• Tor unveils Snowflake Volunteer as a standalone Android app
• The app lets users share their open internet connection
• It is the result of a collaboration between Tor and Bloco

The team behind the censorship-resistant Tor Browser has unveiled Snowflake Volunteer — a standalone Android app that lets you help people living in restricted countries bypass internet censorship.

Developed in collaboration with Portuguese Android studio Bloco, the app expands on Snowflake's capabilities. That's Tor’s pluggable transport, which allows people on censored networks to connect to the Tor network via volunteer-operated proxies, making their connection appear as normal traffic.

Since its official launch in April, Tor reported that the app saw an increase from about 1,300 unique proxy IP addresses per day in May to 1,700 per day in June, marking a 29% increase in one month. That represents a win for raising public awareness and expanding its volunteer-led community.

Altruistic digital privacy

Tor Browser is a free-to-use, privacy-focused network that routes Internet traffic through a series of secure computers run by volunteers in different countries — the "layers of an onion" —to prevent snoopers from identifying you personally as the one visiting sensitive sites.

Just like the best VPNs, Tor is all about protecting your privacy online. However, its system only works if people around the world volunteer to run the access points.

Tor bridges, like Snowflake, allow digital users living in safer countries to make their private connections available by turning their phones and computers into proxies, making it appear that they are making video or audio calls. A system that has been widely used as an alternative to VPNs in countries under censorship, including Iran.

It uses the "domain fronting" technique to establish a connection with one of the thousands of Snowflake proxies managed by volunteers. For users subject to censorship, if their Snowflake proxy is blocked, the broker will automatically find a new one.

What Snowflake actually needs is more volunteers' proxies that can serve as disguised access points to the Tor network. Perfectly addressing this need, the Snowflake Volunteer app was created specifically to allow people with less technical experience to easily become these proxies and contribute to the network's continued expansion.

Indeed, until now, the option was available for Android on Orbot, Tor's main Android app, or via browser extensions, a desktop command-line tool, and manual access to Tor's Kindness mode to facilitate the process.

The new app widely simplifies the experience. Users can simply install the app from F-Droid and Google Play (or build it from the source code) and let it run in the background to have their device become part of the Tor bridge. They can also restrict its use to networks with unlimited data, and set a limit on the number of people who can connect at the same time.

Once enabled, the app automatically connects with users seeking a Snowflake proxy and helps route their connection through the Tor network, making it easier and more rewarding to help others online, as people can see the impact of their actions.

Tor vs VPNs?

Is it wise to use a VPN with Tor? Unfortunately, there is no universally accepted answer.

Tor's official stance for most users is not to use a virtual private network (VPN) to avoid the risk of exposing identifying information. However, if you’re an experienced user who understands the technical aspects of VPNs and Tor routing, you could safely opt for more complex configurations.

Others, however, argue we should all use VPNs: particularly in countries with high levels of censorship, some believe it’s better to use VPNs, as they mix better into normal traffic and arouse less suspicion.

Unfortunately, though, this approach fails where VPNs are subject to restrictions or made illegal — further proof that, when it’s about digital security, there might be no one-size-fits-all solution.

• Amnezia has released a new app upgrade
• It’s mandatory for all Amnezia Premium and Amnezia Free users
• The VPN recently enhanced its features after falling target to a cyberattack

Amnezia VPN has released a new mandatory app upgrade for its Premium and Free users, as the open-source VPN continues to strengthen its blocking capabilities.

As Russian citizens try to circumvent the country’s ongoing and repeated tightening of digital censorship, Amnezia VPN continues to boost its service to counter it, proving itself to be among the best VPNs truly committed to fighting censorship.

Indeed, the new upgrade promises to make the VPN app easier to use, integrating new system tools and circumventing blocks in 'increasingly ingenious ways', Amnezia said.

Available on all platforms, version 5.0.0.5 aims at strengthening the entire VPN blocking service, and it is mandatory for all Amnezia Premium and Amnezia Free users.

What's included with amnezia VPN update

As one of the new features, the app now allows users to install and configure the MTProxy and Telemt proxy services — which are basically designed to help users connect to Telegram in locations where access is blocked or restricted.

This means that, instead of having to manually configure these services on the server, users will be able to let the software handle this task, which will automatically configure the proxy servers for the messaging apps.

In addition, the update expands the networking options available to users. Previously, users could only modify the SNI and port for the XRay protocol (an alternative VPN protocol). Now they can also modify the transport, security stream, and additional HTTP and mKC parameters, giving users greater control over the configuration of their XRay VPN connection and allowing them to customize their VPN more effectively.

Amnezia stated that the update ensures greater stability and fixes several bugs, in addition to offering more comprehensive support for the AmneziaWG 3.0 protocol; but that requires a specific new announcement, and further details will be announced soon.

AmneziaVPN 5.0.0.5 is available for all supported platforms in the "Downloads" section of the website, but there are specific steps for each platform. Indeed, Windows users can install the .exe file, while Android users can download the APK from GitHub.

The VPN service recommends that Linux users follow the update guide. For macOS, users must uninstall previous versions of the VPN, while iOS users can update as usual via iOS.

Developing resilience

With this new update, Amnezia reaffirms its commitment to making the VPN highly resilient over the long term and making it immune to attacks by Russian authorities, which continue to grow increasingly sophisticated.

Indeed, in June the VPN suffered a massive coordinated cyberattack on its VPN infrastructure, allegedly carried out by the Russian media regulatory authority, Roskomnadzor (RKN), and which caused the system to shut down completely.

Despite this, Amnezia promptly released a fix, just a few days after the attack that, according to the VPN, made the infrastructure vulnerable to an attack that came from multiple fronts: from changes in approaches to restricting VPN traffic, searches for the VPN’s protocol signatures, DDoS attacks, phishing, and API scanning.

"Right now we can confirm that AmneziaWG’s developments continue; we have no intention of giving in to the difficulties," Mazay Banzaev, founder of Amnezia VPN, told TechRadar.

Following the attack, the VPN service also stated that it had restored 20 Premium server locations and compensated users affected by the cyberattacks, marking a return to normal service.

Imagine attending a peaceful demonstration, only to have hidden cameras scan your face, match your identity, and log your details into a police database within seconds. This scenario is at the heart of a debate that reignited in Italy last week, highlighting a high-stakes clash between public safety and personal privacy.

Although Italian lawmakers passed the bill on Tuesday with added safeguards, the decision reflects Europe’s expanding appetite for biometric monitoring. A practice Europeans once watched unfold with dread in authoritarian states is now quietly taking root at home.

From London and Paris to Amsterdam and Berlin, police forces across democratic Europe are increasingly piloting AI-powered face-scanning in public spaces and at political demonstrations.

While European leaders frame the technology as a necessary tool to combat crime, privacy advocates warn that facial recognition creates a chilling effect on the right to peaceful assembly and free expression. And the long-term risk may be even more troubling: once facial recognition is normalized, expanding its reach may be the next natural step.

How police in Europe use facial recognition at protests

Facial recognition technology (FRT) is a biometric tool that uses AI to identify individuals by analyzing their facial geometry — such as the distance between the eyes or the contour of the jawline — against a database. This software creates a unique digital signature, often called a "faceprint," which can be integrated directly into CCTV networks, drones, apps, and mobile police units.

Law enforcement deploys FRT in several ways, with Live Facial Recognition (LFR) being the most controversial. LFR scans real-time video feeds to cross-reference passersby against police watchlists almost instantaneously.

Despite significant legal pushback — including a landmark 2020 UK Court of Appeal ruling that found South Wales Police's deployment unlawful — London's Metropolitan Police deployed LFR across two major demonstrations last May.

Similarly, Hungarian authorities used biometric scanning to monitor participants during the 2025 Budapest Pride March.

By contrast, retrospective facial recognition (RFR) functions more like traditional fingerprinting. Rather than scanning crowds live, police analyze recorded footage or photographs after an event to identify suspects.

This is the technology Italian lawmakers attempted to regulate last week, though police forces across the UK, France, the Netherlands and other European nations have already routinely deployed it.

At first glance, RFR might appear less intrusive — simply another investigative tool for law enforcement to access when necessary. However, human rights experts argue the distinction is misleading.

According to Chloé Berthélémy, Senior Policy Advisor at European digital rights network EDRi, the difference between live and post-event scanning is "largely a procedural distinction."

Speaking to TechRadar, Berthélémy warned: "In human rights terms, there is no salient difference between real-time and post-remote biometric identification. Threats posed to rights and freedoms are not reduced just because authorities or companies have extra time to review footage."

Berthélémy also cautions against the rise of Algorithmic Video Surveillance (AVS) — a system she labels "fundamentally unreliable." AVS uses AI software to analyze live video feeds and automatically flag suspicious or dangerous behavior.

Unlike facial recognition, AVS doesn't log facial features. Instead, it is trained to detect behavioral anomalies and physical triggers, such as sudden crowd surges, unattended luggage, weapons, fires, or individuals falling.

The 2024 Paris Olympic Games served as a testing ground for this technology, making France the first EU member state to legalize AI video analytics.

What European law says about facial recognition and our right to privacy

While facial recognition technology poses a risk to personal privacy, explicit statutory frameworks governing its use remain scarce.

Despite nearly a decade of police trials, the UK still lacks specific legislation governing facial recognition — a gap that Jasleen Chaggar, Senior Legal and Policy Officer at Big Brother Watch, warns has created a "real legal vacuum."

Chaggar explained to TechRadar that British police forces instead rely on a patchwork of common law precedents, existing data protection acts, and broader human rights legislation.

Although the UN Human Rights Committee called on the UK to end police facial recognition at protests, Chaggar notes that governments have resisted statutory regulation, citing police "operational independence."

"This has effectively given police a very long leash to experiment with these technologies," Chaggar told TechRadar. "And now we're in a tipping point situation where it's about to be expanded all over the country, and there's a real necessity for those legal frameworks to be in place."

In contrast, the European Union's AI Act establishes a binding legislative framework across all member states. While offering greater legal clarity than the UK's approach, digital rights campaigners view the legislation as only a partial victory.

Dr. Matt Mahmoudi, campaign lead for Amnesty International's 'Ban the Scan' initiative, warns that failing to enact a total ban on public biometric surveillance creates broad national security exemptions that jeopardize fundamental rights.

"And it's not just the right to privacy. It's not just the right to protest and the freedom of assembly and expression. It's also the right to equality and non-discrimination," Mahmoudi told TechRadar.

The end of anonymous dissent?

Before facial recognition technology was deployed in public spaces, citizens attending demonstrations could rely on a degree of practical anonymity. Biometric surveillance fundamentally alters that expectation.

Digital rights experts interviewed by TechRadar agree that this level of intrusion steadily erodes civic space. The knowledge that your face is being scanned and cross-referenced against a police watchlist actively deters citizens from attending demonstrations.

“You may decide not to exercise your democratic rights because you're afraid of how it might be perceived by the authorities,” Big Brother Watch's Jasleen Chaggar explained.

Yet this chilling effect extends far beyond the physical cameras deployed at a single rally.

Facial recognition does not operate in isolation. It depends on extensive, often covert data harvesting. To construct watchlists, authorities aggregate imagery from diverse sources, including scraped social media profiles, government identity databases, police custody photos, CCTV archives, and commercial biometric databases.

As Amnesty International’s Dr. Matt Mahmoudi explains, extensive data aggregation transforms ordinary digital footprints into a pervasive surveillance dragnet.

"Facial recognition is not a simple technology, but a system that effectively weaponizes your entire daily life," Mahmoudi told TechRadar.

Beyond baseline privacy concerns, the underlying technology remains prone to systemic errors.

During eight pilot trials conducted by London's Metropolitan Police between 2016 and 2018, 96% of initial alerts generated were false positives.

Academic research and independent audits consistently show that these algorithmic inaccuracies disproportionately target non-white individuals, women, and ethnic minorities.

The human cost of these algorithmic errors was starkly shown in 2024, when Metropolitan Police officers stopped and searched Sean Thompson — a Black anti-knife-crime campaigner — after live facial recognition software falsely matched his face to a watchlist.

Although computer vision algorithms have advanced in recent years, privacy campaigners emphasize that inherent system limitations remain. As Big Brother Watch's Jasleen Chaggar highlights, because facial recognition relies on probabilistic matching — calculating similarity scores rather than absolute matches — the technology can never be entirely error-free.

Beyond faces: the evolution of biometric surveillance

Even as lawmakers scramble to regulate facial recognition, law enforcement's appetite for public surveillance continues to expand.

In the UK, the growth is reinforced by stricter protest laws like the 2023 Public Order Act, with police monitoring group Netpol warning that enforcement will inevitably rely on an increased use of live facial recognition during demonstrations.

The Conservatives are also calling for greater use of the technology to investigate crimes, while Devon and Cornwall police have already confirmed the use of FRT during the upcoming Boardmasters Festivals.

The obvious immediate danger is that eliminating anonymous dissent could permanently reshape democratic participation. However, privacy advocates warn of an even broader threat: biometric surveillance expanding beyond simple identification into behavioral classification.

Border control authorities are already experimenting with pairing facial recognition with emotion detection and gait analysis — the automated tracking of how an individual walks — which campaigners say could be used to target political demonstrations.

Amnesty International’s Dr. Matt Mahmoudi says that normalizing facial recognition paves the way for other speculative tools that could "fundamentally erode the presumption of innocence."

This rapid technological expansion forces a fundamental question upon democratic societies: how much liberty are citizens expected to trade for security? When scanning a crowd becomes routine policing, public squares risk morphing from spaces of free expression into arenas of perpetual surveillance — where a face is only the initial data point.

• Split VPN has been accused of breaching its no-log policies
• It allegedly leaked 58M connection logs, which SplitVPN denies as its own
• Users trusting a no-log policy is not enough

Russian SplitVPN (formerly NotVPN) has been accused of breaching its own no-log policy after a data leak exposed a MySQL database containing a variety of data linked to the service, including a staggering 58 million alleged connection logs.

While the VPN provider — whose service is widely used to bypass blocks in countries with heavy censorship — told TechRadar that any allegations it keeps logs are false, the incident highlights the limitations of no-logs policy when things go wrong.

Even with the best VPNs, no-log policies are often based on trust rather than verifiable safeguards, meaning they may not give users a clear picture of the risks users could face if their VPN were exposed to a breach — particularly in countries where criminal prosecution due to the illegal use of VPNs is real.

A no-logs VPN policy means a VPN pledges not to collect or share users' information, including search queries, websites visited, time spent on them, and downloads, while they are connected to one of its servers.

However, it remains difficult for users to verify these claims for themselves. That is why the most secure VPNs have their policies regularly audited by independent organisations, ensuring their privacy promises are genuine and not just a fabricated image.

SplitVPN's alleged data breach

On July 21, a threat actor on the Altenen cybercrime forum distributed a 17 GB SQL database claimed to have been stolen from SplitVPN and which allegedly contained a staggering amount of connection logs alongside user records, devices and payments.

The research team at Mysterium VPN analysed the database and claimed part of it (known as 'deviceproxy') indeed contained around 58 million connection logs.

Although this consisted of anonymised metadata indicating which device had connected to which server and at what time rather than complete browsing histories, SplitVPN maintains that it does not retain such data in accordance with its no-logs policy.

SplitVPN told TechRadar that while the leaked subscription metadata — including email addresses, users' countries of origin, subscription status, masked credit card information and device names — is authentic, the deviceproxy table instead is entirely fabricated.

"The third-party listing claims 58 million connection logs, but this is a fabrication added to inflate the price," a company spokesperson said.

"Because we do not generate or store device-server-timestamp mappings, any records claiming to show this are not from our infrastructure," they added. "The exposed data contains only basic account information, which fully aligns with our no-logs commitment."

SplitVPN added that immediately after discovering the breach, they changed all VPN server node IPs, rotated all access credentials and encryption keys, closed the vulnerability, and engaged external security specialists to audit their infrastructure. Operations have now returned to normal.

The lesser of two evils

While it is arguably nearly impossible to independently verify the deviceproxy data’s authenticity, both scenarios present users with fundamental issues.

If allegations are true, the existence of these logs would directly contradict Split VPN's no-logs policy. When cross-referenced with the IP address of the most recent connection and hardware identifiers, these logs could be sufficient to determine who connected, from where, to which server, and when, putting millions of users in areas with heavy censorship at serious risk.

If claims are fabricated, users are still forced to rely on conflicting statements that they cannot independently verify, with leaked official data potentially causing concern amongst users living in countries where VPN usage is banned.

To ensure your privacy is respected, always look for a privacy policy audit and additional security features including kill switches, double VPN servers, and post-quantum encryption. Advanced technologies such as RAM-only servers or advanced cryptographic privacy can really make a difference. Ultimately, words pass, but technical expertise remains —especially when it’s your data that’s under threat.

• Fortinet experts found malicious code in QuickFox VPN's Windows installer
• The attack actively avoided personal gaming computers
• QuickFox has since removed the malicious components from version 3.59.6

Cybersecurity researchers have uncovered a severe supply chain attack targeting QuickFox, a popular Chinese Windows VPN application.

According to a new report from Fortinet’s FortiGuard Labs, attackers trojanized the software's installers for over a year to quietly deploy malicious backdoor implants onto users' machines.

