for developers to build apps that can check for and blur nudity.

Communication Safety is another tool that Apple says will enhance child safety while also safeguarding privacy. Turned on by default for accounts under 18, the feature automatically blurs explicit images received via iMessage, AirDrop, FaceTime video messages, and shared photo albums.

Google has also been making progress. Parents using Android can already manage screen time, track the location of their children's devices, and block camera access. The Big Tech giant also includes a Sensitive Content Warning feature on Messages to detect and blur explicit images.

These are certainly a good start, but none address the more regularly used methods of messaging communications among teens, like Snapchat and Instagram.

Equally, blurring explicit harmful content is one thing, but blocking it altogether is a step further that requires a very high bar for precision to avoid unintended consequences and trigger false positives

That balance, however, is something another company promises to have found.

UK cybersecurity firm SafeToNet — and the linked children's online safety advocate group SafeToNet Foundation — have developed HarmBlock: a technology that works at the operating system level to detect and block explicit images in the camera app, messages, and even encrypted environments like WhatsApp.

Talking to TechRadar, SafeToNet's Co-Founder, Sharon Pursey, explains that HarmBlock works by scanning for image pixels on three different levels: at the screen, on storage, and at the point of broadcast.

Pursey is assured that the rate of accuracy is 98% plus and says that HarmBlock can easily distinguish between an explicit sexual image and an innocent picture of someone on a beach, for example.

So, are SafeToNet, Google, and Apple working together to build what the government's asking for? "I can't deny or confirm," Pursey told TechRadar.

A Home Office representative, however, confirmed to us that the "technology is already there," but did not specify which ones. The Home Office also told us that what the government is now asking is "to apply it differently".

Can scanning ever be private and secure?

Experts have long warned against the idea of so-called client-side scanning. Back in 2023, experts' criticisms led UK lawmakers to decide to halt any scanning requirements within the Online Safety Act until it was technically feasible to do so privately and securely.

Now, the government appears to be convinced that that day has arrived, but technologists and privacy advocates aren't buying it.

From a technological point of view, Mullvad VPN's Founder, Daniel Berntsson, believes that operating system-level scanning will inevitably harm the trust that users have in their devices. And this, he explains, will consequently impact people's privacy rights.

"No one will be able to trust their ultimately government-controlled device for anything requiring privacy, including, among lots of other things, many uses of VPN services," Berntsson told TechRadar.

Robin Wilton, Internet Society's Senior Director for Internet Trust, echoes these concerns. He argues that these functionalities will introduce security flaws into the OS that could later be exploited by criminals and hostile governments alike.

"Whether it’s done by weakening encryption, keeping copies of users’ keys, or reading their messages before they are encrypted, the bottom line is that users can no longer have confidence in the security or privacy of what they send and receive," Wilton told TechRadar.

In a post on X, the UK's Home Office Secretary, Shabana Mahmood, ensured that "there is no reporting, no data collection, no monitoring, and no images leaving the device".

But, Policy Manager at the Open Rights Group, James Baker, isn't convinced.

"I don't know how the Home Secretary can claim that no data will be lost when they're telling companies to develop this software," Baker told TechRadar. "And if she knows that the software exists, then why isn't she being open about saying what it is they're going to do?"

From her side, Pursey from SafeToNet, assures that HarmBlock has been built in a totally privacy-preserving way. Images, she explains, are never stored, but deleted as soon as they are blocked. Everything happens on the device.

Security experts, however, are also all worried about the risk of mission creep. Once these features are on the device, they argue, it would be easy for either the current or future governments to expand on these scanning abilities.

In a fierce open letter, Signal raised this exact problem (among others) by noting: "We know that mass surveillance and censorship capabilities, however sincere-sounding the promises of those who initiate them are, never remain narrowly scoped."

The age verification paradox

While we need to wait and see how the UK government’s proposed final detection and blocking tools will work in practice, there is another intrinsic requirement that's making privacy advocates worried — mandatory age verification.

To determine whether a device is owned by an adult or a child, all users will have to go through ID checks. This, according to Silkie Carlo, director of Big Brother Watch, "will only result in population-wide ID checks for all of us to use our phones, tablets, and laptops".

Beyond whether that's an ethically proportionate request, there may also be a serious privacy and security aspect. Current age verification methods have so far proven to be inadequate in protecting people's sensitive data. The exposure of 70,000 Discord users’ government-issued ID photos because of a third-party vendor should be a stark reminder.

This was among the reasons that led to a coalition of over 400 scientists calling for a halt on age checks until a "scientific consensus" is reached on the balance of benefits versus harm to the wider population.

This is exactly why, according to Baker from Open Right Group, on-device scanning cannot be done in a privacy-friendly way.

"It is going to harm everyone's privacy because everyone is going to have to go through a digital ID checkpoint just to access their device and to access the internet," he told TechRadar.

What's next?

It's hard to say at this stage whether the UK plans to force locked devices on children is the right way to address online harms, nor if it's really possible to do so without breaking devices' privacy and security for all Brits.

What's certain, however, is that this is only the first step in the current commitment to making UK kids safer online.

Drawing on the results of its safety consultation, the government is expected to announce a social media ban for teens next week. According to indiscretions reported by Politico, restrictions will target specific features like livestreaming and disappearing messages.

For digital rights experts, however, a ban isn't a real fix. Commenting on this point, Wilton from the Internet Society told us: "I think secure and privacy-preserving age verification technology can be developed — but that doesn’t solve the human or societal parts of the problem".

It’s a position shared by child safety group, 5RightsFoundation, which has urged the government to start challenging the harmful tech companies' business model rather than policing kids.

Baker, from Open Rights Group, remains optimistic that it isn't too late to reverse this global direction, though. He told TechRadar: "I think it's going to spawn at some point a new global movement of people who are fighting for their free expression rights and open access to the internet. So, watch that space."

With more threats to come for digital freedom expected next week, we may not have to wait too long.

• ExpressVPN is now the exclusive VPN supporter for the FIFA World Cup 2026
• It offers 50 premium tickets for the quarterfinals, semifinals, and final
• The partnership aims to keep traveling fans digitally secure

In a major move to bring digital security to the global stage, ExpressVPN has announced it is an Official Tournament Supporter for the FIFA World Cup 2026 in the US, Canada, and Europe.

Currently among our best VPN recommendations, ExpressVPN is the exclusive VPN supporter for the event — an achievement the company confirmed to be the largest sports deal it has ever signed.

To celebrate the landmark announcement, ExpressVPN is running a ticket sweepstakes for people who sign up to its services, giving lucky fans the chance to win 50 premium tickets spanning the quarterfinals, semifinals, and the highly anticipated final. Note that these purchases won't be covered by the usual 30-day money-back guarantee, as per the company's Terms and Conditions.

With the tournament expected to draw a staggering global audience of around six billion viewers, the stakes for digital privacy have never been higher. The sheer scale of the event makes it the perfect venue to remind fans that online safety matters wherever they watch.

Charles Butler, Chief Executive Officer of ExpressVPN, says: "The FIFA World Cup 2026 is the greatest show on Earth, and our goal is for fans to experience every moment of it securely, without their data being stolen in the process.”

The company is also planning a major Times Square Digital Takeover in partnership with Clear Channel Outdoor during the week leading up to the final, featuring AI-powered advertisements across New York's iconic displays.

Why the World Cup is a cybersecurity flashpoint

While the excitement of the tournament is undeniable, major international sporting events are consistently some of the most targeted moments on the cybersecurity calendar. The FIFA World Cup 2026 will see millions of fans flocking to stadiums across the US, Canada, and Mexico. Many of these attendees will be traveling internationally, relying on foreign SIM cards and hotel networks they have never used before.

This massive influx of travelers means a heavy reliance on unsecured public Wi-Fi networks at airports, restaurants, and local venues. Fans bouncing between a dozen or more of these networks on any given day are at significant risk of surveillance and data theft. Cybercriminals regularly exploit these high-traffic events, launching phishing campaigns tied directly to ticketing, travel itineraries, and team merchandise.

Even seemingly legitimate venue Wi-Fi networks can be incredibly dangerous. Hackers frequently use off-the-shelf tools to spoof real networks, a tactic known in the industry as an "evil twin" attack.

A recent ExpressVPN research highlighted that 7 in 10 World Cup football fans are ready to put their digital privacy at risk, often blindly trusting a public network simply because it carries a familiar venue name. Unfortunately, that familiar name is not always proof that a connection is safe.

This isn't ExpressVPN's first foray into the sports world; the provider recently partnered with Tottenham Hotspur to bolster digital defense for fans. However, the World Cup operates on an entirely different scale, making pitch-side cybersecurity reminders a vital addition.

For those watching safely from home, the security risks might be lower, but a VPN still offers massive benefits. If you're wondering, should I use a VPN to watch the World Cup, the answer remains a resounding yes — whether it's to avoid ISP throttling or simply to secure your connection while streaming the beautiful game.

• 73% of surveyed fans trust public Wi-Fi just by its name
• Evil twin attacks exploit stadium networks
• Using a quality VPN secures your data on public networks

With the 2026 World Cup on the horizon, millions of football fans are set to unintentionally expose themselves to cyber threats by prioritizing connectivity over security on stadium Wi-Fi networks.

A recent survey commissioned by ExpressVPN, one of the best VPN services on the market, reveals a startling disconnect between fan enthusiasm and cybersecurity awareness ahead of major tournaments like the 2026 World Cup.

A survey of 6,000 football fans across six markets revealed that 73% said they would trust and connect to a public Wi-Fi network if it used the name of a venue they were attending. Yet fewer than four in 10 fans said they could reliably tell a real public Wi-Fi network from a fake one.

This willingness to accept danger stems from several factors: the desire to share live moments instantly on social media, check real-time scores and stats, stream matches, or simply stay connected while traveling to venues. For many supporters, all of this feels like an essential part of traveling, so they willingly connect to unsecured networks despite the risks.

"Cybercriminals don't need sophisticated tools"

Stadium Wi-Fi represents one of the most vulnerable points in a fan’s matchday experience. These large-scale public networks create ideal conditions for cybercriminals to deploy simple yet effective attack vectors.

Among the most prevalent threats is what's known as evil twin attacks, a technique that involves cybercriminals setting up rogue Wi-Fi networks that mimic legitimate venue access points to trick people into connecting.

As Aaron Engel, ExpressVPN’s Chief Information Security Officer, explained: "Cybercriminals don't need sophisticated tools to target football fans. They can name a network after a stadium, hotel, or fan event and wait for people to connect. Our research shows that familiar names carry more trust than they should."

Once connected to a rogue network, attackers can intercept login credentials, financial data, and personal messages. This exposure can lead to unauthorized account access, identity theft, and financial fraud.

The consequences of falling for such a trap extend far beyond momentary inconvenience, with younger fans facing the highest stakes. In the US, for example, 30.2% of fans aged 18 to 29 admitted to checking their banking or financial apps while connected on stadium Wi-Fi.

With personal information becoming increasingly valuable, the price of connecting to that unsecured network could end up being surprisingly high.

How football fans can protect themselves

Fortunately, protecting yourself doesn't require sacrificing connectivity or the ability to share your matchday experience. Taking several straightforward security measures can significantly reduce exposure to these common threats.

First and foremost, fans should avoid conducting sensitive activities on public Wi-Fi networks entirely. Banking applications, shopping purchases, and password changes should all wait until you’re on a secure, private connection.

Using a reputable virtual private network (VPN) encrypts all of your traffic regardless of the underlying network quality, creating a secure tunnel that prevents even advanced attackers from reading transmitted data.

Additionally, travelers should disable automatic Wi-Fi connections before arriving at destination stadiums. Supporters should also ensure their device operating systems and applications are updated before travel, and enable two-factor authentication (2FA) on all accounts.

By combining these practices, football fans can navigate the 2026 World Cup with confidence and focus on the game rather than security threats.

The tech giants are pushing back against Canada's Bill C-22. Companies are raising the alarm over the cybersecurity and privacy risks that these new obligations will pose.

Encrypted messaging app Signal and Windscribe VPN went as far as to vow to leave the country if it becomes law.

And the Canadian government appears to be listening to these concerns and has agreed to clarify contentious points around encryption and metadata. However, Canada's Minister of Public Safety, Gary Anandasangaree, remains firm that tech companies are "misinterpreting" the bill.

In a statement to TechRadar, the ministry "categorically rejects" claims that Bill C-22 would enable surveillance, arguing that the provisions are meant to "modernize" lawful access to data in line with similar requirements existing in other G7 countries.

"For international companies, to claim that Bill C-22 would somehow undermine their ability to offer robust privacy and security features is simply misleading," Simon Lafortune, Deputy Director of Communications and Press Secretary to the Minister of Public Safety, told TechRadar.

Tech giants, alongside some of the best VPN providers and encrypted messaging services, aren't convinced, though. Google has warned of "surveillance infrastructure" and, together with Apple, urged lawmakers to add explicit protections for encryption.

Meanwhile, a joint report from Citizen Lab and the Canadian Civil Liberties Association recently branded the proposed legislation "almost certainly constitutionally fatal".

So, what is the actual threat to Canadian privacy? Why are tech providers so worried? And, most importantly, will they manage to make the government actually rethink its surveillance law?

The encryption debate

Lafortune maintains that the government has made it clear that strong encryption is essential to cybersecurity, economic growth, and the protection of Canadian citizen personal information.

"We want to reassure Signal, Windscribe, NordVPN, and all service providers that we are not legislating to require them to install capabilities to enable surveillance, and any assertions otherwise are false," Lafortune told TechRadar.

One of the major areas of contention surrounds the draft's definition of encryption and vulnerabilities. In a May 13 submission, Google called for clearer definitions, while privacy advocates have warned about the law's potential future impact.

Laura Tyrylyte, privacy advocate at NordVPN, told TechRadar: "In its current form, Bill C-22 grants the government overbroad, unsupervised and opaque Ministerial Order powers that could effectively compel any electronic service provider to build technical capabilities that compromise end-to-end encryption, insert backdoors, or perform surveillance."

The VPN industry is largely united in its opposition to the bill, with representatives from ExpressVPN, Proton VPN, and Windscribe all echoing similar concerns.

ExpressVPN's Chief Research Officer, Pete Membrey, told TechRadar: "Even well-intentioned requirements can create pressure for providers to build technical capabilities that weaken security or undermine trust in encrypted services."

Meanwhile, Proton VPN's David Peterson said that politicians are at risk of misunderstanding how encryption works. "If you create a backdoor in encryption, it cannot be selective — it allows both good and bad actors in equally," he said.

For Yegor Sak, CEO of Windscribe, the issues with encryption are linked to another contentious point — greater data retention. He told TechRadar: "[The bill] forces companies to build technical capabilities and retain data in ways that make it nearly impossible to maintain strong encryption without major changes to how the service works."

Metadata privacy matters

Bill C-22 seeks to significantly expand providers' data retention obligations.

The government maintains that the bill introduces "limited retention requirements strictly for metadata," and the text does include restrictions on collecting data that could reveal the "content" of communications, users' "web browsing history," and their "social media activities."

For Sak, however, forcing companies to build data logging systems and "retain large amounts of metadata" directly undermines encryption.

"You can have strong encryption and effective law enforcement. You just can’t have both if you’re also forcing companies to weaken their architecture, which will put users at risk," he told TechRadar.

Even though metadata does not explicitly reveal the content of online activities, its privacy implications are vast. Powered by modern AI tools, tracking this information enables law enforcement — or any malicious actor with the necessary skills — to build a highly accurate picture of a user's digital life without ever breaking encryption.

Michael Geist, Canada Research Chair in Internet and E-Commerce Law at the University of Ottawa, warned that mandatory metadata retention will "create a national surveillance map" of Canadians' movements and communications.

Tyrylyte also views this level of data collection as "disproportionate and dangerous," especially in an era where citizens are increasingly targeted by data breaches, fraud, and identity theft.

Will the government find a compromise?

It remains unclear how the government intends to improve transparency and accountability. Minister Anandasangaree has said that he intends to pass the bill before Parliament breaks for the summer on June 19.

Conservatives also recently moved a motion to split the legislation in half to allow further study of the controversial encryption and metadata provisions.

However, Proton and Windscribe are not optimistic that any concrete changes will materialize.

"It is difficult to see how the privacy of Canadian citizens can truly be preserved while simultaneously granting law enforcement broad access to their most sensitive data," Peterson said.

Sak shares this skepticism, saying that potential amendments "will mostly be fluff."

Regardless, the government's stance remains firm. "The government remains committed to protecting both public safety and the fundamental rights of Canadians, and we look forward to Bill C‑22 proceeding through Parliament and receiving Royal Assent as soon as possible," Lafortune told TechRadar.

As a G7 nation and a member of the Five Eyes intelligence alliance, Canada's final lawful access framework could set a global precedent.

And with a growing list of countries attempting to "modernize" law enforcement's ability to access citizens' data, the implications stretch far beyond Canadian borders.

• ExpressVPN's new products pass third-party review
• This brings its independent audits to 27
• Some medium-severity issues were identified

ExpressVPN is celebrating the results of a new independent audit carried out by third-party cybersecurity firm Cure53, bringing its total number of third-party assessments to a whopping 27.

The new audits were completed on two products launched by one of the best VPNs on the market, a few months back: ExpressMailGuard — a service that provides limitless email aliases — and Identity Defender, an identity protection app.

Curve53 gave the green light with no significant vulnerabilities reported. However, it highlighted several areas that required closer attention. More details below.

While this was not a clean score-sheet on this occasion, such findings highlight why independent audits are now crucial for any reputable provider wanting to provide a truly secure VPN service for its customers. In this context, an independent audit is not just about a software passing a test the first time, but rather an open commitment to address any architectural issues that may arise.

ExpressVPN is a veteran when it comes to third-party checks. Since its first audit in 2018, its products have been consistently scrutinized by several renowned firms, including PwC, Cure53, and KPMG, securing four ISO certifications, and reflecting a growing commitment to accountability that goes well beyond industry standards.

"Every product we build that touches user data gets handed to independent researchers whose job it is to break it. Twenty-seven audits later, we remain committed to the same standard: trust must be earned, not assumed," said Aaron Engel, CSO at ExpressVPN — words to live by when we talk about VPNs.

What Cure53 found?

Curve53 conducted comprehensive source-code reviews and infrastructure assessments of both products — from UIs and email processing functionalities to backend infrastructure, authentication, personally identifiable information (PII), and data storage.

Investigations took place in early March and were carried out for a maximum of 18 days.

In the case of ExpressVPN Identity Defender, the independent auditor identified eleven areas of concern. Of these, seven were classified as security vulnerabilities of a 'medium' grade; issues that do not cause a major impact on any area within scope.

Two medium-severity issues related to the storage of unencrypted data. In the first case, ExpressVPN was passing unencrypted data structures to its log and, in doing so, prevented its redacting processes from securing them. In the second, data relating to the user identity was being used for a secondary purpose, thereby inadvertently providing hackers with one potential way to triangulate data about you.

For ExpressMailGuard, Cure53 team identified even more issues — a total of thirteen findings. However, of these, only two were classified as direct security vulnerabilities, and eleven were categorised as more general weaknesses with no direct route to exploitation.

In this case, the sole medium-level exploitable vulnerability is related to the incorrect processing of sender email address data, an issue that could aid a malicious actor in spoofing emails, amongst other things.

Other medium-severity issues included recipient verification emails being sent to wrong addresses — neither a risk in isolation, but potentially useful in conjunction with another vulnerability.

Curve53 advice included promptly addressing and resolving these findings, undertaking regular tests to identify new risks as they arise, and reporting issues to maintainers when third-party code was involved.

The Memorial Day weekend is here. But, if you're traveling, be sure to stay vigilant about the information you put online along the way.

Connecting to public Wi-Fi at a local cafe or gas station comes with a few security trade-offs. Unsecured networks make it easier for third parties to monitor your online activity or intercept unencrypted data.

Luckily, a virtual private network stops this. A VPN encrypts the data you send online before it can be intercepted and it remains hidden from your ISP.

One of the best VPNs for this is ExpressVPN. Among US VPNs, it's one of only a few to offer servers in all 50 states. It also offers super-secure encryption keys, and other useful tools like a password manager depending on the plan.

What's more, it's cheap. It starts from $2.79 per month right now, almost half what you'd have been paying for it eighteen months ago. This drop puts it among the best cheap VPNs, beating the likes of NordVPN and Proton for value at the time of writing.

Depending on what you use a VPN for most, some alternatives might suit you better.

For example, while ExpressVPN has some of the best security credentials available, NordVPN is a better streaming VPN overall. We tried it with top services like Netflix, Disney+, and Prime Video, and it hardly faltered.

Equally, if you're after robust privacy laws to back up your security, or you're a keen torrenter, Proton VPN is a great solution. It's based in Switzerland and is one of the few top VPNs to offer port forwarding support.

Where ExpressVPN wins compared to both, however, is Aircove. Aircove is ExpressVPN's router, which builds VPN security in directly. While you can set up a router VPN with either Proton or NordVPN, it involves a much more complex process compared to Aircove's plug-and-play capability.

• ExpressVPN has joined other VPN providers in criticizing Canada's Bill C-22
• The bill seeks to impose greater data retention and an encryption backdoor
• Proton, Windscribe, NordVPN, Signal have already slammed the proposal

The privacy industry's backlash against Canada's controversial Bill C-22 continues to grow. Virtual private network giant ExpressVPN has formally criticized the proposed legislation, stating that its no-logs architecture and encryption remain strictly "non-negotiable."

The controversy is a major concern for anyone searching for the best VPN to protect their online identity. Bill C-22, officially known as the Lawful Access Act, would require online services to build technical capabilities facilitating government access to encrypted communications, while also mandating metadata retention for up to a year.

In a statement shared with TechRadar, ExpressVPN said to be "carefully reviewing" Canada's Bill C-22, particularly the provisions on access to user data and the requirement to build technical capabilities supporting government access to encrypted user communications.

For millions who rely on VPN services, the proposal threatens the core mechanisms of online privacy. Under a strict no-logs policy, a VPN provider like ExpressVPN technically promises to never track or store what its users do online. This means that if a government demands user logs, a secure provider simply has nothing to hand over — a fundamental privacy guarantee that Bill C-22 threatens to disrupt.

ExpressVPN's stance follows similar warnings shared by other VPN providers, including NordVPN and Proton VPN. Windscribe and Signal also threatened to leave the market if Bill C-22 were to pass.

The danger of mandated backdoors

Why are VPN companies and secure messaging apps uniting against Ottawa? The core of the issue lies in the bill's technical requirements. ExpressVPN warned that forcing companies to build tools to access secure user data creates a massive security vulnerability that malicious parties could easily abuse.

"Our position on the underlying principles is clear: ExpressVPN’s no-logs architecture and encryption are non-negotiable," the ExpressVPN spokesperson told TechRadar.

That's because, ExpressVPN explains, both encryption and a no-log architecture protect users from a wide range of threats, including bad actors who would exploit any technical capabilities built for one purpose to use them for another.

"Legislation that mandates data retention or technical access, however well-intentioned, undermines the security that millions of users rely on," the ExpressVPN spokesperson added.

By mandating that providers build a way to circumvent encryption, the bill effectively demands digital backdoors.

Security experts argue that there is no such thing as a backdoor that only "good guys" can use. Once an entry point is created, it becomes a high-priority target for cybercriminals and state-sponsored hackers.

A growing privacy exodus

ExpressVPN is not alone in its stance. The provider joins an increasingly vocal resistance that includes some of the industry's biggest names.

Earlier this week, Swiss-based Proton VPN declared that "there is no universe in which Proton VPN compromises its no-logs policy," vowing to fight the legislation by any means.

Meanwhile, Toronto-headquartered Windscribe VPN went as far as threatening to relocate its operations out of Canada entirely. Encrypted messaging giant Signal similarly warned that it would rather exit the Canadian market than compromise user trust.

The friction has even raised cross-border concerns. Lawmakers in the United States have cautioned that the bill could compromise the data privacy of American citizens.

"We are monitoring the legislation closely as it unfolds and engaging with the broader conversation about how Canada balances law enforcement needs with the security and privacy of its citizens," the ExpressVPN spokesperson concluded. "We will be transparent with our users as the situation develops."

TechRadar has contacted ExpressVPN for further comment.

• While modern encryption protects most logins, rogue Wi-Fi networks can still track your browsing or spoof unencrypted sites.
• A VPN routes your traffic through an encrypted tunnel, adding an extra layer of privacy on public connections
• Several VPN providers now offer bundled eSIMs, letting you bypass risky public Wi-Fi altogether

During busy summer travel season, airport departure lounges are packed with people looking for a quick internet connection. Whether you are checking for gate changes, sending a quick work email, or downloading entertainment for the flight, logging onto the free terminal Wi-Fi is an automatic habit for most travelers.

However, open public networks lack the security of your home or office connection, introducing potential privacy risks.

While your banking apps and major websites use encryption to shield your absolute most sensitive information, using unencrypted open networks can still expose your browsing habits, local network traffic, and personal details to third-party tracking.

The hidden dangers of free Wi-Fi

The biggest threat to your data isn't the airport's official network; it is the ones pretending to be. Hackers can set up rogue hotspots, a tactic known as an ‘Evil Twin’ attack.

They broadcast network names like "Airport_Free_WiFi_5G", which look entirely official. However, if you connect to one of these networks, unencrypted traffic could potentially be monitored by whoever is running the hotspot.

On a legitimate airport network, sophisticated Man-in-the-Middle (MITM) attacks can theoretically allow an attacker to intercept data between your device and the router.

Fortunately, because nearly all major websites and financial apps now use HTTPS encryption, passwords and credit card data remain heavily protected even if that data is intercepted.

A more practical concern is the standard airport "captive portal" — the login screen where you accept terms or watch an ad. Many of these pages remain unencrypted, meaning any email address, phone number, or travel details you enter to get online could potentially be visible to others on the open network.

The one tool you need

For those who frequently rely on public networks, a virtual private network (VPN) offers an extra layer of privacy.

When you switch on a VPN, it creates a secure, encrypted tunnel between your device and the internet. This ensures that even if you accidentally connect to a rogue "Evil Twin" hotspot, or if someone is monitoring the local airport network, your browsing activity and data look like scrambled, unreadable code to outside observers.

It is also worth checking if a VPN provider includes a Kill Switch, a highly useful feature when traveling. Because airport Wi-Fi is notoriously unstable, connections frequently drop and reconnect. A Kill Switch automatically pauses your device’s internet access the moment a connection dips, preventing your smartphone or laptop from reverting to an open, unencrypted broadcast before the VPN has time to re-establish its secure tunnel.

The all-in-one solution: VPN and eSIMs

Alternatively, the most straightforward way to avoid public network vulnerabilities is to bypass them entirely using mobile data.

With the rise of digital eSIM cards, travelers can now download local data plans before they even depart.

Several major security firms have recently integrated these services. For example, Nord Security launched a standalone eSIM app called Saily, while ExpressVPN introduced tiers that include limited travel data. Other standalone eSIM options like Airalo or Holafly offer similar ways to bypass public networks.

This means you can switch directly to local 5G or LTE networks the moment the plane lands, ensuring a reliable connection without ever having to engage with an airport portal page.

• ExpressVPN has just updated its Mac, Windows, and Linux apps
• The kill switch can now be toggled instantly for faster use
• It also adds full keyboard navigation and screen reader support

ExpressVPN has just pushed out an update for its Windows, Mac, and Linux apps.

While it isn't the kind of headline-grabbing release we saw earlier this year, ExpressVPN's version 14.1.0 is a tidy round of refinements that should make day-to-day use noticeably smoother. All desktop users gained access to smarter startup, snappier kill switch controls, and better accessibility options.

The same set of changes lands on all three desktop platforms simultaneously, in fact. That's a welcome shift for a provider that has historically rolled out features to Windows first, leaving Mac and Linux VPN users waiting in line.

The release also caps off a busy run for one of TechRadar's best VPN recommendations. ExpressVPN has been steadily expanding its desktop feature set in 2026, with a major macOS overhaul earlier in the year and a beta MCP server that lets AI agents control the desktop app on all three operating systems.

What's new in ExpressVPN version 14.1.0

The headline change is a new minimized startup setting. If you have ExpressVPN set to launch when your computer boots, you can now have it open quietly in the background instead of popping up and stealing focus. It's a small thing, but for anyone who keeps the app running constantly, it's the kind of friction that adds up.

The kill switch — a security feature that ensures your data never leaks even when the VPN connection drops —has also been streamlined. Toggling it on or off no longer requires an extra confirmation step, so you can flip it instantly when your needs change.

Reliability gets a boost, too. The app now reconnects more consistently after your device wakes from sleep, addressing a common annoyance where the VPN could be slow to re-establish a tunnel after a laptop had been closed.

ExpressVPN has also fixed a login loop bug that could trap users signing in with an expired account.

A big step forward for accessibility

The most meaningful changes in 14.1.0 are arguably the accessibility improvements. ExpressVPN has added full keyboard navigation, better screen reader support, spoken VPN status announcements, and clearer focus and selection cues across all three desktop apps.

That's a notable upgrade for a category of software that often falls short on accessibility. Our review of ExpressVPN gave the app top marks for usability but only three out of five for accessibility, so a coordinated push in this area is exactly the kind of investment that should move the needle.

Windows users get one extra tweak: a fix for the system tray icon, which previously didn't always update its VPN status correctly when running in Combined mode.

How to use the new features

Most of the new options live in the app's standard settings. Open ExpressVPN, head into Options (or Settings on Mac and Linux), and you'll find the new minimized startup toggle alongside the existing launch-on-boot controls.