As Fortinet's experts explain, QuickFox "is a VPN proxy and game accelerator typically employed by Chinese users to speed up access to Chinese-based resources, often to improve video game user experience."

However, experts found that malicious actors altered the application's underlying code to deliver a highly targeted malware campaign. The threat actors modified an HTML file within the app's installer to automatically download and execute malicious JavaScript.

To avoid raising suspicion, this malicious code was pulled from a fake domain intentionally registered to mimic QuickFox’s legitimate infrastructure. Fortinet notes that the campaign had been active since at least August 2025, with QuickFox removing the malicious code with version 3.59.6.

TechRadar has not independently verified Fortinet's findings, but we have reached out to QuickFox for comment and will update this article if we receive a reply.

A highly targeted backdoor

The malware didn't infect everyone who downloaded the compromised VPN software. Instead, it used clever guardrails to filter out standard consumers.

If the malicious script detected Steam — the popular distribution service for online games — running on the victim's device, it immediately stopped the infection process to avoid personal gaming computers.

However, if it found tools used by developers, IT administrators, or cryptocurrency users, such as Visual Studio Code, Telegram, or various cryptocurrency wallets, it proceeded with the attack. This behavior suggests the hackers were explicitly hunting for high-value corporate environments and professionals rather than casual gamers.

When a target was deemed suitable, the script abused a legitimate Microsoft utility to secretly install the FDMTP implant and inject the malware. This persistent backdoor allowed attackers to collect sensitive system information, including IP addresses, active processes, MAC addresses, and usernames.

Because FDMTP is highly modular, it also enabled the hackers to remotely download and execute additional malicious plugins, granting them long-term access to compromised machines.

While macOS builds contained the modified file, the infection process only executed on Windows endpoints. Android and iOS apps were completely unaffected.

How to stay safe

While Fortinet researchers have not confidently attributed the attack to a specific group, they noted significant technical crossovers with Twill Typhoon, a known threat actor.

The good news is that the threat now appears to be contained. According to the cybersecurity firm, "QuickFox has removed the described malicious components from their Windows installer from v3.59.6," following responsible disclosure.

If you have used QuickFox on a Windows machine over the last year, you should immediately update to the latest version directly from the vendor and run a full antivirus scan on your system.

Organizations are also advised to check their networks for any unusual activity or unrecognized file transfers originating from QuickFox installations.

• On August 4, users in Russia reported widespread disruptions to 20+ VPNs
• The attack targets the IPs and entire subnets of major hosting providers
• On August 5, connectivity appeared to have been restored for some

Citizens attempting to bypass Russia's stringent digital censorship are facing fresh obstacles, as a new wave of aggressive government blockages has knocked numerous popular VPN services offline.

On August 4, users across the country reported severe connectivity issues, as reported by Meduza, a Russian independent news outlet. The restrictions appear to have affected more than 20 popular services, making it increasingly difficult for citizens to connect to an open internet.

If you rely on circumvention tools to access independent news, finding the best VPN apps that work in Russia is more crucial than ever. However, this latest blackout suggests the Russian state communications regulator, Roskomnadzor, is deploying more sophisticated methods to sever the country's digital lifelines.

These ongoing blockages are becoming a daily reality for citizens, proving that Russians need a VPN to access Google and Apple as unexplained nationwide outages hit core web infrastructure.

On his Telegram channel, Leonid Volkov, an executive at the Anti-Corruption Foundation (FBK), described the current offensive against independent services as "the largest in history," though the exact scale of the disruptions remains difficult to quantify.

A new era of internet censorship in Russia

The recent outages appear to involve broad, aggressive network restrictions.

According to Russian tech outlet SecurityLab, these new restrictions have targeted the IP addresses and entire subnets of major hosting providers, taking a blunt-force approach to network censorship.

Specifically, Volkov speculated on Telegram that Roskomnadzor’s enhanced blocking capabilities might stem from data harvesting. He suggested that domestic Russian applications, such as banking and marketplace apps, could be tracking users and feeding a massive database of IP addresses to state censors for targeted strikes.

This wave coincides with reports that Russia's Ministry of Digital Development (Mintsifry) is planning to tighten control over corporate VPNs.

Sources suggest the government wants to establish a continuous monitoring mechanism with hosting providers to quickly exclude disguised circumvention tools from a whitelist of permitted corporate IP addresses. This aligns with ongoing fears that Russia's solution to its VPN crackdown is a state-owned VPN.

Paper VPN is among the services publicly acknowledging connectivity issues, with some users reporting completely broken connections while others simply experience slower speeds.

In a post published on Wednesday (August 5), the company confirms that "the connection has been restored for most users."

Amnezia VPN — which recently strengthened its apps to fight Russia's new approach to VPN blocking — was caught up in the government's wider summer crackdown. The provider previously restored its premium service in Russia following a devastating state-sponsored cyberattack that lasted a month and a half.

Regarding the August 4 wave, however, the provider stated on its channels that its service is "working reliably" in Russia.

"Friends, over the past two days we have seen many reports of massive blockages of other VPNs. Not long ago this happened to us, but the new wave did not affect us," wrote Amnezia VPN, adding that the team is also currently testing a new "Greenland" location for bypassing whitelists.

TechRadar has reached out to the provider for further comment on the current situation. We will update this story as we learn more.

• Amnezia VPN and Civil Rights Defenders teamed up to protect free speech
• Journalists, activists can ask for free access to Amnezia Premium VPN
• NordVPN and Surfshark previously introduced similar initiatives

Amnezia VPN has partnered with independent non-profit organisation Civil Rights Defenders to provide free access to Amnezia Premium for journalists and activists.

It’s not the first time the anti-censorship VPN has helped the category. Indeed, Amenzia VPN previously partnered with NGOs to support more than 300 journalists and activists from countries with heavy censorship — including Venezuela, Turkey, Russia, and Myanmar.

We all love the best VPNs to hide our real location, prevent our internet provider and third-party marketing companies from tracking us, or to protect our data when we connect to public Wi-Fi networks.

However, as regulators and platforms tighten their grip on freedom of digital access and the freedom of online expression itself, professionals writing about censorship or human rights violations and digital rights require reliable digital tools more than ever — particularly when they are located in countries with heavy internet censorship.

"Through this program, we hope to reach even more people," Amnnezia said.

In the meantime, its free service Amnezia Free continues to serve 2.5 million monthly active users for free in heavily censored countries, as the VPN continues to strengthen its commitment to protecting digital freedom by recently unveiling new anti-censorship protocols.

How to apply for the Amnezia VPN and Civil Rights Defenders program

The program is open to independent professionals and media organisations covering topics including freedom of expression and digital security, or that live and work in countries subject to censorship, media restrictions or state surveillance.

It will provide annual subscriptions to Amnezia Premium service — which, during our testing, has delivered impressive unblocking and access to 20 global server locations — with the option to renew the subscription for longer periods. There is currently no deadline for applications, and the program is expected to remain in place for at least one year.

To apply, professionals can complete a form if they have an email address linked to a specific project. Alternatively, they can contact Civil Rights Defenders by sending a description of their work and some references to vpn@civilrightsdefenders.org. Signal contact is also available upon request. You can find all the information in this blog post.

Mazay Banzaev, founder of Amnezia, emphasised that journalists and human rights defenders' work is vital to society. "Supporting them is part of what we consider our mission," he said.

In this context, the partnership with Civil Rights Defenders is ideal, as the organisation operates in over 50 countries and provides a range of digital support and security services, including legal assistance, temporary relocation and digital protection measures to enable human rights defenders to continue their work.

"Civil Rights Defenders partners with human rights defenders in some of the world's most repressive environments to ensure that those who work for democratic rights and freedom of expression have the right tools to minimize risks imposed by isolationism and censorship," said Sofia Walan, Executive Director of Civil Rights Defenders.

The partnership adds to previous collaborations between other VPN firms and non-profit organisations, reflecting a growing awareness and desire for new initiatives aimed at combating digital threats.

Earlier this year, NordVPN partnered with Internews to boost digital protections for journalists and activists by directly integrating NordVPN’s security tools and 'Changemakers' training sessions into Internews' global digital security programmes.

Surfshark had also previously collaborated with the same organisation to provide fully funded Surfshark One subscriptions to 100 media outlets and civil society organisations operating in nine high-risk countries.

• Windscribe has released deGDID, a free tool that targets a hidden Windows identifier that VPNs cannot mask
• The identifier surfaced in a US court case where it helped trace a suspect's PC across VPNs and three countries
• Blocking the identifier can break Microsoft account features like Xbox, Outlook, and the Store

Windscribe has built a new tool that takes aim at a form of Windows tracking that even the best VPN cannot switch off.

The tool, called deGDID, targets a little-known Microsoft identifier called the Global Device Identifier, or GDID. It is a server-assigned code tied to a Windows installation.

The GDID burst into public view in July after it appeared in a US federal complaint against an alleged member of the Scattered Spider hacking group, where Microsoft gave investigators logs that correlated a Windows GDID with IP activity. Investigators traced the machine through VPN obfuscation across multiple countries over roughly eight months.

What Microsoft's GDID is, and why a VPN won't help

A Microsoft representative described the GDID in the complaint as a persistent, device-level identifier designed to uniquely identify an installation of Windows on a device.

It survives Windows updates but not a clean reinstall, which generates a fresh one. The privacy risk appears when that stable ID is tied to telemetry, Edge browsing data, Microsoft Store records, and IP addresses, letting Microsoft reconnect the same machine across sessions and services.

A virtual private network (VPN) protects your traffic by masking your IP address and encrypting your data. The GDID sits outside that tunnel, at the layer where Windows talks to Microsoft's cloud, so it ties every session together no matter which IP the traffic came from.

Switching to a local Windows account doesn't fix it either. Windscribe found its test machine still created a GDID even as a local account, and after manually deleting the value from the registry, it reappeared after a reboot.

How Windscribe's deGDID works, and how to use it

Windscribe's deGDID uses hosts file modifications and firewall rules to block the registration paths Windows uses to fetch a GDID, and wipes known local identity artifacts.

To run it, download the degdid.ps1 script from GitHub and run it in PowerShell with administrator rights. Use the -Status flag for a read-only check, or -Protect for the full block, verify, and wipe routine, with an -Unprotect option to reverse the changes.

The tool deliberately refuses to run on managed, domain-joined, or corporate machines.

This is not a clean opt-out. In hands-on testing, the script ran without errors, but then broke logins to Xbox, Outlook, and the Microsoft Store because the firewall rules also cut off the connectivity those services depend on.

Windscribe warns it may also affect OneDrive, passkeys, and Windows Hello, cannot guarantee it catches every GDID pathway, and does not erase records Microsoft already holds server-side.

For most people, this is just another reminder of what it means to be a Windows user, but if you want to inspect or reduce the identifier, deGDID is currently one of the only tools that tries. And if you want a more comprehensive solution, Windscribe suggests giving Linux a go.

Millions of VPN downloads on the Google Play Store are usually the ultimate stamp of approval. If 10 million people use an app, it must be well-maintained, technically secure, and backed by a legitimate business, right?

Unfortunately, our latest audit of Android VPNs shows that high download metrics and large app catalogs don't equal operational support, technical maintenance, or store compliance.

Most concerningly, we found that Google Play's automated submission checks are allowing multi-million-download apps and commercial app networks to circumvent certain developer website requirements.

Instead of real support portals, these developers are using blank domain placeholders, error pages, and ad monetization text files to game the system.

Broken infrastructure in 10M+ download "Super-Apps"

When you pay for one of the best VPNs, you get a dedicated corporate infrastructure, 24/7 support channels, and transparent legal documentation. But on Google Play, some of the top-ranking apps we audited are operating as ghost towns.

We identified 14 separate Android VPN apps with over 10 million downloads each that maintain non-existent, broken, or dummy website links. For example, both USA VPN - Get USA IP and VPN Indonesia - Indonesian IP direct users to tap2free.net, which is a completely blank page.

Other high-volume apps redirect to active server errors. AnonyTun directs users to an HTTP '403 forbidden' error. The link for v2RayTun simply times out, and examples like Fast VPN lead to "Invalid URL" messages.

Even when the sites load, they are often devoid of information. VPN 365 is one of several examples that display generic single-line welcome banners like "Welcome to facefaster.com!" with no other content. MTM Tunnel Lite links to an empty free Blogspot page containing a single post stating "there’s nothing here."

Most embarrassing of all is Armada VPN, which points to a blank white page that actually misspells the app’s own product name as "Aramda VPN".

Other major listings were also found to omit a website URL entirely on their official store pages.

More risk of hijacking

These missing and broken links indicate abandoned or completely unmaintained web assets, heightening the risk of quiet service degradation or future domain hijacking.

More importantly, it leaves millions of active users with no obvious or easy channels to seek technical support, report severe security vulnerabilities, or legally request account and data deletion.

It also prevents users from verifying company registration details or reading binding terms of service outside the application client.

The problem of multi-app developer rings

The broken links on individual apps are bad enough, but the audit also exposed massive "developer rings", single entities spinning up dozens of clone apps to flood the search results and trick Google's automated systems.

One of the most common ways these developer networks game the rules is through the "app-ads.txt" exploit.

App-ads.txt is a standard format websites use to manage their Google ads, and many sites host these files for free. Developers need only paste these raw monetization file links into their app store submission forms to satisfy Google's website requirement without having to build a real site.

This exploit is happening on an industrial scale. The developer account Karastm operates 39 VPN apps, and 35 of them link back to Google Play via a generic app-ads text file.

Another developer, helalik, operates 19 VPN apps, including seven with over 1 million downloads, that all point to a single adzonemax.site file. Similar ad-file exploits were found across several other networks of similar size.

When developer rings aren't using ad files, they use dummy blogs. The developer BanglaTach operates 26 VPN apps (including two with over 1 million downloads) that all point to naruto24.com, a generic, dummy WordPress template that contains no information about VPN services.

Networks like BD IT POINT (8 apps) point their store listings to empty blog feeds, removed accounts, or placeholder domains.

So what?

These multi-app networks create a dangerous illusion of software variety. They trick users into believing they are choosing between distinct, competing privacy providers, when they are actually downloading reskinned clone apps.

These white-label fleets share identical infrastructure, identical bugs, and identical data logging practices, all while successfully evading Google's operational transparency and support obligations.

Consumer advice & actionable insights

Because of the ways Google Play permits apps into its store, and the weaknesses in this, users must become their own security auditors to navigate the storefront safely.

Start by completely disregarding download metrics. You should treat high download totals merely as indicators of past distribution popularity, rather than proof of current security, technical maintenance, or legitimacy.

Before downloading, always click the developer's name on the app store listing to audit their portfolio. If you see them operating dozens of identical clone apps sharing generic names, avoid their software entirely.

Finally, pay close attention to the provided URLs. Do not download an app if its official store website link ends in an "/app-ads.txt" extension or points to a free blogging domain like Blogspot. Ultimately, legitimate privacy companies invest in and own their own web domains.

The bottom line

Our data shows that, currently, Google Play's app verification methods offer enough maneuverability for apps to use dead links, blank pages, and ad monetization files to register their apps in place of truly helpful information hubs for users.

Until automated store submission checks are replaced with genuine corporate verification, consumers should evaluate independent security audits and clear corporate domain ownership rather than assuming app store popularity reflects developer reliability.

When contacted about our findings, Google responded, saying: "We are looking into this. When made aware of an app that violates our policies, we will review the apps in question and take appropriate action."

We also contacted all the VPNs mentioned in this article for comment on the issues found. As of publishing, none have responded thus far though we will update with any responses as they arrive.

When you download an app from the Apple App Store or Google Play Store, you assume the environment is heavily moderated and entirely safe. Unfortunately, we recently completed an audit of mobile VPNs that reveals significant privacy and security risks.

Our evaluation identified apps on both app stores that put visitors at risk of unencrypted traffic, hidden redirects, and active scareware.

The best VPNs will invest heavily in bug bounties and secure, authenticated web infrastructure. But there are a significant number of mobile VPN apps that leave you exposed to phishing and malware before you even install the app.

Insecure protocols and obscured links

The biggest concern we found surrounds encryption enforcement. We found that 339 Android links (5.3%) and 188 iOS links (6.8%) use plain, unencrypted HTTP instead of secure HTTPS. This includes massively popular apps like Oryx VPN (which boasts over 1 million downloads) and Stealth Shield VPN.

So what?

Clicking a plain HTTP link allows network eavesdroppers or man-in-the-middle (MitM) attackers to intercept, manipulate, or inject malicious content into the traffic between you and the developer's site.

But the security holes don't stop at missing encryption. The audit uncovered several other severely obscured URL formats being approved, such as:

• URL Shorteners: Multiple store listings rely on shorteners like shorturl.at and the Yandex-based clck.ru. This deliberately conceals the final destination domain, making it impossible for users or automated URL security scanners to evaluate link safety prior to clicking.
• Raw IP Addresses: Some listings use raw numerical IP addresses instead of domain names. This bypasses domain-based web filtering, SSL certificate validation, and public DNS reputation systems, effectively making connection security impossible to verify.
• Direct PDF Links: We found privacy policies pointing directly to downloadable PDF files (13 on iOS, 1 on Android). PDF documents can execute embedded JavaScript, trigger automated local file downloads, or easily exploit PDF reader vulnerabilities on your device.