The kill switch is in the same place it has always been, just with one fewer click to activate.

Accessibility features, including keyboard navigation and screen reader compatibility, are enabled by default and work with the standard assistive tools on each operating system.

If you're already running ExpressVPN, the update should arrive automatically. Otherwise, you can grab the latest build directly from ExpressVPN's website.

• ExpressVPN has updated the terms of service for its password manager
• Users who cancel their plan will now lose the ability to add new logins
• ExpressKeys was previously promised to remain fully functional, free to use

UPDATE: ExpressVPN reached out with some responses to our inquiry after publication. We made some small edits to reflect this.

ExpressVPN has quietly made a U-turn regarding the long-term use of its password manager.

When first rolled out ExpressKeys, the VPN provider promised the tool would remain fully functional and free to use even after users canceled their premium VPN subscription. Now, that policy has changed.

According to ExpressVPN's newly updated terms and conditions, non-paying users face strict new restrictions on how they can interact with ExpressKeys after their active VPN plan expires. Crucially, while retaining access to existing passwords, users will now lose the ability to add new ones.

What this means for your passwords

For users who have come to rely on ExpressKeys as their primary digital vault, this policy shift could significantly impact their everyday usefulness.

The updated document explicitly states: "If previously activated, you can continue to access existing ExpressKeys credentials even if you decide to stop using our ExpressVPN Service, but you may not be able to add new information."

If your VPN subscription lapses, you won't be locked out of the accounts you've already saved. You will still be able to access your existing passwords. However, because you may not be able to add new information, the tool could become much harder to use as your primary password manager.

Password managers are essential because they generate and store secure, complex passwords whenever you create a new online account.

So, if you sign up for a new streaming service or are forced to change a compromised password, you may no longer be able to save those new details directly into ExpressKeys.

Furthermore, the terms clarify that if you never activated the newly launched standalone password manager while your VPN plan was active, you will be completely locked out of the feature once your subscription ends.

A quiet policy shift

The exact timing of this terms and conditions update remains unclear. A look back at the company's archived terms reveals that this restrictive language was not present as recently as September.

TechRadar has contacted ExpressVPN to clarify exactly when this change was introduced and what prompted the alteration.

A company spokesperson told us that "these updated terms reflect an approach commonly seen across many subscription-based password managers, where full functionality is tied to an active subscription."

ExpressVPN also clarified that ExpressKeys is a new standalone password manager app — separate from the ExpressVPN Keys feature previously built into the ExpressVPN apps — while stressing the fact that "users do not lose access to credentials they’ve already saved and can export them at any time if they choose."

This adjustment follows other recent changes to the company's overall product offerings. When the provider introduced new subscription plans last year, in fact, it already made its password manager tool exclusive to new, higher-tier users.

When the rollout of the built-in password manager was completed, it was a significant free addition to a premium VPN package. By altering the terms, ExpressVPN may be encouraging users to remain within its active paid ecosystem if they wish to keep full password manager functionality.

It’s a good week for VPN deals. While we expected ExpressVPN’s gaming-inspired price drop to be a short-term offer, the deal is surprisingly still active.

Everything pointed to this deal being a limited-time offer. $2.27 per month is lower than ExpressVPN has ever offered before — making it a rare chance to get the provider's new tools — including ExpressAI and MailGuard — without the usual premium price tag.

While $2.27 per month gets you ExpressVPN's cheapest plan, the best value is probably the Advanced option.

This includes password management, threat protection, an email alias generator and AI, alongside all of ExpressVPN's standard security capabilities for just $2.92 per month. What's more, you get 12 device connections rather than 10, and 4 months extra thrown in.

It's no secret that ExpressVPN has long been considered pricey — that's exactly why this deal shouldn't be missed.

That said, it's worth remembering that ExpressVPN is the Apple of the VPN space. Premium design you know will work, but at a cost. What's more, it sacrifices being the absolute best at everything to ensure it's reliable and enjoyable with everything it does.

Right now, we rate NordVPN as the best VPN overall. Alternatively, if you're focused on speeds, ExpressVPN's Lightway Turbo is great, but Surfshark's WireGuard solution is better.

Either way, ExpressVPN is currently cheaper than NordVPN by a margin and offers stronger security than Surfshark, so it's a great time to buy if you're interested.

• ExpressAI offers cryptographically secure AI chatbot rival to ChatGPT, Gemini and others
• Five models from OpenAI, Nvidia, DeepSeek and Alibaba will ship from launch
• ExpressVPN Pro users get it first (for free), other plans will come soon

ExpressVPN has launched its own AI chatbot in response to growing demand for more secure artificial intelligence without privacy compromises.

Rather than sending unencrypted data to servers for processing, the new ExpressAI offering has added a secure enclave step that means only the associated users can decrypt the data, essentially creating a "cryptographically isolated environment."

"With our enclave architecture, your messages exist in a secure, isolated environment that even we can’t access," COO Shay Peretz outlined.

ExpressAI chatbot launch

Besides offering zero-access encryption whereby only users can access their data, ExpressVPN also promises not to use the content of any chats to train its models.

An additional 'ghost mode' will automatically delete conversations to disappear from your account, but if users want to access previous chats, they can encrypt them behind their chosen password in a dedicated vault.

At launch, ExpressAI will be available with five separate model choices by four companies – two Chinese firms and two US firms.

ExpressAI will pick between OpenAI's GPT OSS 120B for general writing and summarizing, Nvidia's Nemotron 12B for math and technical work, DeepSeek's R1 Distill 32B for reasoning and analysis, Alibaba's Qwen 2.5-VL 32B for image and document understanding, or Qwern 3.5 35B-A3B for coding and other complex tasks.

Users can also run the same prompt across multiple models to compare for the best answer.

ExpressAI is rolling out globally as of today, beginning with ExpressVPN Pro users at no extra cost as a web app.

ExpressVPN noted that Pro users get 500 daily credits, 2GB of storage and access to the five AI models – it's unclear whether lesser plans that follow at a later date will be limited in terms of models.

• 9 out of 10 top VPN providers failed to meet what we consider baseline GDPR expectations
• Article 15 requires firms to share the data they hold on you when asked
• Surfshark was the only provider to perfectly fulfill its GDPR promises

VPNs are used to minimize the amount of data you share with your ISP and to keep your browsing data secure. But that doesn't mean VPN companies hold absolutely no information about you.

In reality, identifiers such as email addresses and payment details are almost always collected and stored to manage your subscription.

This means they are legally "controllers' of our data under legislation like the GDPR in Europe.

This classification isn't optional. Even if a provider is based in a "privacy haven" like Panama or the British Virgin Islands, they must comply with Article 15 of the GDPR if they offer services to users in the EU or UK.

Article 15 is explicit: you have the right to obtain confirmation from the company as to whether your personal data is being processed and, if so, access that data.

We wanted to test how some of the best VPNs on the market behave when asked to fulfill this basic right.

The results were underwhelming. Our investigation found that 9 out of 10 providers fell short of what we consider basic GDPR expectations, with most failing to share the information they held on us at all.

While our testing focused on the GDPR, these obligations are not unique to Europe. The "Right of Access" is a fundamental pillar shared by modern privacy regulations across more than 160 countries, including California’s CCPA/CPRA and Brazil’s LGPD.

It's important to note that a poor response to a data subject access request is not indicative of poor privacy practices more broadly.

We contacted every VPN company featured in this report. You can read the replies below.

Our findings at glance

• 90% of tested VPNs failed to meet our standards of a "thorough and timely" data subject access report.
• 2 providers (NordVPN and TunnelBear) failed to provide any response within the 30-day window without multiple prompts.
• Only 1 out of 10 (Surfshark) provided a professional, readable PDF report within 24 hours.
• 20% of providers sent unusable or unexplained data files (CSVs with generic headers like "field_0").

How did we get there

To see how the industry’s leading VPN services handle their legal obligations, TechRadar contacted 10 major providers on January 5, 2026, requesting all personal data held on our accounts.

We maintained active subscriptions with every provider and followed the specific instructions laid out in their respective privacy policies for data access requests.

We monitored their response rates over an eight-week period, sending multiple follow-up prompts to companies that failed to acknowledge the initial request.

No reply

NordVPN and TunnelBear were the most significant disappointments. Despite having clear instructions in their policies on how users can exercise their GDPR rights, both exceeded the 30-day legal limit and failed to deliver any data by the eight-week mark.

Equally frustrating were the responses from Proton VPN and ExpressVPN — two services that market themselves on a "privacy-first" ethos. Instead of providing the requested data, both issued "canned" responses directing us to read their privacy policies.

This fails to meet the requirements of Article 15 because a company’s obligation to provide a user's specific data is not satisfied by simply pointing to a generic public document.

PrivadoVPN acknowledged it held email and had once held payment data but stopped short of disclosing specific details. Meanwhile, PureVPN replied after 30 days only to ask what specific types of data we were looking for. Under Article 15, providers are required to disclose all data held on a user and it is not the user's responsibility to guess what that might be.

Cryptic and delayed responses

While some providers failed entirely, others attempted to comply but fell short of a professional standard.

IPVanish was a mixed bag. The company uses a specialized portal to make requests easier and provided a CSV dataset. However, the response took over 30 days and revealed the company still held IP addresses from the signup period — a finding that may clash with the 'anonymous' experience many users expect.

CyberGhost's process was flawed from the start. We were required to download a DOCX file to submit our request, which appeared to be an outdated Scottish government template. The company then demanded sensitive information, such as a physical address and phone number, which they didn't even have on file. After eight weeks and multiple chases, the final response only listed the types of data held, rather than the data itself.

Hotspot Shield eventually provided data in the form of seven CSV files, but the files contained no headers. This left dozens of data points labeled cryptically as "field_0" through "field_32," making the information functionally useless. While the company offered to clarify the data later, this does not fulfill the GDPR requirement to provide data in a concise, transparent, and intelligible format.

The winner: Surfshark

Surfshark was the only provider in our test that treated the request as a serious legal obligation. It took the provider only four hours to deliver a detailed PDF report of all the information held on our account.

The report included a full record of payments (including dates, currency, and IDs), account email addresses, active subscriptions, and even a log of malware blocked by Surfshark’s built-in antivirus tool.

While the level of detail is a win for transparency and GDPR compliance, it does raise secondary questions about whether a privacy-focused company should be logging some of these data points in the first place.

You can read our full analysis of Surfshark's response here.

VPN providers' responses

We contacted every VPN company included in this report for comment prior to publication. Most didn't respond. However, several challenged our findings.

NordVPN initially said that our decision not to verify our identity when requesting information was responsible for the delay.

However, following an internal investigation, the company said our emails had been inadvertently quarantined by their email system so the company effectively never received them. A spokesperson clarified this issue only affects a handful of emails and that it has now been resolved.

IPVanish said that the delay was caused due to waiting for identitiy verification. The company also emphasized it's no-log policy and said: "when a customer subscribes to our service, their sign-up IP address may be collected in connection with payment processing and preventing fraud."

Proton VPN said that there was a misunderstanding as to whether our initial request formally constituted a DSAR, though admitted "the response could have been more specific."

A spokesperson for the company said that personal data — such as security logs, payment details, subscriptions and emails — can all be found via "dedicated tools" online.

Privado VPN said: "We are always happy to provide data subjects with a copy of their personal data upon request, and we consider this obligation to have been met in this case."

While they did respond promptly, their response provided generic information about the categories of data held, rather than specific data points. According to the company, this is a result of the minimal data held, rather than intentionally withholding disclosure.

However, its response was missing many of the supplementary information points we would expect to see, such as the right to make a complaint, whether or not automated decision-making is being used, and how long the data is stored for.

Surfshark's responses have been included in the accompanying article that highlights the data the company holds on users.

• Surfshark now offers up to $1 million in ID theft coverage for new US users
• It covers legal costs, document replacement, lost wages, and more
• The rollout follows similar moves by rival providers ExpressVPN, NordVPN

Popular VPN provider Surfshark has just unveiled a brand-new identity theft coverage feature for its top-tier online security bundle, offering victims up to $1 million in financial reimbursement.

While Surfshark has long been a major contender for the title of best VPN, the new insurance offering shifts the provider from purely proactive protection to reactive recovery.

The release couldn't come at a more crucial time. With billions of personal records floating around the dark web and an average of 33.8 accounts compromised every single second worldwide, as per Surfshark data, digital hygiene is no longer just about hiding your IP address.

"As fraud, scams, and data leaks will never stop, the risk of compromised personal accounts remains high. This danger keeps growing as threats become more advanced and harder to identify," explained Gabriele Sinkeviciute, Head of Product at Surfshark, in a blog post.

ID theft protection, however, is currently restricted to new Surfshark One+ customers residing in the United States, with residents of New York State entirely excluded.

What does the coverage include?

According to Surfshark, a standard antivirus or basic encryption is great for prevention, but it doesn't solve the devastating financial and emotional toll of a hijacked identity.

"Cybersecurity incidents related to identity theft can lead to serious financial consequences, causing victims to have challenging and sometimes persistent issues in restoring their identity," Sinkeviciute stated.

That's exactly why the company decided to enhance its top-tier security bundle. An ID theft coverage, Sinkeviciute explains, allows the team to help users prevent, protect against, and recover from the damages of identity theft with no extra cost.

The $1 million coverage limit provides victims with a licensed identity theft investigator who will do the heavy lifting to correct credit histories and restore compromised records. Because Surfshark itself is not an insurance producer, the policy benefits are issued and covered by HSB Specialty Insurance Company.

Under the policy, users can claim reimbursement for credit bureau reports, legal costs, document replacement fees, and up to $5,000 in lost wages (including elder and child care). The coverage even extends to mental health counseling, offering up to $1,000 to help victims cope with the stress of the ordeal.

The race for all-in-one security

Surfshark’s decision to add identity insurance completes what the company calls its "online protection cycle," joining existing data-protection tools like Alternative ID and the data-broker removal service Incogni.

"Relying on a single online security measure is no longer enough," states Sinkeviciute.

Surfshark is not the only provider pushing beyond standard virtual private networks. Over the last year, the industry has aggressively pivoted toward comprehensive cybersecurity suites.

Rival provider NordVPN previously launched its own ID theft protection tool for US users, before expanding a similar identity theft recovery service to its UK customer base. Likewise, ExpressVPN launched a suite of identity theft protections, offering up to $1M in ID theft insurance for free on certain plans.

As cybercriminals leverage AI to automate phishing and fraud, it is becoming increasingly clear that consumer protection must evolve. While a VPN secures your connection, having a $1 million safety net ensures that if the worst does happen, you won't be left paying the price alone.

• ExpressVPN uncovered massive amounts of AI chatbot leaked data
• The databases were not encrypted
• ExpressVPN urges users to be vigilant

If you heard that up to 3.7 million pieces of private user data had been made public, you might well assume it was the report of a major hack. However, a recent investigation published by ExpressVPN proves just how easy it is to lose your privacy when basic security measures such as password protection and encryption aren’t in place.