Active threats: scareware and malicious redirects

The most alarming discovery is that clicking a link on an official Apple or Google store page can lead to active cyber threats.

When developers abandon their apps, their official web domains often expire. It seems that actors are actively purchasing these expired domains specifically to exploit the existing app store traffic. In fact, our audit verified multiple active store listings containing domains that now host fake antivirus popups and ad redirects.

Users who trust these official app store links are tricked into viewing fake security warnings. These scareware popups are explicitly designed to coerce panicked users into downloading genuine malware to "fix" a fabricated virus.

In other instances, store links point to totally irrelevant and unvetted environments. Official links were found pointing to deleted Twitter handles, empty Facebook and Instagram pages, payment portals like Cashpay Iraq, and even Chinese opera sites.

Directing users to external messaging platforms like Telegram or abandoned social accounts bypasses web security standards entirely, exposing users to unmoderated third-party chat environments and severe impersonation risks.

How to protect yourself

Its important that, regardless of inbuilt measures, consumers take matters into their own hands to some extent to navigate these listings safely. Always inspect link targets closely before blindly tapping on a developer website.

You should verify that the destination uses a secure HTTPS connection, and remain on high alert for obscured formats like raw numerical IP addresses or randomized link shorteners that conceal the true domain.

Furthermore, you should actively decline unexpected PDF downloads. Avoid opening direct PDF links from store pages, as these files may contain embedded JavaScript or exploit reader vulnerabilities. If tapping a privacy policy suddenly prompts an automatic file execution or download, block it immediately.

Finally, if an official app store link leads to a virus warning or requests system scanning permissions, recognize that it is a fabricated scareware scam designed to coerce you into downloading malware. Do not click anything on the page; close your browser tabs immediately to protect your device.

The bottom line

Gaps in outbound link verification across the App Store and Google Play Store mean active security threats and unencrypted traffic can still slip onto mobile VPN product pages.

When we approached Apple and Google on our findings, Apple declined to comment on the record. Instead, we were pointed towards its safety guidelines and app review processes. A Google Spokesperson did comment, saying, "We are looking into this. When made aware of an app that violates our policies, we will review the apps in question and take appropriate action."

We also reached out to both Oryx VPN and Stealth Shield VPN, neither of which has returned to us with a response at the time of publication.

Ultimately, the lesson is that you must apply the same strict web security precautions inside official app stores as you would when navigating the open web.

When Paul Moore heard the European Commission President saying that the EU age verification app will “give children a safer start online,” he was unconvinced.

"Bypassing the latest EU age verification app (2026.07-1) with a Chrome extension," he later posted on X. And it wasn’t the first time.

With over 20 years of experience under his belt, Moore managed to bypass the app back in April, right after the Commission first launched it. Combined, his experiences have led him to a straightforward conclusion: "anonymous age verification doesn't work."

While the process he used to bypass the verification system doesn’t undermine people’s privacy, Moore believes the long-term impact of its ineffectiveness will.

"All it is an escalation path being drip-fed, bit by bit under the guise of child safety," Moore told TechRadar. It won’t just be about proving your age. "The next step will be proving who you are," he said.

The EU’s 'privacy-preserving' approach

Most of the current age verification methods, which require scanning national ID documents or biometrics, put people's sensitive data at risk. (Think, for example, of the data breach that affected Discord’s age verification provider and exposed 70,000 people's government IDs and personal data last year.)

For that reason, there's a growing sense of urgency to find a solution that helps people prove their age without collecting sensitive information. And the European Commission argues that it has found it.

Drawing on the framework of the COVID-19 certificate app, the Commission came up with a template for a privacy-first, open-source tool that EU member states can use to build their own national apps.

The process — which is part of the bigger European Digital Identity Wallet (EUDI) project — leverages zero-knowledge proofs (ZKPs) and verifiable credentials (VCs) to verify someone's age without sharing sensitive information.

In other words, your phone scans your ID and stores that data locally. Websites will then ask users to scan a QR code via the app to prove they are old enough to access certain content.

A European Commission spokesperson told TechRadar that online services won't receive any personal information about the users, saying: "The age proof simply confirms whether the user meets the age requirement."

Moore doesn’t dispute the privacy credentials of the process. Perhaps worse, he just doesn’t think it will work.

Why the EU age verification doesn't work

While the EU age verification blueprint sounds like a welcome improvement compared to the current approach, the advantages don't hold up.

That's because Moore says age checks have to be tied to a person’s identity to be trustworthy. "The second you strip the identity away from how old somebody is, a person can't answer that question," he said.

Since the April launch, the tool's security credentials have even been improved, but Moore says the issue isn’t a bug but the entire process, criticising the latest efforts as mere "security theater."

How Moore bypassed the app

Bypassing the app wasn't difficult. In fact, Moore says he built two Chrome extensions on Claude in minutes.

The first extension he built replicated the Android app, but with the ID checks removed. This meant he could skip the need for a user to scan a document entirely.

"It detects the QR code automatically (when presented by a website) and passes verification," Moore explains, adding that the process is entirely automated with no need to interact with the Chrome extension once installed."

This week, Moore went further and built a Chrome extension that can capture the QR code from a website and automatically forward it to a remote, automated phone to get a genuine signature in seconds.

Known as an 'automated relay bypass,' these attacks mean nothing in the process is faked, making prevention almost impossible.

"Even after they enable all other protection mechanisms, both will continue to work," Moore said.

The EU’s response

When asked whether any steps were taken to prevent circumvention, a European Commission spokesperson said: "We of course rely also on parents and caretakers to check what children are doing online," adding that the app's goal is "avoiding the unintended exposure of kids to inappropriate content."

Yet, according to Moore, lawmakers' focus is misdirected. He said: "What [lawmakers] are missing is that the threat actor isn't a third party; the threat actor is the user.

"They don't want age verification in the first place, so they are going to look for ways to bypass the system. And if the system can be bypassed by design, they will do it."

Deciding not to impose a new law or technology simply because it could be bypassed is unlikely to convince lawmakers. But the problem may extend beyond an ineffective system.

In fact, Moore fears that the app's inevitable ineffectiveness could push lawmakers to turn to more invasive checks and an erosion of people's privacy.

Next step? Our identity

When Moore says the concept is broken, he is calling out what he sees as a fundamental flaw in the EU age verification framework's design: client-side trust.

The app is more privacy-preserving than passports and face scans because the data won’t leave the user’s device. But this may be exactly why its implementation is bound to fail. If nothing leaves the device, Moore explains, there is no way to trust or verify what has been obtained.

This creates a problematic catch-22 for European lawmakers. When this ‘anonymous’ app fails to keep kids off restricted sites, Moore contends that Brussels is unlikely to simply give up on its flagship safety initiative and drop privacy-preserving practices altogether.

"For them to push ahead with it under the guise of child safety is an escalation path to say we've tried this; the natural route is now you've got to prove your identity," Moore told TechRadar.

It’s clear that age verification is here to stay, despite continuous outcry coming from privacy advocates, technologists, and data scientists who warn it may do more harm than good.

For Moore, the danger is that what’s marketed as a privacy-first breakthrough today may ultimately be used to undermine privacy tomorrow.

A VPN isn't a silver bullet. It can’t guarantee total security or anonymity online. Instead, it is a tool that allows you to hide your browsing data from your internet service provider (ISP), adopt a virtual IP address, and access geo-restricted content.

However, there are still a lot of misconceptions about what a VPN can and cannot do — a problem made worse by the exaggerated marketing claims pushed by some VPN companies.

Given that, it’s unsurprising that when we analyzed nearly 30,000 Google Play Store reviews of our four top-rated VPNs, a clear trend emerged: a lot of people aren’t getting the privacy and security protection they thought they were paying for.

In part, this stems from users misunderstanding what a VPN does. But it also shows that the industry needs to do a better job of setting realistic expectations.

On the whole, people are satisfied with their VPNs. Across our full dataset, just 35% of overall comments were negative. However, when we isolated feedback related to privacy and security, the proportion of negative comments rose to 41%.

This article is the second in a series investigating the real-world experience of using major VPN services, driven by our exclusive analysis of Android VPN reviews. The first article examined billing and pricing issues.

Lab-tested security vs Play Store reality

Proton VPN received the highest proportion of positive comments regarding privacy and security, with 68% of its feedback on the topic being positive.

That's significantly higher than Surfshark, which recorded a positive sentiment rate of just 31%. ExpressVPN (54%) and NordVPN (34%) sat in between.

It's worth noting, however, that all four services offer essentially equivalent protection and are among the most secure VPNs available. They all feature advanced encryption and proprietary protocols, and have been audited by third parties to confirm their security credentials.

So what’s causing the disconnect between our lab tests and real-world user experience? It seems that for many, it stems from several myths about what a VPN can actually protect you from.

Myth #1: A VPN stops every 'hacker'

When analyzing the Play Store reviews, we noticed that a significant number of people were concerned about the threat of hackers. And for obvious reasons — people lose money, privacy, and their health to malicious actors online every day.

Unfortunately, a VPN can't help in every scenario, and that seems to have left many disappointed.

One Proton VPN reviewer, for example, alleges it is the “worst app ever” because they had “been hacked by someone else while using this VPN.” Meanwhile, a NordVPN comment says that “hackers” had “managed to set up a way of getting passed [sic] the VPN on all my devices.” Another simply says: “got hacked the second day, don’t trust.”

However, others proudly claim that their VPN “protects my identity from hackers.”

Like most things, the reality is somewhere in the middle. While a VPN protects your data in transit (encrypting the data between your device and the server you’re connecting to), it does nothing to protect data you’ve already handed over to a third party — like an email address or password stored on an external database.

A standard VPN also won't stop you from falling victim to phishing scams, where an attacker tricks you into voluntarily entering your credentials on a fake website. However, VPN companies are increasingly releasing products to help prevent this.

If you're looking for more details on what a VPN can and can't do, check out the cheat sheet at the end of this article.

Myth #2: A VPN offers bulletproof protection

In our tests, these VPNs have never leaked an IP address. That would be a big deal. Yet across Play Store reviews, a surprising number of people report that their VPN appeared to fail.

One NordVPN reviewer said the app “did not hide my IP address from being tracked,” while a comment about Surfshark claimed it “failed to hide my IP address at least twice in the first 3 weeks.” Another noted that their VPN “leaks IP after some time [...] giving you a wrong sense of privacy and security.”

It’s impossible to diagnose the specific issues at play without more context. However, true encryption failures are extremely rare, particularly among well-regarded providers.

In reality, most reported leaks stem from configuration errors (like not having the kill switch enabled), browser tracking or basic steup errors. To make sure your connection isn't dropping data, always enable your app's kill switch and verify your real IP address is hidden using a diagnostic tool like Cloudflare's trace page.

If you’ve checked your settings and still suspect your VPN is genuinely leaking your IP address, leave a comment below and our team will see if we can help troubleshoot it.

Myth #3: A VPN equals total anonymity

Exaggerated marketing claims around online privacy seem to have influenced reviewers throughout the data. Some accuse providers of betraying them, writing reviews like "do not trust this app for privacy," while others complain about the amount of telemetry data collected by the apps themselves.

However, these reviews highlight an uncomfortable truth: masking your IP address only goes so far. Cookies, browser fingerprints, device information, language settings, and SIM card regions are all routinely logged, analyzed, and leveraged by advertisers and platforms to track your identity regardless of your IP.

A VPN is an important first step in improving your privacy, but if you continue to use services that monitor your every move, it’s not enough on its own. Check your browser, the services you use and you might find that there are other factors at play revealing your identity.

‘Not a catch-all’ — VPN providers' defense

We reached out to each of the VPN companies mentioned in this report for comment.

Proton VPN, NordVPN, and Surfshark all acknowledged that a VPN is not a catch-all solution for every digital threat. Instead, they highlighted additional security features they offer and noted that many reported issues stem from configuration errors and non-IP tracking rather than a failure of the VPN.

ExpressVPN did not respond to our request for comment.

Proton VPN highlighted its NetShield feature, which blocks ads, trackers, and malware domains. Addressing leak complaints, the company explained that genuine tunnel traffic does not leak, and that reported issues typically occur when split tunneling, connection dropouts, or browser extensions leave specific traffic outside the encrypted connection.

Surfshark pointed to its Web Content Blocker — which it says blocked nearly 1.2 million phishing and malware sites in the past month — and its Alternative ID tool, which generates email aliases to protect contact details.

Meanwhile, NordVPN, which said that it "does not advertise complete immunity," highlighted its next-gen antivirus and credential leak monitoring tools. It added that perceived IP leaks are frequently down to device configuration rather than an IP exposure.

Combined, it's clear that leading VPN companies are developing more comprehensive and effective cybersecurity products to accompany the core VPN technology. However, if the limitations — as well as the benefits — of these additional tools aren't communicated clearly, the industry risks creating the same expectation gap it appears to face with its core technology.

What a VPN can and can't do — A cheat sheet

A VPN can:

• Encrypt your browsing traffic: Shield your internet activity from your Internet Service Provider (ISP), network manager, or public Wi-Fi admin.
• Spoof your location: Replace your real IP address with one in another location, making it harder for sites to track your physical whereabouts and help you access geo-restricted content.
• Bypass local network blocks: Circumvent restrictions imposed by Wi-Fi administrators, government censors, and geo-fenced content.
• Prevent bandwidth throttling: Stop ISPs from slowing down your speeds when they detect specific activities like streaming or torrenting.
• Secure DNS requests: Direct web address lookups through private, encrypted DNS servers to prevent ISP-level logging and DNS leaks.
• Protect your IP address against DDoS attacks and IP tracking by hiding your actual home IP address during gaming or P2P connections.

A VPN can't:

• Protect the data you share: It can't stop companies from collecting data you submit directly or protect that data if those companies suffer a breach.
• Prevent phishing: It can't stop you from falling for phishing, text, or phone scams, although many providers now offer tools that help on top of the VPN.
• Make you completely anonymous: Web cookies, browser fingerprinting, and account logins can still track your identity online regardless of your IP address.
• Block hardware-delivered malware: It offers no protection against threats introduced directly to your device via physical hardware (like infected USB drives).
• Protect against digital forensics: It cannot shield files or logs stored directly on your physical device if it is accessed with forensic tools.
• Remove existing infections: It cannot retroactively clean malware or spyware already installed on your system.
• Stop OS-level zero-day attacks: It can't stop sophisticated, nation-state spyware that exploits underlying vulnerabilities in your device's operating system.

Methodology

We collected almost 30,000 user reviews published on Google Play Store since the beginning of the year for the four VPN providers featured in this report using the google_play_scraper library.

As individual reviews often address multiple topics (e.g. streaming and security), we broke reviews down into sentence-level units. This expanded our analysis to over 47,000 entries, with individual entries permitted to sit across multiple categories when suitable.

Each sentence was assigned to specific categories using regex keyword filtering, and analyzed for sentiment using a pre-trained BERT model that took into account the user’s star rating.

While all machine learning sentiment pipelines carry a minor margin of error, every VPN provider was subjected to the exact same pipeline to ensure consistency and fair comparison. Human review was also conducted throughout.

Data processing scripts were developed in Python with AI assistance, and all final outputs were manually reviewed.

If you think downloading a VPN directly from an official app store guarantees your digital privacy, it’s time to think again.

We recently undertook a huge audit of storefront verification standards, which has exposed a severe lack of quality control across both the iOS App Store and Google Play.

We evaluated developer transparency and store verification standards, analyzing 3,392 Android VPN apps (with more than 1,000 downloads) and 1,387 iOS VPN apps (with at least one review).

It appears that Google Play looks significantly worse than Apple's App Store across almost every transparency and validity metric. In fact, a mere 61.4% (851) of iOS apps passed all main validity checks, while Android trailed far behind with just 40.8% (1,210) passing the same tests.

Just because a VPN is available on an official App Store doesn’t mean it’s legitimate. Here is what the data tells us about the safety of mobile VPNs.

Storefront Enforcement & Quality Control Data

When you hand over your web traffic to a VPN, you expect the developer to be a real, registered business. However, storefront enforcement data proves that thousands of these apps lack even the most basic corporate infrastructure.

When it comes to maintaining a valid developer website, Apple leads the pack. Our data shows that 82.7% (1,147) of iOS apps maintain a valid developer website. In contrast, only 52.2% (1,774) of total Android apps manage to do the same (which equals 59.8% of the Android apps that actually bothered to list a URL).

But the problem goes deeper than broken links. 46.9% of valid Android websites (832) and 47.5% of total Android privacy policies (1,612) rely entirely on free third-party domains like Google Sites, GitHub, and Blogger.

In total, more than 1,200 Android developer website or privacy policy links pointed directly to free Google pages. Apple performs better here, but isn't immune; 15.6% of iOS websites (179) and 18.3% of iOS privacy policies (217) still rely on these free hosts.

So What?

Relying on free platforms like Blogger or Google Sites signals a complete lack of dedicated corporate infrastructure and financial investment. If a developer isn't willing to spend a few dollars on a custom domain, how can you trust them to invest in secure AES-256 encryption or server maintenance?

Worse, if that free third-party account is suspended or abandoned by the host, developer support and privacy documentation vanish instantly.

The platform differences are equally stark when it comes to developer contact requirements. Google Play mandates that developers display an email address, but 65.1% of Android apps (2,208) use free, public domain services like @gmail.com or @yahoo.com.

Meanwhile, iOS does not require developers to display an email address at all, and it is present on only 16.2% of iOS VPNs (225 apps).

Allowing developers to omit contact emails lets operators remain entirely anonymous. This prevents users from exercising fundamental privacy rights, such as GDPR data access or deletion requests.

It strongly indicates that the "company" is an individual or transient entity rather than a registered business, making legal accountability and data privacy enforcement virtually impossible.

Privacy Policy Misrepresentation & Boilerplate Networks

A VPN is only as trustworthy as its privacy policy. Premium providers like ExpressVPN and NordVPN undergo regular independent audits to verify their no-logs claims. By contrast, our audit revealed that hundreds of mobile VPNs use completely meaningless, generic, or copied text to masquerade as legitimate services.

In one example, we found 13 iOS apps sharing identical boilerplate text containing unedited template placeholders. Because the developers didn't even bother to read their own legal documents, the text still reads: "If you have questions about this Privacy Policy, contact us at support@example.com." You can view one of these identical unedited policies here.

These unedited templates contain zero binding commitments regarding VPN-specific practices, such as traffic logging, IP tracking, or bandwidth monitoring. Users are misled into assuming they are protected when, in reality, no legal policy actually exists.

Furthermore, a massive portion of these apps rely on automated "policy generator farms", sites that bulk-host generic privacy documents. The audit discovered:

• 48 Android apps hosting policies on projeto10.top
• 40 apps using freeprivacypolicy.com
• 19 apps using termsfeed.com

Automated policy generators often attach legal disclaimers stating they do not guarantee accuracy. Furthermore, the host platform can alter or remove the page without the developer's knowledge, leaving users without valid privacy terms.

Perhaps the most absurd discovery belongs to Sigma VPN, an Android app with over 100,000 downloads. Its listed privacy policy isn't a policy at all. Instead, it links directly to a copied Wix support article on how to create a privacy policy.

Even when policies are unique, they are often too short to mean anything. The audit found that 2.3% of valid Android policies (72) and 6.6% of valid iOS policies (78) contain 250 words or fewer. Highly truncated policies like these lack necessary legal disclosures regarding logging, third-party data sharing, jurisdiction, and data retention windows.

Consumer Advice & Actionable Insights

So, how do you navigate app stores safely without downloading a dud, or worse, a data-harvesting nightmare? Here is our actionable checklist to protect yourself before hitting 'Download'.

• Domain Verification: Always check that the provider operates an independent, custom web domain matching the product name, rather than a free sub-domain on Blogger or Google Sites. If they don't own their own website, they shouldn't own your web traffic.
• Policy Audit Checklist: Don't just trust the word "Privacy Policy." Open the link and search the text for generic email placeholders (like support@example.com), generator footers, or broad non-VPN terms. Confirm that the policy explicitly commits to no connection or activity logging.
• Contact Testing: Test the developer's contact channels before subscribing. Send a quick email to verify that support responsiveness and account deletion mechanisms actually exist.

The Bottom Line

Google Play's link verification method lets hundreds of apps operate using temporary blogs, blank pages, and automated generator sites. While Apple does a better job of enforcing valid web links, its main flaw is that it permits total anonymity for developers, leaving users with no way to hold iOS developers accountable legally.

In response to our investigation, Apple declined to comment on the record, pointing instead to its safety guidelines and app review processes. Meanwhile, a Google spokesperson said: “We are looking into this. When made aware of an app that violates our policies, we will review the apps in question and take appropriate action."

The final takeaway is a crucial lesson in modern cybersecurity: store listing approval reflects compliance with basic submission forms, not operational legitimacy or privacy protection. Always do your own research before trusting a mobile VPN with your personal data.

The VPN industry has a problem. For a significant number of people, their VPN subscription has quietly auto-renewed, jumped in price, or cost more than they initially bargained for.

The issue is so bad that multiple VPN providers — including ExpressVPN, NordVPN and Surfshark — have faced legal scrutiny over their auto-renewal practices.

This creates a dilemma for us at TechRadar when it comes to recommending VPNs. We are confident these are the best VPNs available — they are the fastest, most secure, and best at streaming — but it's clear that more needs to be done to ensure fair and transparent billing.

To get a better understanding of people's real-world experience using our top-rated VPNs, we analyzed almost 30,000 Android VPN reviews across the 'Big 4' — NordVPN, ExpressVPN, Surfshark & Proton VPN — published on the Play Store since the beginning of the year.

The results are stark. Across the entire Play Store dataset, people are mostly happy with the apps — just 35% of overall written comments are negative. But when we looked at billing and pricing specifically, that figure rose to almost 60%.

Read on to find out which provider performed the best, which you might want to be wary of, and the key practical steps to avoid common VPN issues.

This article is the first in a series investigating real-world customer experience of using major VPN services, inspired by our exclusive analysis of user-generated Android VPN reviews.

Which VPN has the most positive reviews?

The vast majority of written Android reviews offer little insight into how people really feel. There are thousands of generic entries like "top app," "good," "ok," or "bad."

However, once we filtered out the noise, billing and pricing issues emerged as a significant area of frustration, accounting for almost 30% of all categorized feedback.

Because total review counts varied widely between brands, we compared percentages rather than raw numbers. Attitudes were scored using a machine-learning model supported by manual human checks.

Read more about our methodology here.

When it comes to billing and price satisfaction, Proton VPN is the clear winner. Just 35% of billing-related comments were negative. However, that’s in large part because of the free tier it offers.

In fact, if you remove references to the product being 'free,' the rate of negative comments rises to 57%. While that points to significant underlying friction for paid accounts, it’s still better than the rest.

By contrast, the remaining market leaders face significant dissatisfaction:

• NordVPN: 83% negative billing sentiment
• ExpressVPN: 79% negative billing sentiment
• Surfshark: 71% negative billing sentiment

It wasn’t all bad news, though. There was some positive feedback, with one user praising Surfshark for its "outstanding value for money" and another calling NordVPN the "best affordable" VPN. But for the majority of reviewers, issues around free trials, auto-renewals and price hikes dominated.

Of course, all written reviews skew towards negative emotions as consumers seek to fix or change something. However, taken together they demonstrate a comprehensive picture with clear issues at play.

Free trials, auto-renewals, and price hikes

Across all of the reviews analyzed, three distinct issues appeared.

Firstly, it’s clear many people are experiencing issues with free trials. Specifically, people are signing up only to find themselves charged automatically.

As one Surfshark user wrote: “Wanted to try using the free trial, [it] didn’t work and still charged me for a month.” Meanwhile, a NordVPN user reported not being able to “cancel my free trial just days in.”

Another source of friction occurs when automatic renewals are triggered. And it impacts all of the providers mentioned. As one Proton VPN reviewer wrote: "A lot of users would appreciate more transparency before renewals happen.”

Closely related to the automated renewals are the price hikes that are associated with them. Even if you sign up for a certain price for a year, VPN providers often use more expensive rates at the point of renewing a user’s subscription.

One ExpressVPN user wrote: "Of course every time they renewed my subscription they used old prices and never told me about it.” Meanwhile, a Surfshark reviewer put it even more succinctly for others: “Beware of subscription auto renewal.”

VPN auto-renewal costs

Comparing the prices of 1-year VPN plans across the 'big four' initially and after renewal

NordVPN

Initial cost

53.88

Renewal cost

139.08

Surfshark

Initial cost

50.85

Renewal cost

79

ExpressVPN

Initial cost

74.85

Renewal cost

99.95

Proton VPN

Initial cost

47.88

Renewal cost

83.88

037.575112.5150

USD

Group 1 Data

Product	Initial cost (USD)	Renewal cost (USD)
NordVPN	53.88	139.08
Surfshark	50.85	79
ExpressVPN	74.85	99.95
Proton VPN	47.88	83.88

How to avoid VPN auto-renewal traps and surprise charges

It's clear that major VPN providers need to do more to ensure fair and transparent pricing and billing. Thankfully, there are also a number of steps you can take to make sure you're not unnecessarily impacted.

To avoid the billing and pricing issues referenced here:

• Turn off auto-renewal immediately after signing up: Navigate straight to your account dashboard after subscribing and turn off auto-renew.
• Prepare for the ‘early billing’ window: Many VPN providers trigger automatic renewal charges 7 to 14 days before your subscription technically expires. Set calendar reminders two weeks before your renewal date so you aren't caught off guard.
• Keep an eye on your inbox: VPN providers will contact you to warn you about the auto-renewal and are likely to send you an email about extending your discounted rate around 60 days ahead of your contract expiring.
• Always request an official cancellation first: Submit an explicit cancellation request through the provider's official account portal or support chat.
• Check refund terms: Many ‘free trials’ require upfront payment details and automatically convert into full recurring plans. Read the fine print before providing billing information, and remember that 30-day money-back guarantees often only apply to first-time purchases and are void during certain promotional offers.

What did the VPN companies say?

We contacted each VPN provider for comment on our findings.

Representatives from NordVPN, Surfshark and ExpressVPN highlighted their strong overall Google Play ratings and stressed that user feedback informs ongoing app development.

ExpressVPN added that subscriptions bought via Google Play are subject to Google’s payment and refund policies, but noted its focus is on making the experience "easier to understand, manage, and resolve when customers need help."

A NordVPN spokesperson argued that its premium pricing reflects ongoing infrastructure investment, but pointed out that because the app is free to download, "some users expect the service itself to be free as well," which can drive down review scores when users discover it is a paid product.

A Surfshark spokesperson acknowledged that "public reviews naturally tend to overrepresent moments of friction" but said its current approach is "resonating positively with users" overall.

Meanwhile, Proton VPN emphasized that its paid subscriptions fund an unlimited, ad-free tier for all users, adding that it "clearly states its pricing structure, upfront costs, and terms of renewal" without using tiered feature paywalls or surprise price increases.

Methodology

We collected almost 30,000 user reviews published on Google Play Store since the beginning of the year for the four VPN providers featured in this report using the google_play_scraper library.

As individual reviews often address multiple topics (e.g. streaming and security), we broke reviews down into sentence-level units. This expanded our analysis to over 47,000 entries, with reviews permitted to sit across multiple categories when required.

Each sentence was assigned to specific categories using regex keyword filtering, and analyzed for sentiment using a pre-trained BERT model that took into account the user’s star rating.

While all machine learning sentiment pipelines carry a margin of error, every VPN provider was subjected to the exact same pipeline to ensure consistency and fair comparison. Human review was also conducted throughout.

Data processing scripts were developed in Python with assistance from an LLM, and all outputs were manually reviewed.

• Recorded Future found an Iran-linked group spreading spyware
• The malware is delivered through fake VPN and media player apps
• Researchers assess that most targets are Iranian users

A new report from Recorded Future's Insikt Group describes a campaign that inverts the whole point of a privacy tool: fake VPN apps built specifically to spy on the people who install them.

Researchers have linked fresh infrastructure to an Iran-nexus threat cluster they track as TAG-182, which is using fake VPN and media player downloads to allegedly deliver a surveillance tool called MarkiRAT. The group is "highly likely" to be targeting Iranians living inside and outside the country, the report says.

It's a blunt reminder that choosing one of the best VPN services is a lot more secure than downloading free, unvetted tools.

Fake apps, real surveillance

Insikt Group identified a cluster of attacker-controlled domains allegedly used to stage downloads of applications that appear nowhere on Google Play or Apple's App Store.

Two names stand out: Pis2ray VPN and a media player branded YESHICA, which was quietly renamed YESHICA YEPlayer in March 2026 after researchers publicly exposed the original.

According to researchers, if you download and run one of these files, you get MarkiRAT, a remote access Trojan. In plain terms, that is software that hands control of your device to somebody else.

Analysts have documented it capturing screenshots and uploading them to attacker-run servers, while disguising itself under believable process names.

It also abuses BITS, the background service Windows uses to fetch updates, to pull down further files. Because that activity looks like ordinary system housekeeping rather than an attack, it tends to slip past routine cleanup.

MarkiRAT is not new. It has previously been used by Ferocious Kitten, a group Kaspersky documented conducting years of covert surveillance against activists inside Iran.

Recorded Future stops short of attributing TAG-182 to any specific Iranian agency, but places it within a broader ecosystem of state-aligned surveillance groups.

Why a fake VPN makes such an effective lure

Distribution runs largely through social media. Insikt Group found Instagram posts promoting Pis2ray VPN in the weeks following street protests in Iran in late 2025, and again around the country's prolonged internet shutdown, which ended with partial restoration of access on 26 May 2026.

The people most desperate for a virtual private network (VPN) in a censored country are exactly the people most likely to install one from a social media link, because the official stores are often the very thing they cannot reach.

Recorded Future considers it almost certain that most targets are located in Iran or tied to anti-government movements in Europe and North America. TechRadar has covered previous Iran-linked fake VPN campaigns, and this one seems to follow the same pattern with better infrastructure.

How to stay safe

Most readers will never be targeted by a state actor, but the underlying lesson travels.

Install VPN apps only from official stores, and check that the provider has a real, verifiable presence outside the app listing.

Treat any VPN promoted through an Instagram post, a Telegram channel, or a direct message as suspect, however polished it looks.

Star ratings are a weak signal, since fake reviews are cheap.

• Windscribe said Bill C-22 won't change its privacy policies
• The bill would require service providers to retain user metadata
• Canada's Senate is set to discuss Bill C-22 in September

A Reddit user recently put a blunt question to Windscribe: is paying for a Canada-based VPN a privacy problem, given the surveillance bill working its way through Parliament?

The company's official support account answered without hedging. Windscribe will keep operating exactly as it has, the account said, with "no changes to our logging or privacy policies".

Canada is bringing in laws that genuinely complicate things for the company, Windscribe added, but that is internal work to sort out rather than something subscribers should expect to feel.

It's a calmer message than the one Windscribe was broadcasting in May, when it said it would sooner relocate its headquarters than start logging users. That put it alongside Signal and NordVPN, and made it one of the sharpest voices among the best VPN providers fighting the bill.

Bill C-22, formally the Lawful Access Act, cleared the House of Commons on June 18 and now sits with the Senate, which won't begin its study until Parliament returns in September.

Windscribe and Bill C-22: what the VPN provider said

Pressed further in the thread, Windscribe drew a line between where the company is registered and where its infrastructure lives.

The incoming laws could see it served with a court order requiring it to start logging users, the support account acknowledged. Its answer is jurisdictional: a virtual private network (VPN) operating outside Canada doesn't have to comply with Canadian law.

That echoes the route the company has been signalling since May, when CEO Yegor Sak told the Globe and Mail he was actively exploring moving Windscribe out of the country.

Windscribe was also careful to separate provider obligations from user liability. No law currently stops Canadians from using a VPN, it pointed out, and the risk it describes only reaches customers if a provider stays put and starts logging traffic.

For anyone uneasy about the paper trail, Windscribe's suggestion was simple: pay in crypto, so neither the government nor a card issuer sees the purchase.

What's next for Canada Bill C-22

Introduced in March by Public Safety Minister Gary Anandasangaree, Canada Bill C-22 would let the government compel electronic service providers to retain user metadata and build technical capabilities for law enforcement access.

The House passed it at third reading on June 18 after the government moved to limit debate, and the Senate is set to pick it up on September 21, according to Parliament's own LEGISinfo tracker.

Late amendments cut the maximum metadata retention period from twelve months to six and added a clause stating the act can't be read as compelling decryption, unless the provider already holds the keys.

Still, law professor Robert Diab argues that doesn't go far enough, since ministerial orders could still sweep up the metadata of people under no suspicion whatsoever.

The government has consistently rejected the surveillance framing, insisting the bill builds no backdoors and that authorities still need judicial authorisation to obtain data.

"A circuit breaker." "Bring back hope." "Do better." That was Andy Burnham's promise to the nation on Monday as he became Britain's seventh Prime Minister in a decade. The digital rights community was watching closely — and they didn't have to wait long for action.

Before even stepping into Downing Street, on the previous Saturday, Burnham scrapped the controversial national digital ID plan. On day one, he sent fresh shockwaves by dismantling the Department for Science, Innovation and Technology (DSIT) entirely and merging it with the Business Department.

The question now is whether Burnham’s impetus for change will address the issues at the heart of the digital privacy debate.

According to the Policy and Campaigns Officer at Liberty, Anna Cardoso, the newly-formed cabinet is a prime opportunity for a "human-centred approach" to tech and privacy. "One that puts people, privacy and fundamental rights at its core," Cardoso told TechRadar.

But what does that actually look like in practice — and can the new government truly deliver?

Does Andy Burnham mean an end to Digital ID cards?

Keir Starmer’s BritCard was an unpopular policy among privacy-conscious citizens. Opponents to the programme then welcomed with excitement Burnham's decision to finally send the UK digital ID to the grave.