Conducted by cybersecurity researcher Jeremiah Fowler, the report uncovered a case in which massive amounts of customer data were leaked from AI-powered chatbots used by retailers for customer service.

If you're on this page, chances are that the best VPNs are already protecting your digital privacy while you browse or stream content online, thanks to their top-notch encryption features.

But when a retailer or third-party service hasn’t taken adequate measures to protect your data, even the most tech-savvy users may not realize the enormous risks that they are subject to if leaked information falls into the wrong hands.

The findings

Fowler discovered three separate publicly accessible databases that were neither password-protected nor encrypted and contained 3.7 million records, including personal data such as email and home addresses, and phone numbers.

To give an example of the vastness of the data exposed, even an initial sampling included 1,422,577 audio recordings of customers. In terms of data, even at a glance, this included text transcripts totalling 3.9TB, 207,381 Excel files, and audio recordings totaling 415.2GB.

The limited sample contained transcripts and audio files belonging to Sears Home Services, a US retail and repair business that has embraced AI chatbots in English and Spanish for the purposes of automating their scheduling, phone calls, and online chats.

The files contained 54,359 complete transcripts of the conversations customers had with AI chatbots and their corresponding audio recordings.

Fowler pointed out that the system also continued to record audio files if the customer had not hung up properly, meaning that the audio files contained up to four hours of background conversation and vast amounts of biometric voice data.

The expert provided an overview of the data presented, sharing screenshots of filesystem structures and the types of files they contained. These illustrated how the data could be accessed, including how audio files could be played in any web browser and the convenient user interfaces provided for interacting with the filesystem.

How to stay safe

While Fowler stated that public access to the data was immediately restricted after he sent a responsible disclosure notification to Sears Home Services' parent company, Transformco, he remained concerned.

The investigation highlighted that with AI-driven automation being capable of storing massive amounts of highly sensitive data, there is a significant risk that some companies will act irresponsibly and leave user data exposed — a bleak scenario when estimates say that deepfake‑enabled fraud losses are forecast to reach US $40 billion by 2027.

This vast amount of data could enable hackers to link identities or replicate users’ digital profiles for criminal purposes; in such cases, virtual private network (VPN) tools prove useless if the weak link is the very company to which you have voluntarily entrusted your data via chatbots or other apps.

ExpressVPN urges users to remain vigilant and offers practical advice, including using strong passwords and taking extra precautions in sensitive situations.

Also, be cautious when receiving unsolicited emails, text messages, or phone calls that reference information you may have previously shared with a company or service.

And with the rise in voice cloning scams, agree on a password with family and friends to use in the unlikely event that you receive a call from them asking for money or help.

St Patrick's Day is synonymous with a pint of Guinness, but this year, real luck is found in the VPN market. While the holiday brings a spike in unsecured public Wi-Fi use and themed phishing scams, it also marks a rare opportunity to secure your digital life for a record-low price.

A quality Virtual Private Network (VPN) is your best defense, encrypting your traffic and bundling essential security tools like password managers and data breach alerts

ExpressVPN is one of the best VPNs available. It's the most secure VPN I've tested, simple enough for beginners, and — after some new additions — offers plenty of tools you need to stay safe online.

What's more, it starts from only $2.27 per month. That's its lowest-ever price and a third of the price you could pay for a pint of Guinness in Dublin on a day like St Patrick's Day.

Personally, I'd recommend an Advanced plan. It's still cheaper than deals from NordVPN, the best VPN overall, and offers a similar number of features to the likes of Proton and Surfshark.

The Advanced plan ensures you can access all of ExpressVPN's newest features — MailGuard, Identity Defender, Keys, and AI. That said, it's what ExpressVPN has behind the scenes that impresses me most.

Its Lightway Turbo protocol means ExpressVPN ranks among the fastest VPNs. Plus, its apps are among the best to look at and simplest to use. I also love that it automatically obfuscates your connection if you're in regions with restrictions. Plus, we believe Shadowsocks support may be on the way to improve this further.

That said, for a marginally improved all-around VPN experience, I'd still recommend NordVPN. Or, if you want superb VPN speeds and the tools to disconnect from Google, Proton may be a better alternative.

ExpressVPN has just announced its lowest-ever prices, for the second time in 2026. The drop means prices now start at $2.27 per month, a significant reduction considering monthly prices previously exceeded $5.

While it's not the best VPN overall right now, it's seen significant improvements recently.

It has increased speeds with Lightway Turbo, added features such as ExpressAI and ExpressMailGuard, and added support for Meta Quest. That said, its biggest issue has long been its price.

Unfortunately, the new pricing isn't permanent —it's part of ExpressVPN's recent renewal of its gaming partnerships with the likes of G2 and Method.

That said, it's perfect timing if you're about to travel for spring break or St Patrick's Day. There's no VPN with more locations that's cheaper right now, including NordVPN and Proton. What's more, you get 4 months extra thrown in with two-year plans.

An Advanced plan is the choice I'd recommend. It's cheaper than both NordVPN and Proton per month, offers more months of protection, gives you more simultaneous connections, and access to all of ExpressVPN's new features.

This ExpressVPN deal is superb if your primary focus is security for a low price, but that doesn't mean it's the only VPN you should consider.

Surfshark offers faster speeds over WireGuard and more features, but uses fractionally less secure encryption. That said, it starts from only $1.99 per month.

NordVPN is the best VPN overall. It's super quick, equally secure, and has some great features. However, it is more expensive at $3.39 per month.

Proton VPN sits somewhere in the middle. It's super secure, quicker than NordVPN but slower than Surfshark, and offers a good number of features for $2.99 per month.

For a full breakdown, check out our best VPN guide. But, if you're particularly interested in ExpressVPN, there's never been a better time to pick up a plan.

• ExpressVPN renewed its League of Legends EMEA Championship (LEC) deal
• The VPN also signed new partnerships with VCT, G2 Esports, and Method
• Fans can expect rare in-game loot, merch giveaways, a dedicated social hub

ExpressVPN is stepping directly into the heart of competitive esports, announcing a sweeping roster of partnerships with some of the biggest names in the gaming industry.

The privacy provider has officially renewed its partnership with Riot Games' League of Legends EMEA Championship (LEC). It is also significantly expanding its esports footprint with brand new, exclusive partnerships with the VALORANT Champions Tour (VCT) EMEA and VCT Americas, G2 Esports, and Method.

The move is a clear signal that the company wants to be recognized as the best VPN for gamers, positioning itself at the center of the world's most influential competitive broadcasts and team competitions.

For the average player, these partnerships mean more than just branding on a stream. ExpressVPN has promised that fans can expect ongoing incentives rolling out throughout the year, including promotions for rare in-game rewards and exclusive drops.

To anchor this new community push, the provider is also launching a dedicated gaming social hub at @ExpressVPN_Gaming — now live on Instagram and soon on other platforms — to create a space for exclusive content, merch giveaways, and conversations with creators.

Why use a VPN for gaming?

While privacy tools are traditionally associated with unblocking streaming libraries or securing public Wi-Fi, they are increasingly vital for competitive play.

A premium gaming VPN can help protect you from targeted DDoS attacks, bypass unfair IP bans, and prevent your internet service provider (ISP) from throttling your connection during heavy bandwidth use. In some cases, a VPN can even lower your ping by finding a more direct route to the gaming server, while also unlocking the ability to play with friends in different regions.

In our most recent ExpressVPN review, we praised the provider's technical infrastructure, which is uniquely suited to handle the demands of modern online gaming.

ExpressVPN boasts a 10 Gbps global server network spanning 105 countries, ensuring reliable connections even when networks are under heavy load.

Furthermore, ExpressVPN’s proprietary Lightway protocol, which features built-in post-quantum protection, is designed to support lightning-fast, low-latency performance. Players can also utilize the Smart Location feature, which automatically connects them to the optimal server to keep gameplay smooth and responsive.

"A natural fit"

For professional esports organizations, where milliseconds dictate victory or defeat, digital security and connection stability are non-negotiable.

"ExpressVPN is a natural fit for us," said Sabrina Ratih, COO at G2 Esports. "Our players compete on milliseconds, and our fans live online, so this partnership is about empowering both with a safer, faster, and more secure digital experience."

Zac Eller, GM of Global Partnerships & Business Development at ExpressVPN, echoed this sentiment, noting that the provider’s overarching goal is to make the VPN "a natural part of how people play."

“The organisations we’re partnering with work with the best players and biggest communities in gaming, and they chose ExpressVPN because we care about the same things gamers care about — staying connected, staying stable, and keeping the game smooth,” Eller said.

The sentiment extends to the tournament organizers themselves. Charlie Allen, EMEA Director of Commercial Partnerships & Business Development at Riot Games, noted that the expansion into VCT EMEA and VCT Americas builds upon a shared mindset between the brands.

"We’re looking forward to delivering meaningful activations and exclusive rewards that truly resonate with our EMEA esports communities," Allen added.

• Samples of passwords from 2015 and 2025 have been compared
• Password security is improving, but they're still being reused
• People struggle to remember unique passwords

Despite the rise of many tools to make securing credentials easier, not enough has changed in password habits over the past 10 years.

Cybersecurity researcher Jeremiah Fowler has compared password trends from 2015 to a monumental leak of passwords in 2025 to understand what habits - if any - have changed.

The findings show that 2025’s recommended practices for a secure password are incompatible with human memory.

Password trends

The samples analyzed by Fowler show that over the past 10 years, only 15% of passwords could be classified as genuinely complex passwords - being at least 12 characters in length made up of uppercase and lowercase letters, numbers, and symbols with no structure or patterns.

The other 85% of passwords are considered easy or predictable. These are passwords that contain names, memorable phrases, or common structures (“password,” “admin,” or “qwerty”) with numbers and special characters attached. The problem with using memorable phrases and structures in passwords is that it makes them more vulnerable to brute force attacks.

The good news is that passwords containing keyboard walks, waterfalls, and spatial pattern passwords (such as “qwertyuiop”) have fallen between 15%-20% since 2015. Similarly, keywords such as “admin” and “password” have also fallen by the same percentage.

The number of passwords that appear to have been created by a password generator has also increased by around 10%-12%. There still remains one critical weakness for all passwords however.

Fowler cites a 2024 study that found the average person has around 168 passwords across all of their online accounts. Remembering a strong, unique password for each of these accounts simply isn’t feasible for the average person, and so people erase the potential security a strong password could have by reusing it across their accounts.

“We often take a lazy approach to passwords at our own risk choosing convenience over security,” Fowler explained.

“Even forced password complexity rules are not a silver bullet solution if they are reused on multiple accounts, exposed in a data breach, or compromised by malware. It is a fact that criminals are becoming more sophisticated, the use of AI in cyber-crime is growing, and we must do more to protect our credentials.”

The best way to secure all of your online accounts is to use a password manager - there are many paid services to choose from, with many brands also offering free password manager plans to help keep your accounts secure.

Using an authenticator app can also enhance your account security by requiring a second method of verification through a separate device or biometric identifier.

Last week, our investigation revealed that over three-quarters of Android VPNs fail basic transparency tests. The research casts serious doubt on which apps you can actually trust.

This week, I spoke with leading VPN providers about how you can stay safe online and what the industry is doing to clean up its reputation.

Aaron Engel, Chief Information Security Officer at ExpressVPN, says “the industry must continue to raise the bar on transparency.” But with the bar for Android VPNs set concerningly low, what does this actually look like in practice?

The importance of transparency

Engel said “transparency should be a key factor when choosing a VPN” and highlighted the importance of audits, accessible privacy policies and clear company ownership. Combined, these provide “important indicators of whether a provider is committed to protecting user privacy,” Engel argued.

"Transparency should be backed by verifiable action.”

ExpressVPN has done this with third-party audits — 23 of them to be precise — alongside significant investment into its security capabilities.

Most notably, its TrustedServer technology uses RAM-only server infrastructure to ensure the entire operating system and VPN are reinstalled at every reboot, ensuring no data is ever written to physical drives.

Like ExpressVPN, Surfshark prioritizes clarity. Justas Pukys, VPN Product Manager at Surfshark, says this commitment includes everything from 24/7 customer support to "clear, accessible" online resources.

What else can providers do?

“A VPN is entrusted with a user's most sensitive data, and as this investigation reveals, a significant portion of the market is not equipped to handle that responsibility” explains Marijus Briedis, CTO of NordVPN.

So, what more can the industry do? Pukys, of Surfshark, believes that "VPN providers need to demonstrate trust in other ways”

For Surfshark, this has involved everything from regular independent audits — though fewer than ExpressVPN’s 23 — to transparency reports and frequent app updates to meet evolving platform requirements.

Surfshark also regularly publishes research on topics such as digital privacy, online wellbeing, and global data breaches. While research isn't a direct technical "trust indicator," it’s likely that a provider investing heavily in studying the real-world impact of privacy is genuinely committed to defending it.

Independent audits are a key indicator of a trustworthy VPN. Typically made publicly available, these reports outline any concerns or vulnerabilities discovered by the third-party auditor.

However, since these reports can be dense with technical jargon, transparency reports and no-logs policies serve as more accessible starting points. Both use clearer language to demonstrate how your data is handled.

If you’re keen to dive into an independent audit yourself, two sections deserve your focus. First, look for the executive summary or introduction. This usually provides a snapshot of the findings, including the number of issues identified.

Naturally, the fewer issues the better and ideally, the report will find no ‘critical vulnerabilities.’ Second, be sure to check the "Scope" section. This defines the boundaries of the audit — if the scope is too narrow, significant vulnerabilities may have been overlooked.

Another strong indicator of a provider’s intent is membership in the VPN Trust Initiative (VTI). The VTI includes major players like NordVPN, Surfshark, ExpressVPN, and IPVanish, and focuses on “advancing online privacy, security, and freedom through clear standards and trusted practices.”

Membership suggests that these providers are committed to a shared set of industry principles, implementing these privacy standards directly into their software and infrastructure.

That is not to say that VPNs outside the VTI are untrustworthy. Reputable providers like Proton VPN, Mullvad, and Windscribe have yet to join, but they consistently demonstrate the same rigorous, privacy-first practices that the VTI advocates for.

What should VPN users look out for?

However, as our recent investigation into the Google Play Store revealed, these high standards are the exception rather than the rule.

Responding to the findings, Pukys says “the Android ecosystem is generally more open" than others. While this makes it easy for new developers to access a major downloads platform, it also means closer attention should be paid to “how VPN providers communicate their data practices and privacy commitments.”

When considering Android VPNs, David Peterson, GM of Proton VPN, explains, you should:

1. “Check the data safety section on their store listing” to ensure you’re comfortable with the information being collected and shared with third parties
2. “Visit the brand’s official website and read through their privacy policy.”
3. “Download their VPN only from the links they prominently provide”, commonly found on the provider’s website or via official app store links.