"We’ve done it," wrote Big Brother Watch's Director, Silkie Carlo, in a celebratory post on X, while Akiko Hart, Director at Liberty, called the move "a victory for civil liberties in the UK."

But Burnham's motivations to kill the proposal don't exactly come from privacy concerns. His decision was one of economics. Axing the BritCard means freeing up an estimated £600 million a year — from a policy no one wants — and using it for something citizens desperately desire, such as more support with the cost-of-living crisis.

In fact, Burnham told the Financial Times that he's not "arguing against the principle”. After all, he was a supporter of Tony Blair’s Identity Cards Act back in 2006.

"I think there’s a risk of an opportunity-cost situation here where something can consume a huge amount of time and actually doesn’t come through," he told the newspaper.

Does this mean that another form of BritCard be brought back when the time is right? Possibly.

Some commentators are already speculating that online ID checks may find a way to stick around.

Speaking with Al Jazeera, Alan Miller, co-founder of the campaign group Together, argues that other online government systems could evolve into a "de facto digital ID through creeping expansion".

Cardoso from Liberty agrees that killing one proposal isn't enough to sweep away all the concerns about digital forms of identification. Yet, she still considers it a huge step in the right direction. She told TechRadar:

"Whether or not digital ID returns in another form, any future proposal would need to demonstrate a clear public benefit, strong privacy protections, meaningful safeguards and robust democratic scrutiny. Those principles should apply regardless of who is in government."

Will Burnham really scrap Palantir's NHS deal?

The government's £330 million contract with Palantir to build the NHS's new Federated Data Platform (FDP) has also been a concern for Britain’s privacy-conscious citizens. Whether the wave of division on the subject has been one of geopolitics, morality or technical usability, data protection is at its core.

Some reports suggest that Burnham is already considering scrapping Palantir’s NHS contract. Something that, according to Palantir UK CEO Louis Mosley, "would be a terrible mistake".

While nothing is as yet confirmed, the Head of Tech and Data at Good Law Project, Duncan McCann, sees the political reshuffle as the best chance for the group’s campaign to remove Palantir from the UK's healthcare system to succeed, commenting to TechRadar that Burnham now represents "a beacon of at least an opportunity".

Burnham's track record in this area looks hopeful, too. During his almost decade as Mayor of Greater Manchester, municipal or public health departments did not award any contracts to the US surveillance tech giant.

And while McCann explains that Burnham may not necessarily be the one to credit for the decisions the city's public sector took on Palantir, it is an opportunity for hope of change at a national level.

As reported by Al Jazeera, Manchester’s NHS leaders spent six years building their own analytics infrastructure instead of adopting Palantir's FDP system, something that for Palantir critics became proof that effective NHS data management can be achieved without the help of the American company.

"It offers some real opportunity to show Manchester as an innovation hub," explained McCann, saying that the Good Law Project remains hopeful that this could fit well on Burnham's political agenda.

"It proves that we can do it ourselves and save money by doing that, while creating new jobs."

The Prime Minister's press office has already confirmed to reporters the guiding principle remains "getting value for money for the taxpayer" alongside the "need to be safeguarding people’s data and British interests", both of which fit neatly into McCann’s hopes.

As with the BritCard, then, it could be the financial angle that leads the digital rights community to have their concerns on Palantir and patients' privacy finally addressed.

Don’t expect much change to the UK’s approach to children's online safety

Keir Starmer dropped a digital rights bombshell in his last days of governance — an upcoming under-16s social media ban that privacy experts have already dubbed "a cybersecurity disaster waiting to happen".

But don’t expect Andy Burnham’s rise to power to change much here.

In an interview with The Times in April 2025, Burnham talked about the urgency to regulate social media platforms for teens. A concept he reiterated more recently, when he backed the Tories' call for a ban on under-16s from social media last January — as reported by The Guardian.

According to Policy Manager at the Open Rights Group, James Baker, that’s a clear sign that policies on social media will most likely remain unchanged.

"However, I'm not convinced it's going to work because it doesn't tackle the underlying root cause of what makes these platforms harmful," Baker told TechRadar, adding that evidence coming from Australia shows that young people can easily circumvent restrictions.

Baker argues that to really reassure British parents over their children’s online safety, we need a complete shift in policy.

"We need to tackle structural causes for harm instead, like the advertising business model causing platforms to come up with harmful loops that keep people online as long as possible," Baker told TechRadar.

That said, it also looks unlikely that Burnham will address privacy advocates’ concerns on mandatory age verification.

Back in 2016 — during the discussions around the controversial Investigatory Powers Act — Burnham took a strong stance against what he defined as "simplistic loyalties to the security or privacy lobbies", arguing that "such debates are pitched as a clash between two absolutes of privacy and security, where there can be no compromise and only one winner".

Baker agrees that the new Prime Minister probably isn't going to be a huge supporter of privacy causes. But he remains hopeful.

"So much time and energy has been spent trying to solve online safety with policies that haven't actually worked. Perhaps he will take a more pragmatic look and consider other, more cost-effective measures."

Again, economics may prove to be the deciding factor, shifting the conversation away from policies that experts fear will threaten digital freedoms.

So, what can we expect for Burnham on digital privacy?

By binning the digital ID proposal and the entire tech ministry within his first 36 hours of leadership, Andy Burnham proved he isn't afraid to move fast and break things. But as digital rights experts have made clear, a true 'circuit breaker' requires more than just stopping bad policy.

"Liberty wants policymakers to move away from a ‘technology first, questions later’ approach and instead place human rights at the heart of decision-making," Policy and Campaigns Officer Anna Cardoso told TechRadar.

She said that the real tests are yet to come on whether the government will be "willing to grapple seriously with the risks posed by surveillance technologies, AI and large-scale data collection."

Whether it comes from genuine concerns for digital privacy or a pragmatic way for closing the gap between politics and the public, it doesn’t much matter at this stage. If Burnham’s administration can weave privacy protections into his broader economic agenda, he might just deliver the positive vision for tech that advocates are desperate to see.

Until then, the digital rights community remains cautiously optimistic — holding its breath for the next move. As Baker from Open Rights Group puts it:

"We’ll try to give him a chance. Maybe he can do things a bit better."

• NordVPN releases a free-to-use AI tool that evaluates suspicious content
• NordBot aims to stop users from falling victim to social media scams
• It integrates directly with WhatsApp, Telegram, X, Instagram, Messenger

We all know the feeling of receiving a text about a missed delivery fee or a bizarre link from a friend's hacked Instagram account. As phishing tactics grow increasingly sophisticated, the maker of TechRadar's top-rated best VPN has launched a new tool to give you a much-needed second opinion before you click.

Today, NordVPN announced the launch of NordBot, an AI-powered agent designed to detect suspicious content across social media and messaging apps.

Developed by NordLabs, the company's experimental innovation hub, the tool allows users to quickly verify messages, URLs, and images directly within their favorite platforms.

Attackers constantly impersonate brands, support teams, recruiters, and even friends, often relying on urgency to push victims into sending money or clicking malicious links. The goal is to intercept scams where they are most prevalent.

"Scams follow you everywhere now, and they blend right into places you already trust. They show up in your DMs, your group chats, and the comments under a post you were just scrolling past," says Domininkas Virbickas, Product Director at NordVPN.

By evaluating content on the fly, NordBot aims to stop users from falling victim to fake giveaways and AI-generated imagery.

How NordBot works

Unlike standalone security apps that require you to copy and paste the suspicious content into a separate browser window, NordBot is designed to live where the conversations happen.

It currently supports Instagram, Facebook Messenger, Telegram, X, and WhatsApp (via the number +1 940-616-6302), with Reddit integration reportedly coming soon.

Using the tool is straightforward. Whenever you spot a suspicious delivery notice or an unfamiliar link, you simply share the content with NordBot via a direct message or tag it under a public post — depending on the platform.

NordBot only checks the specific content you send it — analyzing the data before replying with a quick safety verdict — to return one of four clear signals.

Safe if the content shows no clear signs of danger. Suspicious means it contains elements that deserve caution. Dangerous when it appears likely to be harmful or deceptive. AI-generated is reserved for content that looks created or heavily altered by AI.

However, the company warns that the bot isn't foolproof.

Because any AI tool can occasionally miss risky content or flag harmless messages, NordBot should act as an extra safety signal rather than a total replacement for good digital hygiene or NordVPN’s built-in next-gen antivirus.

Users are still urged to never share sensitive information, such as passwords, payment details, or one-time codes, with unknown senders.

NordLabs' trackrecord in fighting scams

NordBot is the latest project to emerge from the NordLabs initiative. Other releases include experimental tools like an AI voice checker to spot audio deepfakes and a dedicated link-checking tool.

Virbickas confirmed to TechRadar that NordBot is built on the same scam-detection technology and link-checking engines that power its existing NordLabs tools. What's new is NordBot's capability of detecting AI-generated images, which works by extracting and analyzing any text found in images.

"So, it's a combination of proven, battle-tested detection technology and new capabilities, delivered where people need it most," added Virbickas.

As with any other NordLabs release, NordBot is also completely free for anyone to use and does not require an active NordVPN subscription.

• Surfshark's study puts total recorded deepfake fraud losses at $3.7 billion
• Social media is the leading origin point, accounting for 47% of losses
• 2025 and 2026 alone are responsible for 89% of the damage

Deepfakes have graduated from an internet curiosity into a serious financial threat.

New research from Surfshark finds that people have now lost at least $3.7 billion to deepfake fraud, and the pace of that damage is accelerating sharply.

The study also traced where these scams tend to begin, and one channel stands out above all others. Social media is the single largest origin point, accounting for 47% of all recorded losses.

Running the best VPN will encrypt your traffic and hide your IP address, but it cannot stop a convincing fake video of a celebrity or a cloned voice on the phone from talking you out of your savings.

Social media is the biggest source of deepfake fraud

The scale of the problem has changed almost overnight.

According to Surfshark's data, losses totalled just $83 million between 2020 and 2023, then climbed to $335 million in 2024, surged to $2.5 billion in 2025, and had already reached $764 million in the first half of 2026. Together, 2025 and 2026 account for 89% of all recorded losses.

Most of these losses come from criminals using deepfakes of celebrities and public figures to push fraudulent investment schemes on social media.

"A single deepfake video can go viral in hours, reaching millions of potential victims before it's detected or removed. No other channel offers that kind of reach at zero cost," explains Luís Costa, Research Lead at Surfshark.

Not every viral fake causes harm, though. Costa points out that an innocent deepfake of a footballer during the World Cup might rack up millions of views without costing anyone a penny, while a fake government post promoting a dubious investment scheme can drain thousands of dollars from a single victim.

The threat is spreading beyond your feed

Social media is only part of the picture. Impersonation fraud, where criminals use deepfakes to pose as real people or bypass identity checks, is the second-largest category at $911 million — or 25% of losses.

Fake job candidate schemes, in which AI-generated interviews are used to infiltrate hiring processes, added a further $100 million. These scams are expected to rise, too. As TechRadar previously reported, a 39% spike in "deepfake-as-a-service" chatter on the dark web could end up fueling the next wave of "fake boss" scams.

Everyday communication channels are increasingly in the firing line as well, contributing $174 million between them: phone calls ($71 million), video platforms ($62 million), and messaging apps ($41 million).

The FBI's latest Internet Crime Report also logged $893 million in AI-related losses for 2025, with AI-assisted investment fraud alone accounting for $632 million.

A separate Surfshark experiment found that nearly half of people cannot reliably tell a bot from a human online.

How to stay safe

As Costa puts it, "awareness is the only effective defense when a familiar voice or face can no longer be trusted implicitly".

For personal calls and messages, he suggests setting up a family "safe word" you can use with loved ones to confirm identity when a request feels urgent or out of character.

On video calls, a "glitch test" can help too. Ask the other person to wave a hand in front of their face, as deepfakes often blur or distort when facial features are obscured.

TechRadar has more advice on catching convincing AI images and deepfakes if you want to sharpen your eye.

• VPN providers aren't liable for copyright infringement, said the EU Court
• The Court explicitly recognized VPNs as "lawful technical tools"
• The case centered on the copyright battle involving Anne Frank's diary

In a major victory for digital rights and common sense, the Court of Justice of the European Union (CJEU) has officially categorized Virtual Private Networks (VPNs) as "lawful technical tools" while establishing new boundaries for online copyright disputes.

The landmark judgment — handed down in July 2026 — stems from a complex legal battle over the online publication of Anne Frank's historical manuscripts. At its core, the case forced Europe's top judges to answer a highly technical question: if a publisher actively tries to block visitors from a specific country, are they still breaking the law if a user sneaks past the digital border using circumvention software?

According to the CJEU, the answer is no. As long as a website employs "state-of-the-art" geo-blocking technology, the publisher cannot be held liable for copyright infringement simply because a determined reader decides to fire up the best VPN to bypass the restrictions.

The ruling sets a massive precedent. It confirms that copyright holders cannot point to the mere existence of VPNs to claim a website's security measures are completely ineffective.

More importantly for privacy advocates, the court firmly pushed back against the demonization of privacy software, cementing the legitimate status of VPN providers across the European Union.

The Anne Frank dispute explained

The legal tug-of-war began when a coalition of Dutch and Belgian academic institutions published a free, scholarly online edition of Anne Frank's manuscripts.

Because copyright laws are not fully harmonized across Europe, the legal status of the famous diary varies by territory. In Belgium and roughly 60 other countries, the writings entered the public domain years ago. However, in the Netherlands, parts of the text remain protected by copyright until 2037.

To respect this territorial divide, the publishers hosted the site in Belgium and used geo-blocking to prevent access from Dutch IP addresses. Visitors from the Netherlands were met with a notice explaining why they couldn't enter the site.

The Anne Frank Fonds, which holds the Dutch copyright, sued. They argued that because standard VPNs easily allow users to mask their true IP address and spoof a Belgian location, the scholarly website was effectively communicating the protected work to the Dutch public.

The CJEU ultimately rejected this argument. In its judgment, the court noted that while geo-blocking measures can inevitably be circumvented, "the possibility of such circumvention cannot, in itself and in all circumstances, be a decisive factor in finding those measures to be inadequate and, therefore, ineffective."

Why this matters for the internet and VPN users

For everyday internet users, the "So What?" of this ruling is deeply reassuring. It validates that using a VPN to encrypt your online traffic, hide your IP address, or bypass digital borders is a legitimate use of consumer technology.

The judges explicitly shielded VPN companies from collateral damage in piracy lawsuits, a topic that has sparked intense debate among European ISPs and rightsholders. The court specifically argued that the provider of a VPN or similar services is not liable for users bypassing restrictions.

By placing the legal burden on publishers to maintain "state-of-the-art" digital fences, rather than demanding absolute, impossible perfection, the EU has drawn a pragmatic line in the sand.

Publishers aren't expected to build unhackable walls, and VPN providers aren't responsible for the actions of users who climb over them. Ultimately, this ruling proves that the borderless internet can still coexist with territorial copyright laws, provided everyone uses the right technical safeguards.

• A digital rights group unveils a new version of its free, open-source VPN
• FreeSocks v2 adds Xray-based pluggable proxy to evade VPN blocks
• Post-quantum encryption has also been added for maximum security

With state-sponsored internet blocks growing more sophisticated worldwide, ordinary citizens are finding it increasingly difficult to stay connected. Now, one privacy-focused non-profit is fighting back by completely rebuilding its popular censorship circumvention tool.

Unredacted, a US-based non-profit dedicated to internet freedom, has launched the second generation of its free VPN service, FreeSocks. First released in 2023, the original service successfully issued over 60,000 access keys to users trapped behind digital firewalls.

However, as Unredacted noted in a blog post, censors have refined their blocking skills and become more efficient in blocking VPN and proxy protocols designed to circumvent Internet censorship. "We realized we needed to build FreeSocks from the ground up via a highly flexible system," the group explains.

Today (July 20), Unredeacted announced the new version of the app, adding that "It's now time to punch more holes in the closed Internet."

FreeSocks v2 is now live and promises to provide an incredibly powerful, fully anonymous alternative designed specifically for high-risk environments.

Unredacted’s mission against a closing web

Why the urgent need for a censorship-resistant VPN? 2025 was the worst year on record for internet shutdowns, and state censors are deploying increasingly advanced deep packet inspection (DPI) to identify and block traditional proxy traffic.

Unredacted’s stated mission is to "Operate with absolute transparency, morality, and empathy to directly benefit users and citizens globally." As governments crack down, everyday users, like Iranians overcoming unprecedented internet censorship, are forced into a daily struggle to access outside information.

This mirrors global trends where VPN providers have radically adapted how they dodge blocking technology. Rather than relying on easily identifiable connections, modern circumvention demands dynamic VPN obfuscation technology.

Unredacted embraces this approach by shifting away from the easily blocked Outline (Shadowsocks) protocols to a new primary backend running Xray.

By supporting pluggable proxy backends, FreeSocks v2 can instantly pivot if censors catch on. This ongoing cat-and-mouse game continues to pose a broader question to the industry: is the future of censorship-resistant VPNs no VPNs at all?

Upgraded privacy, hardware, and post-quantum encryption

Beyond evading blocks, FreeSocks v2 offers aggressive privacy guarantees. Users don't need an email or password to sign up. Instead, solving a proof-of-work challenge generates a random 32-digit account number. Furthermore, Unredacted explicitly confirms: "The application never stores a client IP address anywhere – not even hashed."

Security is also heavily bolstered by hybrid post-quantum encryption. FreeSocks v2 adds X-Wing, a hybrid protocol that combines classical X25519 and post-quantum ML-KEM-768 algorithms. In simple terms, it ensures that your data remains secure even against hypothetical future quantum computers designed to break modern encryption.

Crucially, Unredacted is cutting ties with third-party hosting, too. "FreeSocks v2 is launching fully on hardware that we own, colocated in Kansas City, MO," the team confirmed. This hardware ownership prevents upstream providers from interfering with user traffic or handing over server logs.

While the core service remains free, users can purchase an optional $5 monthly membership to remove traffic limits. Unredacted also accepts cryptocurrency and fiat donations.

In a unique philanthropic twist, every donation made to the platform directly funds a shared bandwidth bonus that is automatically split across all free users on the network every month.

• The US Treasury sanctioned First VPN Service for aiding ransomware gangs
• Complying with the sanctions, the .ME registry wrongly suspended Telegram's entire t.me domain
• The domain was restored roughly 19 hours later after Telegram CEO Pavel Durov flagged the issue online

If you clicked a Telegram link on Monday and stared at a blank screen, you weren't alone. Every shortlink starting with 't.me' suddenly vanished from the global internet, breaking group invites, profile shares, and channel links for roughly a billion users worldwide.

But the outage wasn't caused by a technical glitch or a targeted cyberattack. Instead, it was the unintended collateral damage of a US government crackdown on a cybercriminal proxy network.

On July 13, the US Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned the administrators of a rogue proxy network called First VPN Service (1VPNS), aiming to cut off infrastructure used by ransomware operators.

While anyone shopping for the best VPN expects privacy, First VPN actively courted cybercriminals with promises of total anonymity, leading European law enforcement to pull the plug on the service earlier in May.

As part of the new sanctions, the US Treasury published a list of web addresses associated with the VPN. Buried in that list was a link to First VPN's public Telegram support channel: t.me/FirstVPNService.

A sledgehammer to crack a nut

Because top-level domains operate under strict international compliance rules, domain registrars must act quickly when sanctioned entities use their infrastructure.

Identity Digital, the company managing the technical backend for the .me domain, confirmed that the t.me domain had been blocked at the request of OFAC.

However, because a domain registry cannot selectively disable a specific webpage or channel path — like a single Telegram group — the Montenegro-based registry Domain.Me applied a "serverHold" status to Telegram's entire t.me domain.

This sweeping action effectively erased the domain from the global Domain Name System (DNS). The core Telegram app continued to function, and the older telegram.me domain remained active, but the shortlinks the messaging platform is built upon went entirely dark.

The swift resolution

The sudden shutdown prompted immediate action from Telegram's leadership.

Unaware of the backend domain hold, Telegram CEO Pavel Durov took to X to publicly ask the registrar for an explanation: "Hey @domainME, t.me links stopped working. Can you look into it?"

Once the sanctions issue was identified, Telegram scrubbed the offending channels from its platform. The registry operator subsequently verified the compliance and brought the domain back online.

"On 13 July, 1VPNS was included as a sanctioned entity by the US Department of the Treasury. A Telegram channel using the t.me domain was among 1VPNS identified infrastructure. Accordingly, the t.me domain was suspended," domain.Me confirmed in a statement following the outage.

The registrar clarified that normal service resumed roughly a day later, after Telegram provided confirmation that it had removed its links and affiliations with 1VPNS. "We appreciate Telegram's prompt cooperation in resolving this matter," domain.Me added.

While the outage is now resolved, the incident highlights a glaring vulnerability in the modern web, where a single URL swept up in a government sanctions list can inadvertently silence an essential communication channel for millions.

"We decided not to limit VPNs." These six words from Online Safety Minister Kanishka Narayan ended months of tension on Wednesday, confirming the government's U-turn on age-gating privacy tools.

VPN services are popular software that millions of people in the UK use every day to encrypt their online activities for better privacy and security. Yet, their ability to grant access to geo-blocked content has also been making enemies among democratic countries lately, as age verification laws spread across the world.

This friction has led some British lawmakers to dub VPNs a "loophole that needed to be closed," prompting a national consultation to investigate how kids use this technology.

The announcement of an upcoming UK teen social media ban has made this process even more crucial. Since then, many have speculated that it would have helped to tip the scales towards new VPN restrictions. And yet, that didn't happen.

"This is the right call, and a welcome recognition that VPNs play a crucial role in everyday cybersecurity," Justas Pukys, Senior Product Manager at Surfshark, told TechRadar, adding that protecting children online and preserving strong cybersecurity tools "can, and should, go hand in hand."

But why did the UK government choose to leave VPNs alone after all? And can this bold decision pave the way for a similar response in the rest of Europe?

Why the UK government will not age-gate VPNs

As the UK Science, Innovation and Technology Secretary, Liz Kendall, explains in a parliamentary statement, VPNs have legitimate privacy and security uses. The reason why, she explains, "we will therefore not age-gate or ban them."

Independent research conducted by Kendall's department has indeed found that privacy is the top reason UK children use a VPN. Only a small minority of them — between 7% and 10% — do so to bypass mandatory age checks.

The latest Ofcom report on the use of age assurance — which was also published on Wednesday — paints a similar picture. While confirming that VPN usage doubled in the UK following the enforcement of mandatory age verification, only "a relatively small minority of children" use these tools to access restricted content or features.

These findings mirror separate YouGov research commissioned by the VPN Trust Initiative, which revealed that a mere 1.4% of surveyed minors use a VPN specifically to access platforms meant for older demographics. Before that, a May 2026 study conducted by Internet Matters also found that only 7% used a VPN to circumvent age restrictions.

This evidence doesn't necessarily mean that children aren't trying to evade controls. Yet, they show how most young people do so simply by entering a fake birthdate or using a parent's login.

So, the onus to prevent kids from evading controls is now back on the platforms. But the government also shared the intention to "engage with VPN providers on voluntary action and strengthen guidance and support for parents."

NordVPN's Privacy Advocate, Laura Tyrylyte, welcomes the prospect of working with lawmakers to find a balanced solution, praising Kendall's decision.

"The Government is right to recognise the important role that VPNs play and to adopt an evidence-led approach," Tyrylyte told TechRadar.

And while arguing that "it should have been obvious from the start," Windscribe's CEO, Yegor Sak, explains that this move reassures VPN users in the UK that they can continue using VPNs. "Without worrying that a legal privacy tool is about to be treated as suspicious by default," he added.

Will other countries follow the UK?

UK wasn't alone in toying with the idea of age-restricting VPN apps.

The EU is also considering something similar following the release of its age verification app. On a national level, France is also evaluating VPN use as it gets ready to enforce its under-15 social media ban.

That's why Mozilla Product Policy Manager, Svea Windwehr, urges European governments to follow the UK's lead.

"We urge policymakers everywhere to address the root causes of online harms, and follow the UK's evidence-based approach in keeping VPNs accessible for everyone," Windwehr told TechRadar.

And while the wider industry is now hopeful that VPN restrictions will ultimately disappear from politicians' agendas, the tensions between children's safety and people's privacy have not been defused yet.

"If an online safety regime only works when everyone's location and identity are easy to verify, the problem is the regime. Not the tool that prevents constant identification," Sak from Windiscribe told TechRadar.

NymVPN's CEO, Harry Halpin, agrees with Sak on this, warning that UK lawmakers' action could still impact VPN users in the country.

"The problem is that the UK government is still pursuing its idea of connecting your passport to your internet usage," Halpin told TechRadar, arguing that this still "hinders free access to the internet even if VPNs are usable."

The road to ensuring age verification systems don't hurt our digital freedoms may still be long. But protecting the integrity of the VPN is certainly a step in the right direction that we hope more politicians will replicate.

As MEPs were getting ready for the summer break, the European Parliament revived a law to give Big Tech giants the green light to scan citizens’ unencrypted messages for child abuse material (CSAM). And the digital rights community is furious.

In March, the same lawmakers rejected blanket monitoring in favor of a "proportional and targeted" approach. Yet, by exploiting an unusual procedural loophole, the EP President Roberta Metsola managed to revive what's been dubbed Chat Control 1.0.

Critics have not only slammed the procedure as "undemocratic," but also warned that it could mean mass scanning — where everybody's data is checked — becomes permanent.

But how did a law voted down over three months ago end up on the fast track to be enforced? And what will be the lasting impact on our privacy?

How Chat Control 1.0 was revived

Due to the "rarely used" legal procedure adopted last week, an absolute majority was required to reject the proposal.

This meant at least 361 MEPs were required to vote against it — something critics say was difficult to achieve as many of them were already on holiday.

So, despite the majority of MEPs rejecting it (314 against, 276 in favor), the motion was sent to the Council for final approval, which is expected in September.

Initially intended as a stopgap while lawmakers debated the permanent Child Sexual Abuse Regulation (CSAR) bill — aka Chat Control 2.0 — the interim framework was in place from 2021 until it terminated in April of this year.

Since then, child safety groups and some MEPs have argued that the legal vacuum this caused required urgent action — a gap addressed by last week's vote.

However, Google, Meta, Microsoft, and Snapchat issued a joint statement in April pledging to "continue to take voluntary action" to execute CSAM scans — regardless of whether the interim scanning law was enacted.

The privacy backlash

Many critics didn’t like how the Chat Control gambit unfolded, calling Metsola's actions a political stunt. They allege she used a legal loophole strategically to schedule a vote during the final meeting of the legislative season to maximize its chances of passing.

A long-standing critic of the CSAM scanning law, former MEP for the German Pirate Party and digital rights jurist Patrick Breyer didn’t mince words, slamming Metsola's move as a "farce" that "damages democracy."

Robin Wilton, the Internet Society's Senior Director for Internet Trust, also told TechRadar that the "extraordinary bending of parliamentary procedure" required to pass the bill should concern everyone.

In a written statement to TechRadar, Roberta Metsola’s press office said, "it was not the President who brought this up or pushed for it" but that the issue was raised by other political groups during a meeting in June.

The lasting impact of Chat Control 1.0

While the temporary legal framework is expected to be reinstated soon, the more significant battle over CSAM scanning and digital privacy continues in the background.

Lawmakers are still discussing the terms of the permanent CSAR law, with negotiations reportedly stalling over the issue of targeted or mass scanning.

Critics are now concerned that last week's vote could steer the direction of the debates regarding the permanent law. And not in ways that would protect people's digital privacy.

Rand Hammoud, Director of the Security, Surveillance and Human Rights Programme and Regional Encryption Lead at the Center for Democracy and Technology (CDT), fears that passing the temporary law risks legitimizing mass scanning and says that opposition may become "more difficult" to sustain.

Put simply, because the temporary law allows for mass scanning, the permanent legislation may be more likely to include the same provision.

Digital rights advocates have long argued that mass scanning is a privacy "disaster waiting to happen," calling for more targeted solutions. They believe that even when the scanning is "voluntary" — meaning when tech companies can choose whether to perform the scanning or not — it remains problematic.

For child safety groups, however, voluntary scanning is non-negotiable. According to Hannah Swirsky, the Internet Watch Foundation's (IWF) Head of Policy and Public Affairs, it would be a mistake to limit detection only to individual suspects.

"The scale of the issue with CSAM requires technology to be used widely across platform systems," Swirsky told TechRadar.

Either way, Hammoud from CDT Europe says finding the right balance between privacy and children's safety "demands careful, evidence-based lawmaking" — a standard she argues was lacking in the fast-tracked procedure last week.

What’s next for the privacy of chats?

Despite the temporary law expected to officially pass in autumn, some opponents of Chat Control are still hopeful.

Crucially, the vote showed that most MEPs remain unconvinced about the current legal framework being developed. And while there is deep disagreement on how to do so effectively, it is worth noting that people on all sides want to find solutions that keep children safe online.

As the EU institutions pull down the shutters for the summer, we can only hope that politicians are able to reach a compromise that upholds democratic principles while keeping children safe and defending citizens' digital privacy.

• Google, Apple, GitHub sites are inaccessible on Russian IP since July 14
• The state regulator, Roskomnadzor, denies blocking the webistes
• A reliable VPN remains the only way for citizens to bypass outages

Russian internet users found themselves locked out of crucial digital services on Tuesday, as widespread and unexplained outages knocked Google, Apple, and GitHub offline across the country.

The network disruptions, which began around 10:00 Moscow time, prevented anyone using a domestic IP address from reaching the websites. This sudden digital blackout is the latest hurdle for citizens trying to access the open web, making the use of VPN services an absolute necessity rather than just a privacy luxury.

According to data from Russian web monitor platforms Detector404 and Sboy.rf — as reported by Novaya Gazeta — the failure rates were staggering. The tracker noted that HTTPS connections to Google broke in 26% of cases, while connections to Apple sites failed 99% of the time.

The outages sparked over a thousand user complaints within hours, heavily concentrated in regions like Moscow, St. Petersburg, and Novosibirsk. Users quickly discovered that accessing the sites via a foreign IP address completely restored service.

Despite the highly localized nature of the blocks, Russia's telecommunications watchdog, Roskomnadzor, denied any state involvement. In a statement reported by the Moscow Times, the regulator claimed it did not restrict access to the affected platforms.

Regardless of the official explanation, the result is the same: the only way to restore normal access to these everyday platforms is by routing your connection through a secure, foreign server using a Virtual Private Network (VPN).

How a VPN helps and why VPN traffic is the next target

For anyone caught behind Russia's digital iron curtain, a VPN is a critical lifeline.

By encrypting your internet traffic and routing it through a secure server outside of the country, a VPN masks your real IP address. This effectively tricks the network into thinking you are browsing from a completely different location, allowing you to sidestep domestic censorship and load Google, Apple, or investigative news outlets as normal.

However, the Kremlin is well aware of this workaround, and the censorship landscape in the country is rapidly deteriorating. Russia's ongoing war against the open internet has increasingly zeroed in on the circumvention tools themselves, with Roskomnadzor wanting to block 92% of VPN apps by 2030.

The tactics go far beyond simple website bans. Earlier this year, Russian authorities ordered major mobile operators to disable the ability for users to top up their Apple ID balances via mobile phone accounts. This calculated move was designed specifically to stop citizens from paying for premium VPN apps through the App Store, compounding the payment difficulties created when Visa and Mastercard suspended operations in 2022.

Worse still, VPN traffic itself is now actively targeted. Roskomnadzor has heavily invested in deep packet inspection (DPI) technology to detect and block VPN protocols.

Over the past few months, the agency has throttled popular protocols like WireGuard and VLESS, creating a frustrating cat-and-mouse game for providers trying to keep their users online — the popular Amnezia VPN included.

Meanwhile, Russia continues to use DNS and DPI blocking to restrict YouTube, Telegram, and WhatsApp while aggressively pushing state-controlled alternatives.

As state control tightens, free access to basic tech tools is no longer guaranteed. If you are in the region, securing a tested, obfuscated VPN is the only remaining defense against an increasingly isolated Russian internet.

• The UK government confirmed it will not limit VPNs
• Data reveals only 7-10% of teenagers use a VPN to bypass age checks
• Social media curfews, autoplay restrictions were also announced

The UK government has officially scrapped the idea of restricting virtual private networks (VPNs) to enforce its impending social media bans, delivering a massive victory for digital privacy advocates.

Speaking on BBC Breakfast today, the government confirmed a major U-turn on the subject, with Online Safety Minister Kanishka Narayan stating: "We decided not to limit VPNs."

This was further cemented in a written parliamentary statement by Technology Secretary Liz Kendall, who clarified that the government will not age-gate or ban the best VPN software because "VPNs have legitimate privacy and security uses."

The announcement ends fears that sweeping age verification laws could inadvertently break online privacy for millions of adults.

Cybersecurity experts and privacy groups previously warned that restricting these tools would be a disaster waiting to happen, prompting an open letter from the industry urging lawmakers to leave everyday privacy tools alone.

Privacy wins, but platforms face new rules

While VPNs are safe from a blanket government ban, the social media ban loophole hasn't been completely ignored.

Kendall confirmed the onus will now fall on social media platforms "to take robust steps to detect and prevent attempts by underage users to circumvent age assurance measures."

To achieve this, the government has tasked Ofcom and the Information Commissioner’s Office (ICO) to report by October on how platforms can better detect and prevent VPN use for age-check circumvention. The government also plans to engage directly with VPN providers regarding voluntary actions.

This shift in responsibility aligns with newly released government research.

A Department for Science, Innovation and Technology (DSIT) report revealed that while 26% of 11- to 17-year-olds use a VPN, findings show they do so primarily for privacy.

Only 7-10% use them to bypass age checks, whereas 45% simply enter a false date of birth.

Midnight curfews and AI limits

While everyday privacy tools have been spared, the government is pressing forward with strict new rules to combat digital addiction — that online commentators already deemed "ineffective and useless" — with the first regulations coming into effect in early 2027.