For Briedis, there is a broader scope of sensible steps to consider:

"Invest time in researching their provider. Look for clear, accessible privacy policies, professional websites, and dedicated customer support channels.”

Our research has also shown how unresponsive customer support can be when using an untrustworthy Android VPN. Knowing you can get help is crucial. if you’re unsure, try contacting a provider's support team with a question before signing up. A prompt response is a good sign.

As Briedis noted: “Choosing a VPN is a significant decision for one's digital security, and it's essential to select a service that proves its commitment to user privacy and transparency.”

So, do your research. Don’t fall for the first VPN you see, and make sure to check anything if you’re unsure.

• ExpressVPN launches industry's first Model Context Protocol (MCP) server
• The beta allows AI agents to interact directly with its VPN desktop apps
• The feature is opt-in, runs locally, and operates under a strict no-log policy

ExpressVPN has announced the beta launch of its Model Context Protocol (MCP) server, becoming the first major provider to allow AI tools to interact directly with its desktop applications.

Announced today (March 5), this addition bridges the gap between the best VPN services and the booming world of AI agents. By adopting the open standard introduced by Anthropic in late 2024, ExpressVPN is effectively giving developers the ability to control their network security using natural language or automated scripts within their coding environments.

Previously, if a developer using an AI assistant needed to test a geo-specific API or verify a secure connection, they had to leave their workflow to manually toggle settings in the VPN app. Now, compatible AI tools like Anthropic's Claude Code and OpenAI's Codex can read the VPN's status, switch regions, and troubleshoot connectivity issues on behalf of the user.

Bringing AI to network security

The Model Context Protocol (MCP) is an open standard designed to connect AI systems with external data and tools. While many developer platforms have adopted it since its introduction, network infrastructure has largely remained a manual affair — until now.

ExpressVPN’s implementation creates a "strictly local bridge" between the AI tool and the ExpressVPN desktop app on macOS, Windows, or Linux. This means developers can issue commands in plain English, such as "switch to a US server" or "check if my connection is secure", and the AI agent executes them via the MCP server.

Shay Peretz, COO of ExpressVPN, says the move is about removing friction for technical users who live in their terminals.

"Developers are increasingly relying on AI agents to automate complex tasks, yet their network environment has remained manual," Peretz said. "Our MCP server brings VPN control into those workflows, enabling secure testing, troubleshooting, and region switching without interrupting their workflow."

Peretz added that the company sees MCP becoming a "foundational standard for how AI systems interact with external tools."

Private by design

Allowing an AI to control network settings might raise eyebrows regarding security, but ExpressVPN emphasizes that the feature is "private and secure by design."

Crucially, the integration is disabled by default; users must actively opt in via the desktop app settings. Furthermore, the MCP server operates on a fixed command allowlist. It cannot access account credentials or session information, ensuring that the AI agent doesn't get free rein over sensitive user data.

The company also confirmed that the new feature operates under its strict no-logs policy. "Activity logs, connection logs, and destination data are not collected or stored," said ExpressVPN.

Who is this for?

While the average user might not need their AI chatbot to swap VPN servers just yet, this is a significant quality-of-life upgrade for software engineers and QA testers.

The beta version enables developers to automate tasks such as verifying secure connections before running scripts, testing geo-sensitive APIs across multiple regions, and diagnosing network issues through AI-assisted workflows. It essentially removes the need to context-switch between a code editor and the VPN client.

The MCP server beta is available starting today, March 5, 2026, for individual users and ExpressVPN for Teams customers on all major desktop platforms. You can find more details on the ExpressVPN features page or their support guide.

• ExpressVPN develops a CSAM blocking tool in partnership with IWF
• OpenBoundary blocks known CSAM domains at the DNS level
• The tool is open-source so other services can integrate it

As regulators worldwide scramble for solutions to boost online child safety, VPN services are frequently targeted due to their alleged role in facilitating anonymous access to illegal content.

ExpressVPN is now taking a proactive stance against one of the internet's most heinous crimes by building a dedicated tool that halts access to child sexual abuse material (CSAM).

The provider partnered with the Internet Watch Foundation (IWF) to develop OpenBoundary, a server-level toolkit designed to help network operators restrict access to verified CSAM domains safely and transparently.

ExpressVPN maintains that OpenBoundary is built on a privacy-first infrastructure, introducing network-wide safeguards without altering or infringing upon its strict no-logs policy.

Dr. Peter Membrey, Chief Research Officer at ExpressVPN, told TechRadar that the move is a "safe first step to open the conversation" between technologists, child safety groups, and regulators.

He added: "We believe there is no good reason for this material to exist or to traverse our networks — but, it doesn't have to be all or nothing." He believes OpenBoundary provides regulators with "sharper tools" that do not weaken encryption or user privacy in the name of safety.

As part of the "Not on My Network" initiative, ExpressVPN is open-sourcing the code for OpenBoundary. The goal is for other VPN services, internet service providers (ISPs), and cloud platforms to adopt the framework.

Fellow Kape Technologies brands CyberGhost and Private Internet Access (PIA) are the first to join the mission. Kerry Smith, CEO at the IWF, applauded the innovative approach, saying the move "balances its commitment to online child safety and online privacy."

How OpenBoundary works

The technical implementation of OpenBoundary is straightforward. The tool operates at the DNS level, blocking domains that appear on the human-verified IWF list.

This happens automatically when a user connects to the VPN app, preventing known CSAM domains from loading. Membrey explains that if a user attempts to visit a flagged site, the system simply returns an error stating the site does not exist.

Crucially, this process involves no traffic inspection, monitoring, or breaking of encryption. Instead, it is a straightforward domain block.

While some advocates argue that any content filtering contradicts the "neutral" nature of a VPN, Membrey says he is "comfortable blocking" sites exclusively hosting CSAM material.

"We don't want this stuff going through our network. We don't want to be part of this," he told Techradar.

Bridging the gap between safety and privacy

Until now, the battle against CSAM content has largely focused on the detection of illegal materials.

In the EU, the proposed law nicknamed Chat Control, which is now in its final legislative step, has attracted strong resistance from politicians, scientists, and technologists alike. Now, the UK is also fast-tracking CSAM scanning obligations under the Online Safety Act.

In both cases, critics have pointed out how today's detection technlogies — whether that's client-side scanning or hash matching — are technically ineffective, while inevitably hurting the privacy and security of all online services that are supposed to implement these checks.

ExpressVPN's new tool certainly doesn't come as a technical solution to CSAM scanning and detection, but it's rather a way to recalibrate the discussion towards what we can do now. A first step to mitigate the issue and bridge the gap between privacy, security, and children's safety on the internet.

Commenting on this point, Membrey told TechRadar: "Our pitch is simple: 'Not on my network.' We urge lawmakers to collaborate and innovate before legislating and regulating. It is much easier to undo a failed technological solution than to undo a blanket law passed by a parliament or congress."

The T20 Cricket World Cup is coming to an end. Sunday 8th marks the final day, with semi-finals taking place later this week. But if you're traveling, getting access to a good stream isn't always simple.

Luckily, this is where a VPN can help. A VPN encrypts your online traffic and allows you to connect to secure servers in your own country. This means that if you have a streaming subscription you'd normally use for cricket, you can access it hassle-free, wherever you are.

Right now, one of the best VPNs for this is ExpressVPN. It just re-launched all-time low pricing, meaning two-year plans start from only $2.44 per month (paid as $68.40 upfront). If you're only keen on using it for the cricket, you can pick up a 1-month plan for only $12.99.

ExpressVPN is super-simple to use and can be set up in a matter of clicks. Most importantly, its apps for mobile phones and tablets are among the least complicated available. So even if you're new to VPNs, you won't be confused.

If you're considering the one-month option, a couple of VPNs offer cheaper 1-month plans. Proton VPN is only $9.99, while Windscribe is only $9.

From a performance perspective, ExpressVPN is among the fastest VPNs and most secure VPNs, too. NordVPN, Surfshark, and Proton VPN offer better all-around VPN experiences but ExpressVPN's apps are super sleek and easy to navigate across devices.

In my experience, ExpressVPN is a more than capable streaming VPN. I've had slightly smoother experiences with NordVPN in the past, but, given that a 1-month ExpressVPN plan is the cheaper of the two, it's my recommendation if you're looking for an easy solution to accessing your streaming solutions while on the move.

• JioStar has filed a criminal complaint against ExpressVPN in India
• The complaint argues the VPN actively markets the ability to bypass blocks
• JioStar alleges ExpressVPN is an "inducer" of copyright infringement

India's largest streaming and entertainment company, JioStar, has reportedly filed a criminal complaint against ExpressVPN, marking a significant escalation in the battle between rights holders and privacy tools in India.

According to a report by Storyboard18, the complaint was lodged at the Noida Cyber Crime Police Station. It alleges that ExpressVPN has engaged in marketing practices that effectively abet copyright infringement by encouraging users to bypass geo-restrictions.

The complaint reportedly targets the specific language used in ExpressVPN’s advertising. While VPNs are often defended as privacy-preserving utilities, JioStar contends that ExpressVPN's promotion of "unblocking" capabilities crosses a legal line.

"This is not a case of a neutral tool being misused," the complaint argues, alleging that the provider has assumed the role of a "knowing facilitator and inducer" of geo-restriction bypass.

JioStar, which holds exclusive digital and broadcast rights to premium sporting events like the IPL, argues that by explicitly marketing the ability to virtually change locations to access content "for free" or from unauthorized regions, the VPN provider is complicit in the resulting piracy.

TechRadar has contacted ExpressVPN for comment on the allegations and will update this story when we receive a response.

The "Neutral Tool" Defense Under Fire

The distinction between a "neutral tool" and a "facilitator" is central to modern copyright law. Typically, technology providers argue that they cannot be held liable for how customers use their software, much like a VCR manufacturer isn't liable for a user pirating a movie.

However, JioStar’s complaint appears to challenge this defense by focusing on inducement. By allegedly advertising features specifically designed to defeat the geo-blocking measures employed by streaming services, the complaint suggests ExpressVPN is stripping itself of the "neutral intermediary" status.

This development is particularly notable in India, a market that has become increasingly hostile to VPN providers. In 2022, the Indian government’s CERT-In directives forced many providers, including ExpressVPN, to remove physical servers from the country to avoid mandatory data logging.

Now, providers face legal challenges not just over data retention, but over their core value proposition to streaming audiences.

A Global Crackdown on 'Unblocking'

This case in India is not an isolated incident; it represents a growing global trend where rights holders are moving beyond targeting "rogue" pirate sites and are instead targeting the infrastructure that enables access to them.

In Europe, the pressure is mounting. The MPA presses for VPNs to have a role in the anti-piracy row in Europe, arguing that services must do more to verify that their users aren't engaging in copyright theft.

Similarly, sports leagues are taking aggressive action. La Liga has just won a court order requiring NordVPN and Proton VPN to block illegal football streams in Spain — a move that VPN companies criticized for being technically unfeasible and a privacy overreach.

Furthermore, a French court has already issued three blocking orders against popular VPN services, ExpressVPN included. Another signal that courts are increasingly willing to place the burden of policing content on the VPN providers themselves.

JioStar's criminal complaint suggests that India is now joining this global front, using criminal law rather than just civil injunctions to pressure VPN services into compliance. If successful, this could force a major change in how VPN providers, which frequently top our lists of the best VPN services, market their abilities to unblock global content.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone using a VPN service to break the law or conduct illegal activities. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

• Dedicated ExpressVPN app now available on the Meta Quest store
• The hybrid VPN extension includes browser-only and full-device protection
• Smart Routing allows site-specific VPN locations in the same window

ExpressVPN has announced a major expansion of its service, launching a dedicated app for Meta Quest VR headsets and a new "hybrid" browser extension that aims to solve a long-standing frustration for privacy-conscious users.

The move sees the provider — which TechRadar's reviewers rank as one of the best VPN apps right now — pushing into the mixed-reality space while simultaneously overhauling how we protect our web traffic on desktop.

While the arrival of a native Meta Quest app is significant for gamers and VR enthusiasts, the new VPN browser extension is arguably the bigger technical leap. By combining a lightweight proxy and a full-device remote control into a single interface, ExpressVPN claims to have created an "industry-first" solution that adapts to how you actually browse.

The 'Hybrid' Advantage

Until now, VPN browser extensions have typically fallen into one of two camps: they are either simple proxies that only spoof your IP address within the browser (leaving other apps exposed) or they are merely remote controls that switch your desktop VPN app on and off.

ExpressVPN’s new offering bridges this gap. It functions as a standalone proxy when you need speed and lightweight protection for browsing, but can instantly toggle to control the full desktop application when you need device-wide encryption.

"Most VPNs make you choose: either a simple browser proxy or a full-device app. Our new hybrid browser extension does both in a single tool," said Shay Peretz, Group Chief Operating Officer at ExpressVPN, in the official announcement.

Now, Peretz explains, users can decide whether protect just their browser activities when they want something lightweight, or switch to full-device coverage. "We're excited to launch this first-of-its-kind extension in the industry," he added.

Flexibility isthe key here. A 'Smart Routing' function also lets users assign different VPN locations to specific websites. For example, you could browse a local news site with your real IP (using split tunneling rules) or a specific proxy location, while streaming content from a different region in another tab, all without constantly toggling settings.

Crucially, the extension retains critical privacy safety nets, including WebRTC leak blocking and HTML5 geolocation spoofing. This ensures that your physical location isn't inadvertently exposed by browser vulnerabilities, a common issue with lesser proxy tools.

Privacy in the Metaverse

Alongside the browser news, the partnership with Meta Quest brings full-device VPN protection directly to the headset via the Meta App Store.

VR devices are increasingly treated as general-purpose computers, used for everything from social networking to productivity. A native app ensures that all traffic entering and leaving the headset is encrypted, rather than just the web browser. This is particularly vital for preventing ISP throttling during high-bandwidth VR streaming or gaming.

However, ExpressVPN confirmed that the new hybrid extension functionality will also be coming to the Meta Quest browser soon. This will offer a "browser-only" mode for the headset, giving users a lighter option if they don't want to run the full background process during intensive gaming sessions where every frame counts.

The provider also noted that the new extension supports its proprietary Lightway protocol, which now includes post-quantum protections, future-proofing user data against next-generation decryption threats.

The hybrid extension is available now for Chrome and Firefox, with the Meta Quest integration following shortly. For a deeper dive into the provider's performance and features, check out our full ExpressVPN review.

ExpressVPN's Valentine's Day sale ends today. This means you've only got a few hours left to get ExpressVPN's lowest-ever prices.

The biggest savings are available on two-year plans. These start from just $2.44 per month, paid as $68.40 upfront. Alternatively, for a shorter commitment, one-year plans start from $3.49 per month, paid as $52.39 upfront.

Whatever you choose, make sure you turn off auto-renewal to avoid being stung by price increases at the end of your term.

ExpressVPN's price was long its biggest drawback. Now, tiered pricing, new products, and Valentine's Day savings mean it's only held back by some minor performance niggles compared to the very best VPNs.

Plus, it's cheaper than the likes of NordVPN or Proton for the moment, and a great choice if you're after a secure way to watch tomorrow's Champions League action in Europe.

ExpressVPN remains one of only 3 VPNs ever to top our rankings. Despite falling to fourth spot more recently, it's seen some huge performance improvements – particularly on its Lightway Turbo protocol – which means it's among the fastest and most secure VPNs available.

The best ways to save on ExpressVPN

The biggest savings and lowest price are available with a Basic plan. This is currently only $2.44 per month, down from $3.49, and includes four extra months on two-year plans.

This budget plan is more affordable than the alternatives offered by NordVPN, Proton VPN, and Norton VPN at the moment. However, for a super budget alternative, Surfshark's $1.99 per month Starter plan is hard to beat.

If, however, you want the full spread of new ExpressVPN features – namely ExpressAI, ExpressKeys, ExpressMailGuard, and Identity Defender – then you'll want an Advanced plan.

These cost $88 upfront for 28 months of protection, equivalent to $3.14 per month, and give you everything ExpressVPN has to offer for only a fraction more than the basic plans from Proton and NordVPN.

You also get the benefit of 12 simultaneous connections rather than 10. Plus, if you're unsure, both plans offer a 30-day money-back guarantee.

• ExpressVPN earned four ISO certifications to boost users' trust
• It also published the Transparency Report for the second half of 2025
• The report shows zero data disclosed despite over 1.38 million requests

When looking for the best VPN, users are often asked to take a leap of faith. ExpressVPN, already well-known for its frequent independent audits, is now looking to cement that trust further by securing four internationally recognized International Organization for Standardization (ISO) certifications and releasing its latest transparency report.

Announced on Thursday (February 12), ExpressVPN and its parent company, Kape Technologies, have earned certifications in security management (ISO/IEC 27001), customer contact (ISO 18295-1 & 18295-2), and quality management (ISO 9001).

As the company explains in a blog post, "While an audit validates our technology, these ISO certifications validate our methodology." A proof that the organization has implemented a rigorous framework to manage data risks, rather than just fixing bugs when they appear.

In a further effort to boost users' trust, the provider also published details on all data requests it receives from authorities in the second half of 2025. The report shows zero data disclosed despite over 1.38 million requests, showing that its "no-logs" claims are more than just marketing.

"Security isn't just something you prove once"

The move to acquire these ISO certifications highlights a shift toward continuous governance rather than sporadic checks. Shay Peretz, Chief Operations Officer at ExpressVPN, describes this as a fundamental change in operations.

"Security isn't just something you prove once, it's something you build into how a company operates every day," Peretz said. "These ISO certifications reflect a real shift in how we run ExpressVPN, with clear standards, stronger governance, and greater transparency at the core. It's about putting proven systems in place, so privacy and quality are built into every product we ship, and giving users real confidence their data is protected for the long term."

In addition to the headline security standard (ISO/IEC 27001), the company also secured ISO 9001 for quality management, and ISO 18295-1 & 18295-2, which specifically cover customer support operations. For a service that relies heavily on 24/7 support to help users unblock streaming content or configure routers, verifying the quality of that support is a welcome addition.

1.38 million requests, zero data disclosed

Alongside the certifications, ExpressVPN released its H2 2025 Transparency Report. These reports are vital for potential customers because they show what happens when legal pressure is applied to the VPN provider.

According to the data released today, the company received a staggering 1.38 million DMCA (copyright) requests and 155 requests from government and law enforcement agencies during the second half of 2025.

The result? ExpressVPN disclosed zero user data.

This statistic is the practical application of the provider's "no-logs" policy. Because the servers are designed not to retain activity logs or connection data, there is simply nothing to hand over when a warrant or request arrives.

This dual announcement serves as a reminder of why ExpressVPN has successfully undergone so many audits. By combining "snapshot" code audits with long-term operational certifications like ISO, the company is attempting to build a wall of evidence that its privacy claims are factual realities.

For users, this doesn't change how the app works, but it does offer peace of mind. In an industry where trust is the primary currency, knowing your provider adheres to strict international standards for both security and customer support makes hitting that "Connect" button a little easier.

ExpressVPN's Valentine's Day sale has reached its halfway point. This means you've now got less than a week left to claim its super-low prices if you're looking to sign up.

Right now, ExpressVPN ranks 4th in our best VPN rankings. It's one of only 3 providers to ever top our list, and has seen huge improvements to its performance in recent months.

ExpressVPN was long held back by its price, with plans starting at over $5 a month. But thanks to its new tiered pricing and a Valentine’s Day deal, you can now pay less than half that amount.

Plans currently start from only $2.44 per month over two years, which is paid as $68.40 upfront. One-year plans see equally useful discounts, with plans starting from $3.49/month ($52.39 upfront).

Everything you need to choose an ExpressVPN plan

To get access to all of ExpressVPN's features – including the new ExpressAI, ExpressMailGuard, Identity Defender, and ExpressKeys – you'll need a more premium plan than Basic.

However, the cheapest plan does include ExppressMailGuard and blocking capabilities for malicious sites and ads. With up to 10 devices, it's also on a par with other top VPNs such as NordVPN or Proton.

I'd recommend getting an Advanced plan as it balances price with functionality. It's currently only $3.14 per month, paid as $88 upfront, and gives you access to all of ExpressVPN's new features, plus an increased device limit.

If you're looking to grab a cheaper VPN, there are several other worthy alternatives.

Surfshark ranks as the best cheap VPN out there. It starts from $1.99, but you can get a bunch of features for only a little over $2 per month. PIA is also a great choice if you're a more adept VPN user, with plans starting from only $2.03 per month.

To see a complete breakdown of what you get with each plan, see our comparison table below. Still got questions? Leave a comment, and I'll get back to you as soon as possible.

• TechRadar investigation found five VPNs impacted by typosquatting
• Around 14% of the 980+ domains are malicious
• Serves as a reminder to always double check the URL

Cybercriminals employ a range of tactics to distribute malware and harvest data, but few are as simple as the misuse of fraudulent web domains. While often associated with targeting online shoppers, a new TechRadar investigation has found that even users of the world’s most secure VPN providers are not immune to these attacks.

The technique – known as typosquatting – involves threat actors registering domain names that are near-identical to popular websites, relying on intentional misspellings or subtle character swaps. The goal is to catch users who make a minor slip at the keyboard, redirecting them to a dangerous landing page before they realize the mistake.

TechRadar’s Lead Security Reviewer, Mike Williams, identified over 980 of these lookalike domains targeting major VPN companies, including NordVPN, Proton VPN, Surfshark, ExpressVPN, and Private Internet Access (PIA).

While many of these sites were parked or inactive, approximately 14% were found to contain active threats, ranging from phishing and malicious advertisements to direct malware distribution.

Typosquatting popular VPN domains

Williams described typosquatting as a "simple but dangerous attack," noting that many users fail to spot the threat even under close inspection. "Some misspelled domain names are so similar to the original that they're really difficult to spot, even when you look closely," he explains.

To quantify the risk to those seeking privacy tools, Williams used a detection service to analyze the volume of fraudulent domains mimicking five of TechRadar’s top-rated VPN apps.

This research generated an extensive list of typosquatted domains, which Williams then investigated using NordVPN Threat Protection Pro. By running the domains through this security suite, he was able to identify exactly how many were flagged as active threats.

While ExpressVPN, NordVPN, and Surfshark emerged as the primary targets for typosquatters, Proton VPN faced the most aggressive threat landscape, with 29% of its associated fake domains flagged as malicious.

Conversely, PIA appeared to be the least targeted – of the 112 lookalike domains identified, only four were found to be potentially dangerous.

Encouragingly, some providers are taking proactive steps to combat the issue by registering and redirecting common misspellings back to their legitimate sites. ExpressVPN led on this front, securing at least 22 such domains to protect its users from keyboard slips.

As Williams explains, attackers rely on the difficulty of spotting a deceptive URL. "If the dodgy domain points to a fake site dressed up to look like the website you expect, there may not be any reason to look closely. You might just assume you're in the right place," he said.

While it is difficult to quantify the exact risk these sites pose to everyday users, landing on a site infested with malware and invasive trackers can jeopardize the security of your device and data privacy – precisely what you are trying to avoid by signing up for a virtual private network (VPN) service.

Beyond the threat of infection, TechRadar found at least 42 typosquatted domains redirecting to fraudulent copycat storefronts. These sites are designed to trick users into making a purchase, effectively handing over sensitive banking details to cybercriminals.

Web browsing isn't the only vector for these attacks, either. Williams notes that these fraudulent URLs are frequently used as bait in phishing emails and social media posts. Attackers deploy them in the hope that a user will see a URL that looks "about right" and trust that it is safe to click.

VPN companies respond

When approached by TechRadar, all five VPN providers confirmed they are actively monitoring typosquatting campaigns.

"Brand trust is important in the cybersecurity industry, and when you combine that with high brand visibility, it creates an appealing opportunity for bad actors looking to exploit user confidence through brandjacking and typosquatting," said a NordVPN spokesperson.

ExpressVPN noted that the global, open nature of domain registration makes this a difficult trend to curb. "Anyone can register a domain at any time and publish impersonation or misleading content without authorization," the company said.

While it isn’t a company's legal responsibility to police the entire internet for fraudulent URLs, all the brands we spoke to have established mitigation strategies.

Paulius Dauknys, Head of Risk Management at Surfshark, described the situation as an ongoing "cat and mouse" dynamic. "New domains often appear shortly after others are taken down," he warned.

The process typically begins with automated web monitoring to flag suspicious or near-identical URLs. These domains are then analyzed for risk before the providers coordinate with hosting companies and registrars to have the fraudulent sites removed.

However, even with these systems in place, the process remains slow. "The domain dispute process can still take a considerable amount of time," noted David Peterson, General Manager of Proton VPN.

How to stay safe

The findings of this investigation serve as a stark reminder that even routine browsing can jeopardize your digital security. It only takes a single slip on the keyboard to land on a compromised page.

As Mike Williams notes, there is no single, silver bullet solution to the problem. "Chrome first added basic URL checking in 2019, but it missed the vast majority of dangerous domains in our tests," he said.

However, there are some easy-to-follow steps to mitigate the chances of falling victim to typosquatting:

• Scrutinize the URL: Remember, even one letter can land you on some dangerous websites. When in doubt, run the URL through a link checker tool to check for safety.
• Look for commonly switched characters or missing characters: Domains like 'n0rdvpn.com' or 'norvpn.com' are very common as they are more difficult to spot. You should also be wary of URLs that just add common words like 'login', 'support', or 'store' to a domain name.
• Bookmark the originals: Once you have verified a provider's legitimate homepage, save it to your bookmarks. Using a trusted bookmark is the most reliable way to avoid the risks of manual typing or clicking suspicious links.
• Download your VPN app from official sites: Whenever possible, it's advisable to download your application from official app stores.
• Verify before you click: Treat ads and unsolicited emails with caution. If you are unsure about a link, manually type the known URL into your browser or use a link-checker tool to verify its safety.
• Use a malware and ad-blocker: Use a dedicated malware and ad-blocker. These tools are specifically designed to intercept phishing attempts and malicious scripts, providing a final safety net even if you accidentally click a "dodgy" link.

• ExpressVPN has introduced fixed pricing in GBP, EUR, and BRL currencies
• The provider is now testing fixed prices in CAD, AUD, JPY, SGD, and HKD
• The update paves the way for new regional payment options

For international users, subscribing to a top-tier service often comes with a hidden annoyance: currency conversion fees and fluctuating monthly bills. ExpressVPN is finally addressing this pain point by rolling out fixed local currency pricing for several major regions.

Historically, ExpressVPN has charged international customers in USD. While the base dollar amount remained static, the actual cost on a user's bank statement would wobble based on the daily strength of their local currency against the dollar.

Starting immediately, that uncertainty is gone for users in the United Kingdom, the Eurozone, and Brazil. Customers in these regions will now see fixed prices in Pounds (GBP), Euros (EUR), and Reals (BRL) respectively. The price displayed at checkout is now the exact final figure, regardless of how the global forex market behaves.

ExpressVPN describes the move as "the natural next step in our mission to make digital protection as accessible and straightforward as possible." By locking in these rates, the provider ensures that a subscription cost won't unexpectedly spike due to economic shifts, a welcome change for anyone managing a tight monthly budget.

Who gets local pricing?

The rollout is happening in phases. As of now, fixed pricing is fully live for the UK, Eurozone, and Brazil. However, ExpressVPN confirms it is "actively testing and launching" local currencies for several other major territories.

Users in Canada (CAD), Australia (AUD), Japan (JPY), Singapore (SGD), and Hong Kong (HKD) may already see local pricing appear at checkout. Additionally, the provider plans to launch currencies for New Zealand (NZD) and Switzerland (CHF) in the "coming weeks."

In a blog post announcing the change, the company stated: "Great digital privacy should be seamless. That applies to how our apps work, and it applies to how you pay for them."

"By offering fixed pricing, we ensure that the price you see on our site is exactly the price you pay, providing a consistent, localized experience from the moment you sign up."

A precursor to new payment methods

This shift isn't just about currency symbols; it’s about infrastructure. By localizing its billing systems, ExpressVPN is preparing to support region-specific payment methods that were previously difficult to implement under a USD-only model.

The company explicitly mentioned plans to roll out support for "Buy Now, Pay Later" (BNPL) services, such as Klarna, in select markets. This aligns with the provider's recent strategy to offer more flexibility, following the launch of its new tiered pricing structure last year.

Users can now choose between three plans, Basic, Advanced, and Pro. The Basic tier covers the core VPN service and trusted identity protection features. The Advanced plan adds an ad-blocker, the ExpressKeys password manager, and limited international eSIM data. The top-tier Pro plan includes a dedicated IP and expanded data removal services.

While the currency on the bill is changing, the product remains global. All plans continue to include the provider's strict no-logs policy and RAM-only TrustedServer technology. However, it is worth noting that the "Identity Defender" suite (including ID monitoring) remains available solely to users based in the US for the time being.

Current subscribers or new users in the supported regions can check the specific fixed rates by visiting the order page today.

Safer Internet Day is a global event dedicated to promoting a more positive digital world, and for 2026, the campaign is focusing on one of the most pressing challenges in tech: "exploring the safe and responsible use of AI."

Our interaction with the web has been transformed by the rapid rise of tools like ChatGPT, Gemini, and Grok. However, these advancements have arguably outpaced the industry’s sense of responsibility.

From intrusive data harvesting for Large Language Model (LLM) training to the surge in AI-powered scams and deepfakes, the AI boom has created a new frontier of digital threats

To mark Safer Internet Day, I'm investigating how the VPN industry is evolving to meet these challenges and developing new tools designed to shield users from these emerging risks.