Following the upcoming blanket ban on social media for under-16s, new measures will ensure 16- and 17-year-olds don't face a sudden "cliff edge" of addictive features. Government consultation revealed that nearly one in three children actively want help managing their screen time.

Under the new rules, older teens will face default social media curfews from midnight to 6 am. Additionally, persuasive features like autoplaying videos and personalized infinite feeds will be switched off by default to make logging off easier.

"This is about giving these older children more choice and control over the feeds and reducing that sense that they can never switch off being online," Kendall stated.

The protections also extend to artificial intelligence.

The government will require mandatory breaks for under-18s using AI chatbots to prevent emotional dependency. Furthermore, lawmakers are working with health regulators, including the MHRA and DHSC, to consider banning therapy chatbots entirely if they provide dangerous or unverified mental health advice to minors.

• The US Treasury has sanctioned First VPN's administrator for aiding ransomware attacks on American infrastructure
• Another suspect was targeted for selling "cryptors" that cloak malware from security systems
• The move follows a May 2026 takedown by European law enforcement and the FBI that seized the VPN's infrastructure

The United States government has officially issued sanctions against the operators of a notorious virtual private network (VPN), escalating a global crackdown on digital infrastructure used to facilitate ransomware attacks.

On Monday (July 13), the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated First VPN Service (also known as 1VPNS) and its Ukrainian administrator, Dmytro Rashevskyi, for abetting cybercriminals. The service, which has operated since 2014, was heavily favored by ransomware gangs targeting American hospitals, municipalities, and businesses.

While the best VPN services are designed to protect everyday consumer privacy, rogue networks like First VPN provided malicious actors with the tools to "hide the origins of their attacks, deploy malware, and manage exfiltrated data," according to a Treasury Department press release.

As part of the same action, the Treasury also sanctioned Yegeniy Vladimirovich Silayev, a Belarusian national accused of selling "cryptors" to ransomware operators.

While Silayev is not directly affiliated with First VPN, his inclusion in the sanctions package highlights a broader strategy of targeting the entire cybercriminal supply chain. Cryptors are tools specifically built to disguise ransomware as harmless files, preventing security systems from detecting or deactivating the malware.

A haven for cybercriminals

The US Treasury's latest move is an update to an ongoing international operation against First VPN.

In a massive May 2026 takedown, a coordinated effort led by European law enforcement agencies and the FBI successfully seized the service's website and server infrastructure.

Prior to the takedown, Rashevskyi aggressively marketed First VPN on dark web forums. To lure cybercriminals, he promised total anonymity and boasted that the network "does not keep logs of users' identities or activities, and that it refuses to cooperate with law enforcement investigations into illegal activity originating from the servers it rents to customers".

According to the US Treasury, Rashevskyi went to great lengths to keep the operation running. He utilized false identities, such as "Maksim Sorin" and "Roman Chabanenko," to "buy infrastructure from companies that might otherwise refuse to do business with him because of complaints of abuse from internet service providers about illegal activity originating from 1VPNS servers".

Disrupting the cybercriminal ecosystem

This latest wave of sanctions was coordinated alongside the United Kingdom's Foreign, Commonwealth & Development Office (FCDO) and carries severe consequences for the designated individuals.

Under the new sanctions, all property and interests belonging to Rashevskyi and Silayev within the US are blocked, and US citizens are strictly prohibited from engaging in any transactions with them. Beyond the immediate financial freeze, OFAC sanctions serve as a massive reputational blow designed to choke off future revenue streams.

By focusing on the service providers and tool suppliers who facilitate these attacks, rather than just the ransomware operators themselves, authorities are aiming to maximize their impact and disrupt multiple gangs at once.

"Under President Trump's leadership, Treasury is using every available tool to disrupt the cybercriminal ecosystem and protect the American people," said Gene Lange, who is performing the duties of the Under Secretary for Terrorism and Financial Intelligence. "We will continue targeting the actors who enable ransomware attacks against Americans and our critical infrastructure".

• Government report shows British kids mainly use a VPN to improve their privacy
• Only a fifth of VPN users use the tech to bypass age verification
• Pretending to be older is the most common way to dodge age checks

As the debate surrounding potential VPN restrictions heats up in the UK, a government report has cast doubt on whether such drastic measures are justified.

According to the study commissioned by the Department for Science, Innovation and Technology (DSIT), digital privacy is the primary driver behind VPN use among British children.

Content unblocking ranks as the second most common motivation, with children using the tools to access specific apps and media from other countries.

Crucially, the desire to bypass mandatory age checks ranks much further down the list, with only about a fifth of young VPN users actively using the software to evade age checks. This equates to just 7% of all British children using a VPN to access restricted platforms.

These findings challenge the narrative that restricting VPNs is vital to enforcing current age verification laws and the government's proposed under-16 social media ban.

The government is set to share evidence of its public consultation on children's online safety and VPNs this month.

In response to requests for comment, a spokesperson for DSIT shared a press release that confirms that "VPNs play a limited role in circumventing age check."

"As platforms implement more robust age verification to comply with the newly announced restrictions, many of the common routes used to bypass age checks today will become increasingly difficult," they continued.

Kids and VPNs: What the DSIT report found

Following a nationwide survey of over 2,000 young people aged 11 to 17, researchers at BMG Research discovered that familiarity with virtual private networks among British children is high.

58% of children surveyed reported that they are aware of the software, while roughly a quarter of all respondents admitted to using a VPN in their lifetime.

The underlying motivations of these young users appear to challenge the argument in favor of stricter controls.

Among active VPN users, 30% state they use the software specifically to secure their online privacy. This aligns with warnings from digital rights advocates who argue that restricting VPN access could strip vital security tools away from minors.

And while young people do use these apps to bypass content restrictions, the study shows they are primarily interested in evading regional entertainment geoblocks or school network restrictions rather than maliciously outsmarting age verification.

Bypassing age checks ranks fifth on the list of motivations. These findings mirror separate YouGov research commissioned by the VPN Trust Initiative, which revealed that a mere 1.4% of surveyed minors use a VPN specifically to access platforms meant for older demographics.

So how do children actually bypass age checks?

It seems that British children have found much simpler workarounds to evade online controls than using a VPN.

Over half of the children surveyed admitted they simply migrate to different platforms, with 37% choosing websites that completely lack age verification and 34% opting for services known to enforce weak, easily tricked checks.

Posing as an adult remains the most common tactic, with roughly 63% of those who bypass checks admitting they pretended to be someone older.

Specifically, 45% do so by giving a false date of birth during self-declaration checks, while a notable minority (11%) use their parents' or relatives' identification details.

The findings follow a stark warning to Downing Street from a coalition of more than 20 tech firms and privacy advocacy groups, which urged policymakers to protect digital rights and ensure that VPN tools remain unrestricted.

• 20+ digital rights groups and tech firms urge the UK not to restrict VPNs
• Age-gating VPNs would undermine the online privacy of millions, they warn
• Signatories believe VPN restrictions are ineffective, technically unfeasible

The UK government's ongoing debate around tightening online safety rules to protect kids has drawn fierce pushback from the global cybersecurity sector.

On July 9, a coalition of 24 major digital rights organizations and top VPN providers, including Amnesty International, ExpressVPN, NordVPN, Surfshark, and Mozilla, issued a stark warning to the UK government: leave VPNs alone.

In an open letter to the Secretary of State for Science, Innovation and Technology, Liz Kendall, the group stressed that while keeping kids safe is a shared goal, it must not come at the cost of breaking the internet's fundamental privacy infrastructure.

As lawmakers weigh up potential restrictions ahead of an expected online safety consultation update this month, the stakes for your digital privacy have never been higher.

If you currently use the best VPN to protect your personal data on public Wi-Fi or secure your connection while working remotely, new regulations could fundamentally alter how these tools work. Any move to force VPN providers into verifying the age of their users would require you to hand over sensitive personal data, effectively destroying the anonymity you pay to protect.

"Restricting VPNs would undercut security"

The heart of the coalition's argument is that virtual private networks (VPNs) are, first and foremost, essential security software.

"The challenge is ensuring measures strengthen child safety without weakening the privacy and security millions of people rely on every day, including children," the letter explains.

Beyond everyday consumers, the coalition notes that VPNs provide critical protection for vulnerable groups.

The open letter emphasizes that these tools are a lifeline for "human rights defenders and journalists, domestic abuse survivors, the LGBTQ+ community, and others at heightened risk online." As rights groups have noted previously, weakening this protection could actively infringe human rights.

Addressing the reality check of age verification head-on, the group didn't mince words about the dangers of ID checks.

"Age-gating VPNs would require everyone to surrender sensitive personal information simply to access tools designed to protect privacy," the letter states.

A technically unfeasible approach

Critics of the UK's proposed teen social media ban have repeatedly pointed out that restricting privacy tools is a flawed approach to child safety. The letter backs this up with hard data, pointing to Ofcom research which "found that only around 3% of children had used VPNs to access content meant for older audiences."

The coalition also highlights that teenagers will simply find other, lower-tech ways to bypass rules. "Evidence from Australia shows children are much more likely to get around age checks by not being asked, giving false information, or even drawing on a moustache," the letter adds.

Ultimately, the cybersecurity industry is warning that while restricting privacy tools is failing to protect kids, it will succeed in punishing regular users. "Blocking VPN traffic reliably is technically unfeasible," the letter warns, noting that it risks locking employers and schools out of the web, while pushing regular citizens toward "unregulated, data-exploiting services that are harder to oversee, leaving them less secure."

Rather than breaking encrypted tools, the coalition urges the government to focus its upcoming policies on the root causes of online harms, suggesting investments in "strong enforcement of platform obligations, better parental controls, investment in digital literacy, and safety- and privacy-by-design obligations."

• Proton launches a map to show how age verification laws spread globally
• Proton CEO said these laws will lead to "the death of online privacy"
• Alternatives to prevent digital safety are possible, Proton argues

It feels like an eternity ago, but it has only been less than a year since Australia made global headlines by introducing the world's first nationwide under-16s social media ban. Even longer, perhaps, since mandatory age verification checks have landed in the UK.

Over the past 12 months, however, mandatory age-verification regulations have been spreading rapidly across the world. The era of anonymous browsing — and perhaps the very concept of online privacy — may be quickly coming to an end.

To keep pace with these seismic changes, Proton — the Swiss-based company behind one of the best VPN and secure email services on the market — has launched an interactive map tracking the global spread of age verification laws.

While these laws continue to provoke criticism from scientists, tech experts, and digital rights advocates, Proton aims to ensure that the public remains properly informed by providing timely updates as new legislation advances.

Proton's age verification map

Proton's age verification map provides a real-time overview of where these measures are being introduced and how they are being implemented.

Clicking on any country reveals information about the progress of legislative proposals in that region, with the tool offering a detailed overview of the different approaches adopted by governments regarding age verification legislation.

A glance at the map is enough to show just how rapidly laws are proliferating.

In Europe, for example, 18 countries have already implemented or proposed age verification requirements targeting adult content. Fifteen of these have already introduced measures specifically aimed at social media platforms.

On the other side of the pond, 49 US states have put forward proposals, and 27 have successfully implemented mandatory age checks for websites with harmful content for minors. In addition, many states have either successfully implemented or are considering parental consent or verified age mechanisms for mainstream social apps.

But this pattern stretches way beyond Europe and North America. In the Asia-Pacific region and the emerging markets of Latin America, governments are targeting a wide range of channels, including adult websites, social media platforms, online gaming platforms, and apps.

The death of privacy worldwide?

Andy Yen, founder and CEO of Proton, strongly argued that requiring every user to provide their identifying information is simply tantamount to "the death of privacy online."

He is not alone in holding these views. Many privacy advocates and digital rights organizations argue that current age verification methods encourage the growth of surveillance while compromising users' privacy.

Critics also point to past failures in ensuring the security of sensitive data. Breaches involving Discord's third-party age verification service affecting over 70,000 users or the EU’s age verification app, allegedly hacked in two minutes, are just a few examples of the scale of the problem.

The picture looks even bleaker when one considers that many experts from youth organizations and children’s charities seem to agree that such methods could have harmful effects on young people browsing the Internet.

As opposition continues to grow — from scientists calling for the suspension of mandatory age verification to gaming groups and digital rights activists joining forces to prevent the erosion of Internet freedom — Yen argues that alternatives are possible.

Proton advocates for a different approach to child protection. One that does not compromise the very concept of online privacy and is based on client-side processing, with results that are fully anonymized thanks to end-to-end encryption and publicly accessible open-source code.

"We simply can’t afford to get this wrong. Who stands to benefit? The same tech giants who build today’s privacy nightmare," Yan said.

• Australian eSafety Commissioner views VPN detection as a "reasonable step" for tech companies enforcing age limits
• The watchdog notes that service providers must prevent workarounds under new industry codes
• Australia's position mirrors a growing global debate surrounding age assurance and VPNs

Australia's internet watchdog is keeping a close eye on VPN services as the country steps up its efforts to enforce strict online age verification rules.

According to documents obtained by The Guardian under freedom of information (FOI) laws, the Australian eSafety Commissioner expects tech platforms and service providers to actively block workarounds that allow users to bypass age-restricted content and social media bans.

The internal documents explicitly detail how the government plans to approach these privacy tools under its Unlawful Material Codes and Standards. Under the Codes, the documents state, "service providers must take reasonable steps to prevent workarounds like VPNs so eSafety will look at this when considering compliance with codes."

For everyday web users, this raises a troubling question: could turning on a virtual private network (VPN) to protect your personal data soon flag you as a circumventor?

As cybersecurity protections increasingly find themselves in the crosshairs of child safety regulations, digital privacy advocates are sounding the alarm.

The push for VPN detection

Under the new codes, the Australian government is placing the burden directly on industry providers to prevent the exposure of age-restricted material, defined by regulators as Class 1 and Class 2 material.

Because a VPN encrypts your internet traffic and spoofs your IP address, it can easily make you appear as though you are browsing from a different country, bypassing local geoblocks and age gates. That's exactly why VPN downloads skyrocketed after Australia enforced mandatory age verification for adult content last March.

However, Australian authorities are confident that platforms can counter this.

According to the FOI documents, the government's ongoing Age Assurance Technology Trial has convinced regulators that network detection is feasible. The documents note that "the Department of Infrastructure, Transport, Regional Development, Communications, Sport and the Arts knows that tech companies can tell when a VPN is in use."

Consequently, the eSafety Commissioner is treating the detection of these tools as a fundamental requirement. The internal log clarifies that "this is similar to eSafety’s regulatory guidance for the social media minimum age, where eSafety considers VPN detection as a reasonable step to prevent underage users from having an account."

A global ripple effect?

Australia is far from the only country struggling to balance child safety legislation with the right to online privacy. The debate over whether to treat VPNs as essential security software or mere circumvention tools is heating up worldwide.

Recent analysis of Australia's age verification rules suggests that trying to plug these "loopholes" could severely compromise the digital safety of the broader population. In fact, some experts argue that demanding that platforms actively block VPN connections sets a dangerous precedent for civil liberties.

The ripple effect is already visible across Europe.

As the EU launches its own age verification initiatives, regulators are increasingly signaling that VPNs might be next in line for restrictions. Similarly, the shifting role of VPNs in the UK has prompted rigorous discussions about whether incoming social media bans could lead to VPN restrictions.

Ultimately, the eSafety Commissioner’s plan highlights a growing reality: as governments worldwide roll out strict age assurance mandates, child safety measures and VPN use are on a collision course.

Whether everyday Australians will still be able to freely protect their data on public Wi-Fi without being blocked from their favorite sites remains to be seen.

Decentralized, encrypted, and completely private messages. That's what Session promises.

You may never have heard of the app, but for its 1.7 million monthly users, Session is an important piece of privacy tech worth fighting to sustain.

Due to a severe funding shortfall, Session was expected to cease operations this week. However, after securing $200,000 to keep the project afloat, the team is now ready to look ahead.

Session co-founder Chris McCabe described the app as a "critical tool for fighting against an Orwellian future." But what is Session, and what does it offer that mainstream giants like Signal can't?

How Session survived its financial crisis

Launched in 2018, the project originally sustained its decentralized infrastructure through its own crypto tokens. According to McCabe, the Session Technology Foundation (STF) sold roughly $2.4 million worth of tokens toward the end of 2023 to keep the project going.

However, the model wasn't sustainable and, when a crisis in the crypto market drained Session's finances last year, the founders were forced to terminate the contracts of all 16 of their team members.

Unwilling to let the platform die, the founders scrambled for alternative lifelines. Following a high-profile emergency donation from Ethereum co-founder Vitalik Buterin — who gifted 128 ETH to support the app's mission — the foundation decided it was time to turn to its user base for long-term survival.

That grassroots fundraising campaign ultimately paid off.

To date, Session has received hundreds of community donations totaling $205,000. While that is still a long way off the project's ultimate $1 million sustainability goal, it is enough to keep the platform operational, albeit with far fewer resources than it once had.

"This funding allows us to retain three developers and one community operations person to maintain the app," McCabe explains.

How Session protects your messages

"Send messages, not metadata" is Session's mantra. To back this up, the app uses a variety of advanced techniques to ensure users' messages remain private and secure.