1. Lumo by Proton: The first privacy-first chatbot

Swiss-based Proton – the firm behind one of the best VPN and secure email services on the market – has long championed a private and free internet.

Since the launch of Proton Mail in 2014, the company has built a comprehensive security ecosystem designed to challenge Big Tech with privacy-first alternatives. In July 2025, Proton brought the same ethos to the generative AI space.

Lumo is Proton's open-source AI assistant designed to match the functionality of other LLMs like ChatGPT without the privacy trade-offs.

Conversations are kept confidential through zero-access encryption, ensuring that no user data is used to train the underlying model or sold to third parties.

Speaking at the launch, Proton founder and CEO Andy Yen warned that Big Tech is using AI to "supercharge" the collection of personal data and accelerate the growth of "surveillance capitalism."

Yen argued that AI should not become a surveillance tool, and said Lumo "puts people ahead of profits."

Following Proton’s established model, Lumo offers both free and premium tiers. The Lumo Plus plan provides expanded features, including unlimited chats and support for larger file uploads.

The assistant is accessible via a web browser or through dedicated apps for Android and iOS.

2. ExpressAI: ExpressVPN's upcoming private AI platform

ExpressVPN is also making a significant move into the sector with its new "private-by-design" platform, ExpressAI.

While originally scheduled for a February 5 launch, the provider has pushed back the release to refine the tool’s performance.

Despite the delay, we already have a clear picture of its architecture. Much like Lumo, ExpressAI uses zero-knowledge, end-to-end encryption, ensuring that conversations are unreadable to everyone.

It is also expected to include a disappearing messages feature, which allows users to set conversations to auto-delete after a set period. Furthermore, ExpressVPN claims that no user files are ever stored on its servers.

ExpressAI will be included with all ExpressVPN plans. Here are more details on everything it means for your VPN subscription.

3. From Meshnet to Threat Protection Pro: How NordVPN fights the danger of AI

Unlike Proton and ExpressVPN, NordVPN has yet to announce its own chatbot. Instead, the provider is focusing on helping users defend against some of the risks of the burgeoning AI agent ecosystem.

Much of this concern centers on OpenClaw, a viral open-source AI agent capable of executing code and accessing local files.

Recent research found that attackers uploaded at least 14 malicious skills to ClawHub, the public registry for OpenClaw extensions, with the goal of tricking victims into spreading malware.

NordVPN CTO Marijus Briedis says the most critical risk are "prompt injection" attacks. That's because OpenClaw has access to your email and messages, allowing a malicious actor to craft content that hijacks the agent's behavior. It's essentially "weaponizing your own AI assistant against you," Briedis said.

NordVPN's Meshnet – a tool that lets you create a secure virtual network among up to 60 different devices at once – offers a straightforward solution to this.

Briedis said: "Meshnet can create a direct, encrypted connection between your devices without routing through third-party servers. You can access your self-hosted OpenClaw instance as if it were on your local network, while keeping it completely invisible to the public internet."

The team at NordVPN has also been busy improving the functionality of its flagship Threat Protection Pro suite to defend users against AI-enabled scams.

In 2025, the provider launched tools that scan email links for threats in real time, block spam calls, monitor crypto scams, protect against session hijacking vulnerabilities, and even perform adult site blocking on mobiles.

One of the company's top priorities for 2026 is to keep expanding the capabilities of the Threat Protection Pro beyond VPN protection, with a focus on building tools to help detect deepfakes and manipulated content.

Looking ahead

Safer Internet Day 2026 serves as a vital reminder that while innovation can fundamentally improve our lives, those benefits are easily undermined without robust safety and ethical frameworks.

While the broader AI industry has often struggled to keep pace with the risks inherent to its own platforms, several companies from the VPN sector are now stepping in.

From Proton and ExpressVPN’s private-by-design assistants to NordVPN’s proactive threat detection, these tools offer a blueprint for a more secure, AI-integrated future.

As these threats continue to evolve, the "arms race" between malicious automation and privacy-first defense will only intensify.

For users, the best defense is no longer just a strong password, but a comprehensive security suite built to navigate an automated world.

Super Bowl LX kicks off this Sunday at 6:30 PM ET on February 8th when the Seattle Seahawks go up against the New England Patriots. It’s streaming on Peacock and Hulu, as well as TV providers that offer NBC. You won't want to miss out on this clash because of a sports blackout or a vacation outside the US – and that's where a VPN comes in handy.

The TechRadar team has spent hundreds of hours testing today's best VPNs. Our Super Bowl picks have the right combination of speed, unblocking power, and US servers to ensure that you can keep up with every kick and scrum in HD.

NordVPN is our #1 choice overall, thanks to reliable access to top streaming platforms, but Surfshark is a great alternative if you're working with a budget and want to stream across multiple devices.

Quick overview

Our top 5 recommendations

The best VPN overall

NordVPN takes the #1 spot in our Super Bowl ranking because it's the strongest VPN in key areas: streaming, speed, and a great roster of tools you can use even after the game has ended.

Our streaming tests found that NordVPN provides reliable access to pretty much every streaming service you can think of – including dedicated sports platforms and channels. This also covers the likes of Peacock, Fubo, and DAZN, which we were able to check out without needing to switch servers or deal with pesky pop-ups telling us to switch off our VPN.

In terms of speeds, NordVPN consistently ranks at the top of our in-house performance tests. We use a 10 Gbps line to put VPNs through their paces, and NordVPN's proprietary protocol, NordLynx, delivered the best results. Our local connection (UK to Dublin) clocked in at 1256 Mbps.

These speeds are enough to stream the Super Bowl in 4K resolution many times over. So, there's no need to worry about a low-quality picture spoiling a game-winning touchdown.

When we switched to a transatlantic connection, we saw results of 900 Mps. While that’s a significant drop-off compared to some of the other providers on our list, it’s still well above what you’ll need to stream sporting events live and in HD.

NordVPN also offers a wide choice of VPN server locations in the US. At our last count, NordVPN has 39 separate locations in North America including New York, Los Angeles, and Chicago. This means there should be a server local to you if you're currently in the States, or one based in your hometown if you're overseas for work or vacation.

NordVPN allows 10 simultaneous connections per account, which is about what you’d expect from a premium VPN. Currently, you can buy the Basic plan at $12.99 per month, which gives you access to NordVPN's core roster of features. Upgrading to one of NordVPN’s more premium plans unlocks features like a Password Manager, ID Monitoring, and 1TB of cloud storage, but you’re unlikely to need these features if you’re just interested in streaming.

The best secure VPN

Proton VPN ticks off all the security credentials you'd expect from one of today's top VPNs – but it knows how to have fun, too. With speeds on par with the quickest providers out there, and great unblocking power, it's a top-notch Super Bowl option for anyone looking to enjoy the game and ramp up their privacy in the meantime.

We saw Proton VPN step things up in terms of speed, recently, which makes it a fantastic streaming VPN. Using the WireGuard protocol, and the VPN Accelerator tool, our UK-to-Dublin connection clocked in at 1,521 Mbps. Switching to the States, our results were equally as impressive, at 1,242 Mbps.

So, if picture-quality is your main concern, and you don't want big plays spoiled by buffering, Proton VPN is well worth checking out.

The same goes for expats and vacationers looking for access to US-based streaming services. Proton VPN works well with most platforms, including Peacock, Fubo, and Netflix, and we even managed to get it working with US YouTube – which Surfshark couldn't manage.

In terms of North American server coverage, Proton VPN falls behind NordVPN and Surfshark – but only by a whisper. 32 locations across the continent are still more than enough to work with.

Proton VPN is unusual in that it’s one of the only top-tier VPN providers that offers a genuinely free tier with no ads or bandwidth restrictions. However, there's a pretty significant catch - you can't manually select a server to connect to (and there are only 10 countries available). Ultimately, this makes Proton VPN Free a less-than-ideal choice for streaming, and why we'd recommend sticking with the premium version for the Super Bowl and other sports.

That said, Proton VPN’s base plan is actually pretty cheap at only $9.99 per month. This gets you all of the core VPN features, and access to servers in more than 120 countries. Buying yearly drops this price down to $3.99 per month, whereas the two-year plan costs $2.99 per month. Both plans renew at $83.88 for the year.

The best cheap VPN

Surfshark's budget-friendly price points are tempting all-year round – doubly so if you're already paying for a sports streaming subscription to catch this year's Super Bowl. From just $1.99 per month, you'll have access to one of the fastest VPNs we've tested.

During our internal testing, we clocked a high of 1,615 Mbps when connecting to a nearby Dublin server from the UK. It's an absolutely blistering result that's more than fast enough for smooth, HD streaming.

Those speeds dropped off to 355 Mbps when we connected to the States. It's more of a drop-off than we'd expect from Surfshark, given its past performance, but the results are still well within the range you need to enjoy clear playback.

It is also worth noting, however, that Surfshark posted the highest latency to the US in our tests by a wide margin at 171 ms. This won't cause too many issues while streaming, but it could cause minor hiccups (like latency and slowdown) if you have plans to game online or join a video call.

We also think that Surfshark could do better when it comes to streaming US-based content. We had no trouble tuning in to Peacock and US Netflix, but struggled to enjoy US YouTube, no matter how many times we switched servers – which could be a sticking point if you plan on watching highlights or player interviews after the dust has settled.

To get the most out of Surfshark, you'll want to pick up one of its long-term subscriptions. It's where the biggest and best savings are. A single year of Surfshark Basic costs $3.19 per month, but if you opt for the 2-year plan, that price drops to $1.99 (though remember, you'll need to pay for your plan upfront).

Surfshark also offers unlimited simultaneous connections at a budget-friendly price point, which makes it an excellent choice if you're streaming the Super Bowl across multiple devices. Most competitors limit you to around 10 devices, meaning a decently sized family would have to take out more than one VPN subscription. That’s not the case with Surfshark: one subscription covers all of your devices.

An speedy, mid-range pick for the Super Bowl

A recent revamp saw Norton VPN become a real contender in the VPN space – and it's an undeniably good pick for the Super Bowl, too, thanks to the double-whammy of awesome speeds and unblocking power.

Most people will be more familiar with Norton's antivirus software, but its new, overhauled VPN product is making waves, too. Fans wanting to follow every play of Super Bowl LX will be glad to hear that Norton VPN is an excellent choice for streaming. It works with most US-based streaming platforms we tested, including US Netflix, though we did fail to crack US YouTube.

This isn't a total surprise, given how new Norton VPN is to the market, but it's something to keep in mind for anyone who wants to tune into clips, analysis, or interviews after the game.

The news is better when it comes to speed. Using the WireGuard protocol, we saw results of our UK-to-Dublin connection come in at 909 Mbps. These roughly halved when we switched to a US server, and though 463 Mbps lags behind the likes of ProtonVPN and ExpressVPN significantly, we didn't experience any major issues when streaming (and this is still quick enough to keep up with multiple 4K streams - just in case somebody else in the household wants to watch the Winter Olympics, instead).

Currently, there are 25 US-based servers offered by Norton VPN, and they're spread out pretty evenly across the continent. This is good news for locals and expats alike, though we'd always recommend picking the server closest to you, geographically, for the best, most stable connection.

A 1-year Standard Norton VPN plan comes in at $3.33 per month, and we think the VPN deserves credit for being up front about how prices jump to $6.66 on renewal. Plenty of VPNs do this - but Norton VPN is one of the only services we've seen that are transparent about it. If it all seems a bit steep, a generous 60-day money-back guarantee is available, so you can try Norton VPN out over Super Bowl weekend, risk-free.

The best VPN for Windows

If you're more of a sports aficionado than VPN expert, ExpressVPN is a great place to start. Its apps are nice and easy to use, a recent upgrade introduced a whole host of new tools, and it has enough North American servers to make tuning in to your local broadcaster (or NBC) as simple as picking a location in your home state.

ExpressVPN's speeds are solid and well-suited to streaming live TV in HD. There are a few protocols to choose from, though. Alongside OpenVPN and WireGuard, ExpressVPN also has its own proprietary VPN protocol, Lightway, which comes in two flavors: the standard version and Lightway Turbo.

We'd recommend sticking to Lightway Turbo if performance is your main concern (though be aware it currently only works with Windows devices – Mac users are better off with Lightway or WireGuard).

Using Lightway Turbo to connect to Dublin, we recorded results of 1,479 Mbps, and these dipped slightly when connecting to the US to 1,374 Mbps. It's the best transatlantic result we've seen, from all our top-ranked VPNs, and bodes well for anyone overseas wanting to keep up with action from Levi’s Stadium.

When we put ExpressVPN's streaming capabilities to the test, we were just as pleased. ExpressVPN works well with US Netflix, Hulu, Fubo, and Peacock, and at no point did we have to switch servers to get around lag or playback issues.

Finding a US or North American server to join won't be a problem with ExpressVPN, either, seeing as there are 70 locations to choose from. This is practically double the amount offered by NordVPN, Surfshark, and Proton VPN – and ExpressVPN is one of only a handful of VPNs that has servers in all 50 states.

ExpressVPN’s pricing is now much more in line with its competitors after a pricing overhaul. The Basic plan sits at $12.99 a month, which is a little less expensive than Surfshark. For this price, you’ll get 10 simultaneous device connections and all of ExpressVPN’s core features, including a basic ad-blocker. Buying the yearly plan drops this price to $3.49 per month, whereas the two-year plan costs $2.44 per month and throws in four extra months for free.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

ExpressVPN has announced that four new major features are being added to its VPN plans starting today, February 5.

The tools — ExpressAI, ExpressMailGuard, Identity Defender, and ExpressKeys — are the biggest expansion to ExpressVPN's portfolio since it eSIM launched in December 2024.

VPN users can try most of the tools from today. Only ExpressAI is yet to fully launch, but is expected in the near future. Identity Defender is also limited to US users for the time being.

To get the full experience, you'll need a Pro plan. Basic plans don't offer to ExpressKeys or Identity Defender.

What this means for your VPN plan

ExpressVPN has confirmed to TechRadar that all of its plans will stay the same price, despite the new features,

This means that with ExpressVPN's Valentine's Day sale, you can try all of the new features with an Advanced plan for only $3.14 per month, billed as $88 upfront on a two-year plan with 4 months extra included. For the full package, a Pro plan is currently only $5.24 per month, billed as $146.80 for 28 months of coverage.

If you're still contracted to one of ExpressVPN's old 'one-plan-fits-all' packages, there's no need to worry. ExpressVPN confirmed that users on these plans would be given access to everything you'd expect in an Advanced plan — ExpressAI, ExpressKeys, ExpressMailGuard, and Identity Defender (if you're in the US).

If you'd previously used ExpressKeys in the ExpressVPN app, don't stress. The new launch merely moves the platform to a standalone app, with improved features and functionality.

If you've used ExpressKeys before, logging in with your ExpressVPN credentials will give you access to all your saved details.

Shay Peretz, Chief Operating Officer at ExpressVPN said: "We’re giving users a simpler, more secure way to save, organize, and autofill their credentials. ExpressKeys is also an important step in where we’re headed: a broader privacy ecosystem designed to give people more control over their digital lives."

What do we know about the new features?

To find out more about each of the new tools, check out our coverage of:

ExpressKeys

ExpressAI

ExpressMailGuard

Alternatively, see below for an overview of the full scope of what each ExpressVPN plan now has to offer.

• ExpressMailGuard lets users create unlimited email aliases for total inbox control
• Users can manage forwarding, blocking, and filtering through a central dashboard
• Aliases work with any email provider across multiple devices seamlessly

ExpressVPN has introduced ExpressMailGuard, a tool designed to give users more control over one of their most exposed digital identifiers: their email address.

The service provides a central dashboard where users can generate unlimited email aliases, track which services each alias is used for, and see messages that are blocked or forwarded.

Users can set rules and automations to determine which emails reach their primary inbox and which are filtered or stopped, allowing precise control over incoming messages.

ExpressMailGuard – a solution for email spam

The dashboard also provides clear visibility into usage and limits, showing monthly activity and delivery statistics at a glance.

ExpressVPN says the goal is to reduce exposure to spam, phishing attempts, and other threats without changing existing email habits.

Unlike many email alias tools limited to a single provider or ecosystem, ExpressMailGuard works with any email service and across multiple devices.

Users can assign destination inboxes for forwarded mail and update recipients without creating new aliases, simplifying management across apps and accounts.

ExpressVPN emphasizes these aliases are disposable, allowing users to instantly block any address that receives spam or unwanted messages.

This flexibility aims to protect privacy while maintaining everyday usability, ensuring that all forwarded mail remains under user control.

ExpressMailGuard integrates seamlessly into the broader ExpressVPN ecosystem, extending privacy protections beyond a VPN to daily digital identity use.

This tool is now available as part of ExpressVPN’s subscription plans, starting from the Basic tier, with additional features for Advanced and Pro users.

The web-based service requires an active ExpressVPN subscription and operates alongside the company’s VPN tools, providing a consistent privacy layer across email, online browsing, and AI tools.

In 2025, nearly two billion unique addresses were exposed publicly. ExpressVPN describes the service as a practical response to the growing email-related risks.

The platform also incorporates firewall-like protections, letting users control how aliases interact with external services and ensuring that messages are filtered and managed according to user preferences.

“Email addresses are permanent, but many of the services people sign up for are not,” said Shay Peretz, COO at ExpressVPN.

“ExpressMailGuard is like a VPN for email. We’re making it easy for anyone to protect their real email address, reduce unwanted exposure, and manage aliases in one place, no matter which email provider they use.”

• ExpressVPN is releasing a password manager app
• ExpressKeys will allow you to store credentials, credit cards, and more
• The app can double as a two-factor authenticator (2FA)

ExpressVPN, creators of one of the best VPNs around today, has unveiled its latest addition to the world of security - the standalone ExpressKeys app.

ExpressKeys (or Keys as it was known within the ExpressVPN app), is now a dedicated password manager app for iOS and Android devices and as a web browser extension.

The new ExpressKeys app allows users to store logins, credit cards, and secure notes, while also functioning as a two-factor authenticator app.

ExpressKeys password manager

The new app enters the industry at a time when many competitors have existed for years, and in some cases decades. So what does it offer?

The app offers all the standard features of a password manager, including a password generator that can be adapted for length, numbers, and special characters. The app can be unlocked using your device's built-in biometric authenticator so there is no need to enter a password just to access the app.

The app can analyze your stored credentials to check for any weak or reused passwords, and even scan the dark web for any wayward credentials that have been leaked or exposed.

ExpressKeys doesn’t rely on having an internet connection to access your stored logins and offers quick and easy credential imports from other password manager apps - and if something goes wrong, there is 24/7 live chat support.

The ExpressKeys app is included in all current ExpressVPN plans that include the Keys password manager, including Advanced and Pro plans. For those using the existing in-app password manager, you have until March 5, 2026 until the Keys feature is depreciated and password management is available exclusively through ExpressKeys.

• ExpressAI ensures user data cannot be collected or accessed by anyone
• Confidential computing enclaves isolate AI interactions from all infrastructure and provider access
• Users can run the same prompt across multiple LLMs simultaneously

Artificial intelligence is increasingly used for tasks that involve sensitive personal and professional information.

ExpressVPN has announced ExpressAI, an AI platform it says is built around a single principle: user data should not be collected.

The company links this principle directly to its long-standing VPN architecture, including its business VPN services, where traffic is designed to remain inaccessible even to the provider itself.

Data handling concerns and company rationale

ExpressAI is designed as an extension of that same approach into conversational AI and file-based interactions.

“With ExpressAI, ExpressVPN is effectively extending its long-held stance on traffic protection to AI interactions: The best way to protect user data is not to collect it in the first place,” said Shay Peretz, COO at ExpressVPN.

The target is to offer AI functionality without requiring users to trade privacy for convenience.

ExpressVPN argues that many users already rely on AI tools for personal matters that would normally require confidentiality.

“People are already turning to AI for high-stakes, personal conversations—from health questions to financial decisions. Whether you’re accessing a bank account online or discussing private matters with a professional, you expect strong privacy protections. But those protections don’t automatically carry over to everyday AI chats,” said Shay Peretz, COO at ExpressVPN.

“That gap has left many users uneasy about how their data is handled. ExpressAI was built to remove that fear entirely, proving that private, trustworthy AI isn’t a future promise, it’s available today.”

Therefore, user prompts and files are not accessible to anyone, including the company’s staff or infrastructure operators.

It relies on confidential computing enclaves, a technical method that isolates data during processing.

This ensures that conversations can only be decrypted within a cryptographically protected environment that is separate from the host system.

User inputs are not reused for training, and uploaded files are processed in memory rather than stored on servers.

The platform supports several LLM options, allowing users to choose different models depending on their needs.

A comparison view enables the same prompt to be run across multiple models at once, showing different outputs without merging the data.

The platform will be available soon both through a standalone web application and is included in existing ExpressVPN subscriptions, with additional features reserved for higher tiers.

Flowers and chocolates may be the usual Valentine's Day go-to gifts, but this year, the real treat is the substantial savings you can make with ExpressVPN’s subscription plans.

ExpressVPN has a special offer in the run-up to Valentine's Day, with savings of up to 81%. One of the best VPN services you can use, it’s offering deep discounts on all one and two-year subscriptions, giving you and your loved ones the chance to save significantly.

By taking advantage of ExpressVPN’s Valentine’s Day sale, you’ll pay as little as $2.44 a month. All two-year plans even come with an extra four months free, allowing you to use this premium VPN even longer at no extra cost.

Committing to a longer-term subscription lets you lock in the biggest savings, but if you don't want to pay quite as much upfront, ExpressVPN’s 12-month plans still carry generous discounts of up to 73% – alongside three additional months of free protection.

ExpressVPN Valentine’s Day offers are set to run until February 16, 2026.

Which ExpressVPN tier is right for me?

Valentine’s Day is a reminder that not every relationship looks the same, nor does it need to. That’s also the case for ExpressVPN’s subscription tiers, with three plans designed for different levels of commitment: Basic, Advanced, and Pro.

Basic is your low-maintenance option, providing all of the ExpressVPN essentials, including 256-bit AES encryption and a kill switch. It even comes with Lite Protection, which blocks ads and malicious sites, and allows up to 10 simultaneous connections. If you’re a light user who wants reliable protection without all the extras, this is your best bet.

Advanced is for regular users who want broader protection. This expands your connection allowance to 12 devices and adds numerous extras, including tracker blocking and ExpressVPN’s password manager. Notably, it also comes with Identity Defender, ExpressVPN’s suite of ID protection tools, which include SSN monitoring, data removal, and ID theft insurance.

Pro is ExpressVPN’s all-in, no-compromise plan, offering everything available in the Basic and Advanced tiers, as well as a dedicated IP address. Between this and an expanded 14-device connection allowance, this plan is perfect for families and multi-device households who want the most comprehensive protection available – and it's now discounted of 73% from its normal pricing.

Whichever plan you choose, you should do it quickly, as this is a time-limited offer.

• ExpressVPN is rolling out major updates across all of its apps
• It includes performance improvements and post-quantum protection
• Older versions of the app will stop working after March 31

ExpressVPN has just set an important deadline for its users. No matter the platform, you have to update the app by March 31, 2026, or you will lose VPN protection.

This push to update comes as a result of ExpressVPN retiring older security certificates. This means that legacy apps will no longer be able to authenticate and connect to the VPN service.

ExpressVPN is one of the best VPN services out there, and these updates are necessary for users to stay protected. Fortunately, updating your app is easy, no matter the platform.

If you have automatic updates enabled, this probably doesn't affect you – but given the consequences of not running a VPN, you might want to verify that you're already running the latest version regardless.

All legacy ExpressVPN apps will go offline at the end of March

In a blog post, ExpressVPN explained that it will retire older security certificates. Without a working certificate, your ExpressVPN app will no longer be able to connect to a VPN server.

This won't affect internet connectivity. You'll still be able to go online, but without the added protection of a VPN client. This means that your IP address will be visible to your internet service provider (ISP) and various websites and apps. It may also be more vulnerable to potential threats.

Most devices will need updates. Linux users will have to make the switch to the GUI-based client as part of this.

The update doesn't bring new features to users, but it does add an extra layer of security by refreshing the older certificates with new, improved ones. The credentials now support ExpressVPN's latest post-quantum security features, setting it up for the future.

The change in certification follows some other recent upgrades, including a major Qt performance update, a boost to connection speeds, and a major mobile app redesign in May 2025.

How to update ExpressVPN or check your existing app version

The update is free across all ExpressVPN apps. To make sure you stay protected, you need to update to the latest version of your respective app, as outlined below.

Updating is easy. Many users may have automatic updates enabled. If you don't, it should be as easy as simply clicking "Update" in the app when prompted, or going to the ExpressVPN website to download the latest version.

To check your app version, do the following:

• On Windows and Mac, run the app and click the menu icon (three lines) > open Help & Support > About ExpressVPN
• Android and iOS users need to tap the Help tab, then go into About
• On Linux, type "expressvpn--version" in your Terminal
• If you use an Aircove router, log in to your dashboard, then go to Advanced Settings > Software update.

If you use a third-party router that runs on ExpressVPN firmware, it’ll get an automatic update, so you don’t have to do anything.

• Enormous trove of 149 million credentials exposed online
• Included usernames and passwords for banking, social media, and .gov accounts
• It isn't known how long the database was exposed for, but it has now been taken down

Cybersecurity researcher Jeremiah Fowler (via ExpressVPN) has once again uncovered a huge publicly accessible trove of data.

The massive container of unique usernames and passwords was exposed on the web without any password or encryption protection.

The data contained over 149 million combinations of usernames and passwords totalling around 98 gigabytes of credentials spanning online accounts of almost every kind.

149,000,000 credentials exposed

The credentials found within the container covered financial services including cryptocurrency wallets, trading accounts, and banking account details. Social media and dating app credentials were also included in the database.

Outside of personal accounts, a number of email accounts using the .gov domain were found within the container.

Very little is known about the origin of the exposed cloud storage container, but Fowler notes that traces of infostealer and keylogging malware was present in the database. Upon discovery, Fowler attempted to trace the owners of the account, but was unable to find any associated information.

Instead, Fowler attempted to contact the hosting provider who said that the container was being hosted by a subsidiary operating independently. It took almost one month to have the container taken down, Fowler notes.

Interestingly, the credentials stored within the database were indexed in such a way as to make them easily searchable using the “host_reversed path”, meaning that the database could have been the work of an organized hacker, or may have been a research database.

A database of this size and scope could be used for highly nefarious purposes, such as spear-phishing, banking and credit fraud, and even identity theft. It is not currently known how long the database was left exposed.

The best password managers are one of the top ways to keep your credentials safe from being stolen. Many password managers store your usernames and passwords in an encrypted vault using two-factor authentication, and will scour the dark web to check if any of your credentials have been exposed.

• France issues another blocking order to five top VPNs
• The VPNs must block access to 13 illegal football stream sites
• That's the third such ruling against VPNs since May 2025

A court in Paris has ordered five well-known VPN providers to block access to illegal sports streaming sites.

The order, dated December 18, compels NordVPN, Surfshark, Proton VPN, ExpressVPN, and CyberGhost to restrict access to 13 piracy sites, ruling in favor of the Ligue de Football Professionnel (LFP).

The ruling, as first reported by TorrentFreak this week, echoes a similar order issued against the same VPN companies last May, which required these services to block access to 203 domains linked to illegal sports streaming. At the time, the VPN industry warned the move set "a dangerous precedent," warning of a chilling effect on online privacy and security.

Those concerns appear well-founded. Since the landmark May ruling, more VPN-blocking orders followed in June and July at the request of French broadcasters beIN Sports and Canal+.

What does the blocking order say?

Under the most recent ruling, the five VPN providers are required to introduce "any effective means" to prevent access to the 13 domains from within France within three days of the decision.

The measures apply for the duration of the 2025/2026 football season, which is set to end on May 24, 2026.

The list of sites affected can be extended throughout the season at the LFP's request, via the regulatory authority ARCOM.

Judge reject VPN defence

VPN providers raised several legal and technical arguments against the blocking order, which the judge rejected.

NordVPN and Surfshark argued that their no-logs infrastructure prevents them from identifying users based in France. The companies warned that collecting real user geolocation data would violate their contractual obligations.

The court responded that blocking access to illegal domains does not imply that the service needs to permanently store user information.

The VPN providers also challenged the definition of "technical intermediaries" under Article L. 333-10 of the Sports Code. The judge rejected this argument, identifying VPNs as key intermediaries in online piracy and deeming them legally liable.

According to the VPN companies, the blocking measures are also ineffective and easy to circumvent, as users could turn to another VPN or DNS service.

What's next?

We have contacted the affected VPN providers to understand how they plan to comply with the order and to clarify the implications for their users in France.

A NordVPN spokesperson confirmed to TechRadar that the company has already initiated an appeal, arguing that blocking does not eliminate the content itself or reduce the incentives for piracy.

"Effective piracy control should focus on eliminating the source of the content, targeting hosting providers, cutting off financing for illegal operations, and increasing the availability of legitimate content," said NordVPN.

The provider also warned that these orders unfairly target established, paid VPN services while leaving free alternatives largely untouched. "Free VPNs are often harder to regulate and, since users who seek to avoid paying for content are unlikely to pay for a VPN either, these services remain a loophole for pirates to bypass restrictions," NordVPN added.

Surfshark previously told TechRadar it intended to appeal the earlier May ruling. We anticipate the provider will likely file a similar challenge against this latest order.