From basics like end-to-end encryption to the use of a decentralized infrastructure and onion routing, Session goes significantly further than mainstream messaging apps.

"Session is completely trustless," McCabe told TechRadar. "You don't even have to trust us because the open-source code guarantees your security."

In the future, the app's design should also make it less vulnerable to increased surveillance and monitoring, such as the initiatives currently being proposed in Canada, the EU, and the UK.

Because the platform is open source, McCabe claimed the app can continue to operate even in countries where it has been banned from mainstream app stores, noting that users can easily bypass those restrictions by sideloading the app on Android devices.

And what happens if a repressive government demands data about an individual user? McCabe noted that the foundation simply couldn't comply, saying: "It's technically impossible for our company to copy or store that data."

Crucially, users do not need a phone number or email address to sign up for the service. That anonymity is especially beneficial for citizens in conflict zones or highly restrictive digital environments, where hostile governments can block SMS two-factor authentication messages to cut off access to mainstream messaging networks.

So, how exactly does Session stack up against mainstream giants like Signal?

Is Session really better than Signal?

Signal is widely recognized as the gold standard for privacy-preserving messaging apps. Like Session, it is fully open-source, collects minimal metadata, and uses advanced end-to-end encryption via the Signal Protocol.

While McCabe agrees that "Signal is great," he believes that being completely decentralized and eliminating the need for a phone number tips the scales in Session's favor.

However, not everyone in the cybersecurity community shares this view.

A prominent cryptanalyst who uses the pseudonym Soatok has publicly argued against switching from Signal to Session. A major point of criticism is Session’s decision to remove Perfect Forward Secrecy (PFS) — an important security feature that ensures that past chats remain private even if a user’s long-term identity keys are compromised in the future. Soatok also suggested that Session contained several other cryptographic flaws and implementation mistakes.

Bill Budington, Senior Staff Technologist at the Electronic Frontier Foundation (EFF), backed Soatok’s analysis, telling TechRadar that Session appears to be another aspiring Signal competitor that "comes up lacking on its security claims."

Mohammed Al-Maskati, the Digital Security Helpline Director at Access Now, shared this concern. He argued that sticking with a widely implemented standard like the Signal Protocol is generally a safer option because it significantly reduces the risk of making critical errors during development.

Responding to these critics, McCabe explained that while Session initially relied on the Signal Protocol, the team was forced to build its own encryption method because Signal's architecture wasn't designed to handle a decentralized node network.

However, he confirmed that PFS is officially slated to be reintegrated into the platform with the upcoming Session Protocol V2 upgrade.

Security experts have also pointed out that Signal remains a stronger choice for most users due to the sheer size of its network, which makes it far easier to use with friends and contacts.

However, McCabe rejects the idea that popularity equates to security, arguing that by that logic, WhatsApp would be considered a better privacy option than Signal. "Which it is not," he said.

What’s next for Session?

As Session prepares to enter its next phase, the foundation is focused on achieving long-term financial sustainability.

To generate steady revenue, the platform plans to launch a premium subscription tier called Session Pro. Similar to Telegram Premium, Session Pro will offer power users advanced features — such as higher message character limits, expanded group sizes, more pinned chats, and animated profile pictures — backed by cryptographic proofs that preserve user anonymity during payment.

Most pressing, however, is finalizing Session's Protocol V2. Beyond reintroducing Perfect Forward Secrecy (PFS), it will also introduce post-quantum cryptography to secure users' chats against 'harvest now, decrypt later' threats.

While the wider InfoSec community continues to be divided on whether Session's custom architecture outperforms legacy rivals, the core team remains fiercely dedicated to the project.

"Many former team members are incredibly passionate and are taking pay cuts or donating their time to help get it back together," said McCabe.

And with mandatory age verification, lawful access to data, and encryption backdoors challenging the very notion of online privacy globally, it seems that messaging app like Session are going to become increasingly important.

As McCabe puts it: "People often don't realize they need this level of privacy until things go really badly and freedom of speech is restricted."

If you want to support the platform, Session continues to accept donations directly through its official website and mobile application.

• Broadcasters in France, Spain have submitted a formal complaint to FIFA
• Rightsholders labeled the partnership with ExpressVPN as "disastrous"
• ExpressVPN previously refused to implement sweeping anti-piracy blocking

FIFA’s decision to partner with ExpressVPN for the 2026 World Cup has sparked outrage among top European football broadcasters.

La Liga and French media giants, including LFP Media and Canal+, have formally submitted a complaint to football's governing body, slamming the new sponsorship as a "disastrous" message to the football ecosystem, according to reports from French sports newspaper L'Equipe.

"La Liga believes that this agreement is manifestly incompatible with the principles of protecting football's audiovisual rights that should govern the actions of world football's governing body," said La Liga president Javier Tebas.

Rightsholders are furious that FIFA would accept sponsorship money from a company they previously targeted with lawsuits for "facilitating access to pirated content," Tebas added.

In a statement to TechRadar, a spokesperson for ExpressVPN strongly denies such allegations.

"Any suggestion that ExpressVPN has been 'found guilty' of facilitating piracy is entirely inaccurate; we have not been convicted of any such conduct in any jurisdiction," the company told us.

While reiterating that a virtual private network (VPN) is a privacy and security tool — "not a loophole for illegal activities" — ExpressVPN also argues it has already presented a framework to national and EU authorithies to tackle the illegal distribution of copyrighted content, without breaking its no-logs VPN commitment.

For everyday football fans and privacy advocates, this corporate clash highlights the growing tension between rightsholders wanting total control over internet traffic and privacy companies defending open, unrestricted access.

If you are looking to secure your digital footprint, utilizing the best VPN is essential to bypassing unfair network restrictions and ensuring your online activity isn't monitored by your internet service provider (ISP) or third-party organizations.

A clash of privacy and anti-piracy

In France, organizations like the Association for the Protection of Sports Programs (APPS) have aggressively pursued court orders forcing ISPs and tech companies to block access to pirated streams.

ExpressVPN has historically resisted these demands, refusing to implement network-wide blocks. This staunch defense of an open internet led to the VPN provider being formally condemned in the country, making FIFA's sponsorship announcement a bitter pill for French broadcasters to swallow.

The situation has escalated similarly in Spain, where La Liga's president has spearheaded a controversial crusade against illegal streaming. La Liga’s heavy-handed tactics have been heavily criticized by digital rights groups, especially after a recent anti-piracy campaign backfired spectacularly, wrongly blocking over 500,000 legitimate websites in Spain.

The Spanish league has also previously attempted to fine individual users and pressure tech platforms into handing over user data. With La Liga’s war on piracy breaking the internet in Spain, privacy experts have warned that your VPN could be the next target.

Despite the immense legal pressure and the latest formal complaint to FIFA, top VPN providers have consistently argued that enforcing rightsholder site-blocks fundamentally compromises the security and architecture of a privacy service.

In fact, NordVPN recently won a crucial legal battle in Spain over La Liga piracy fines, establishing a major victory for user privacy against copyright holders.

Meanwhile, the climate in France remains incredibly hostile for privacy tools.

Earlier this year, a French court backed the LFP and ordered top VPNs to block illegal football streams. This sweeping injunction set a dangerous precedent, forcing the VPN industry to react to France’s aggressive order to block illegal streaming sites and defend the technical realities of zero-logs infrastructure.

• Russia’s Digital Development Ministry confirmed it has completely dropped its plan to charge users for international internet traffic.
• The proposal initially aimed to charge users roughly 150 rubles per extra gigabyte after a 15GB monthly allowance.
• Demand for censorship circumvention tools remains at an all-time high as the Kremlin continues its broader crackdown on digital privacy.

Internet users in Russia can breathe a sigh of relief as the government has abandoned its controversial plan to tax international mobile traffic.

The proposal, which heavily targeted those using the best VPN services to bypass state censorship, would have forced residents to pay steep premiums to access a free and open internet.

The policy reversal was confirmed during a recent State Duma session by Deputy Minister of Digital Development, Ivan Lebedev.

Responding to parliamentary questions about the initiative from Communist Party lawmaker Oleg Smolin, Lebedev categorically stated: “Fees for foreign traffic are not being considered”, according to reports from Meduza.io.

First introduced during a late March meeting between Digital Development Minister Maksut Shadayev and domestic telecom operators, the plan aimed to hit privacy-conscious users' wallets.

Because Russian carriers inherently classify VPN data routing as international traffic, the government intended to implement a strict 15-gigabyte monthly cap. According to initial reports from the BBC’s Russian service, authorities intended to charge users roughly 150 rubles for every additional gigabyte consumed beyond that limit.

The sudden U-turn comes after months of ongoing logistical hurdles and industry pushback. The tax was initially scheduled to take effect on May 1, but was subsequently postponed to June 1 after the Russian business daily Vedomosti reported that carriers were not ready to configure their billing systems.

The deadline was later pushed again to "closer to fall" or after the September elections, before finally being scrapped altogether.

As previously reported by TechRadar, an inside source confirmed that Russia's internet regulator, Roskomnadzor, lacks the technical abilities to effectively prevent residents from using VPNs at scale.

A temporary victory in a wider digital crackdown

While the scrapped tax is a definitive win for privacy advocates, it remains just one battle in an increasingly hostile digital war.

Russian demand for circumvention tools has surged dramatically following the state-ordered blocking of major global platforms, including YouTube, Facebook, Instagram, WhatsApp, and Telegram.

Without a VPN, everyday citizens are largely cut off from independent news sources and international social networks.

Rather than relying purely on financial deterrents, the Kremlin has steadily escalated its technical and legislative attacks to plug the gaps.

By mid-April, authorities successfully pressured major domestic internet platforms to comply with new regulations, actively restricting users from accessing their sites and apps while a VPN was enabled.

Cybersecurity experts have also repeatedly warned of more drastic state-led interventions aimed at entirely isolating the country's internet infrastructure from the rest of the world.

For now, millions of citizens continue to rely on robust privacy tools to navigate the web safely and maintain digital contact with the outside world. If you find yourself dealing with this restrictive landscape, learning exactly how to survive Russia's VPN crackdown is more crucial than ever.

• New Zealand's Education Minister denies any plans to restrict or ban VPNs
• Reports previously alleged it was part of the teen social media ban package
• Prime Minister Christopher Luxon also confirmed "no plan to ban VPNs"

The New Zealand government has officially denied any plans to restrict or ban VPN apps as part of its upcoming under-16 social media ban, putting an end to intense speculation and a rapid backlash from digital privacy advocates.

The saga began following a report from The Post that Education Minister Erica Stanford said the government was considering any restrictions on VPNs as part of the country's under-16 social media ban.

Because a Virtual Private Network (VPN) can easily spoof a user's location and bypass local network blocks, the technology was viewed by some officials as a potential roadblock to enforcing age verification mandates.

New Zealand VPN ban's privacy backlash

The notion of banning vital encryption software sparked immediate political and public pushback. Coalition partners quickly distanced themselves from the idea, with the ACT party reportedly marking any anti-encryption measures as a strict red line — The Post reported.

The Free Speech Union also lambasted the concept. Critics warned that a VPN ban would undermine digital free speech and put New Zealand in the same category as oppressive regimes that strictly control internet access.

“The Government wants the power to prohibit technologies New Zealanders use every day, because those technologies make it harder for the state to control what we see and say online. That is not child protection, it is censorship infrastructure," the organisation said in a statement.

Following the uproar, the government changed its tune.

In a recent media stand-up, Prime Minister Christopher Luxon put the rumors firmly to rest. "I can reject that outright. There's no plan to ban VPNs at all," Luxon said. "I don't know where that reporting or where that story came from, but I can reassure you that's not the case".

Shortly after the Prime Minister's remarks, Stanford’s office officially clarified its position, stating that the Government is "not looking at restricting or banning VPNs". For anyone relying on the best VPN to secure their personal data, the rapid reversal is a significant victory.

Circumvention tool or essential security?

The brief controversy in New Zealand highlights a growing global debate surrounding age verification laws and privacy tools. As governments worldwide attempt to regulate how minors interact with the internet, VPNs have increasingly found themselves in the crosshairs of lawmakers seeking foolproof ways to enforce their legislation.

Because a VPN encrypts your internet connection and masks your IP address, it is commonly used to bypass geo-blocks and content filters. This makes it an obvious workaround for teenagers looking to dodge age gates.

However, treating VPNs purely as circumvention software fundamentally misrepresents what they do. They are essential security tools used by millions of businesses, journalists, and everyday citizens to protect sensitive data from hackers, intrusive ISPs, and mass surveillance.

New Zealand’s flirtation with anti-VPN measures mirrors the shifting role of VPNs in the UK. This friction is also visible in Europe. The EU recently signaled that VPNs could be targeted next to prevent users from bypassing local rules.

The reality is that age verification has changed the internet, and authorities are desperately searching for ways to enforce digital borders. Yet, as Australia's social media ban shows, heavy-handed child safety measures are incredibly difficult to implement — with or without a VPN.

Ultimately, lawmakers must strike a delicate balance. Enforcing a social media ban should never come at the cost of weakening the cybersecurity infrastructure that protects the wider population.

The question remains: could the UK’s social media ban, or New Zealand's, lead to real VPN restrictions? For now, at least in New Zealand, the answer is a resounding no.

• Proton VPN added 89 new Brazilian servers to combat network congestion
• This follows intense World Cup streaming traffic that flooded its servers
• Football fans globally are using VPNs to watch matches on CazeTV

Proton VPN has been forced to drastically expand its South American infrastructure, deploying 89 new servers in Brazil over a single week to combat massive network congestion caused by 2026 World Cup streaming.

The Swiss-based privacy provider confirmed the rapid rollout after its existing Brazilian servers struggled under the immense weight of international fans bypassing geo-restrictions to stream the tournament. The massive influx of traffic specifically spiked during the Brazilian national team's matches, grinding connections to a halt for some users.

According to Proton VPN, the culprit is the immense popularity of CazeTV, a Brazilian YouTube channel showing the entire tournament for free. Savvy football fans are utilizing the best VPN services to route their internet traffic through Brazil, unlocking the geo-blocked broadcast.

The sudden demand forced the company’s engineering team to take drastic action ahead of the heavily anticipated Brazil vs. Norway fixture, working overnight to ensure their network could handle the load.

"Please don't break these too"

The sheer scale of the server upgrade highlights just how much bandwidth live 4K streaming demands.

General Manager at Proton VPN, David Peterson, confirmed the emergency rollout in a post on X (translated from Portuguese): "Fans, you can rest easy: the ProtonVPN infrastructure team pulled an all-nighter reinforcing servers in Brazil. That's +59, on top of the 30 already added this week."

Peterson assured users that the network was now ready, adding: "To watch Brazil vs. Norway today via Proton VPN, just connect and cheer."

The official Proton VPN account also took to X to address the unprecedented traffic surges directly.

"Every time Brazil plays, our 🇧🇷 servers get flooded," the company stated. "We assume Brazilians abroad are connecting to our Brazil servers to watch the World Cup for free on the CazéTV YouTube channel. We've added a bunch more servers to help with that. Please don't break these too."

How CazeTV is driving the VPN boom

If you are already using a VPN to tune in to the World Cup, Proton VPN’s swift infrastructure upgrade is excellent news.

Adding extra servers directly increases the overall bandwidth available in the region. This reduces the load on individual servers, meaning your connection is much less likely to stutter just as your team lines up to take a crucial penalty.

For those who want to try the workaround themselves, the setup process remains incredibly simple. You can read our full guide on how to watch CazeTV from outside Brazil with a VPN for step-by-step instructions.

Just remember that streaming 4K video requires strong, consistent speeds. Furthermore, most free VPN plans restrict access to South American servers, so you will likely need a premium subscription to reliably grab a virtual seat in the stadium.

• Amnezia VPN has restored its Premium service in Russia
• Amnezia Free is expected return in the coming weeks
• Roskomnadzor blocked over 90% of its local servers between June 1 and 15

Russian privacy provider Amnezia VPN has successfully restored its Premium service for users in the country, after suffering an unprecedented state-backed infrastructure strike.

Between June 1 and June 15, millions of Amnezia users in Russia lost their connection after the state censor, Roskomnadzor (RKN), launched a multi-pronged offensive that blocked over 90% of the provider's local servers.

The strike represents a dramatic escalation in Moscow's digital crackdown, deploying automated network fingerprinting and targeted cyberattacks to actively hunt down VPN infrastructure.

While the Premium tier is now back online with a newly updated, stealthier protocol, Amnezia has confirmed that its Free tier's Russian service will return in the coming weeks.

For internet users trapped behind Russia's "sovereign internet" firewall, the stakes have never been higher. Identifying the best VPN has become a critical lifeline to the free web as the state dumps massive resources into its censorship machine.

A sophisticated, $898 million censorship machine

According to Amnezia’s incident analysis, Roskomnadzor has abandoned basic IP-blocking in favor of a highly automated, aggressive ruleset.

By analyzing network traffic, Russian authorities appear to have learned to identify the unique "network fingerprint" of specific VPN protocols — Amnezia's proprietary AmneziaWG protocol included.

Once RKN's internet censorship and filtering system (known as TSPU) detects this fingerprint, it automatically blacklists the server's IP address. During the June assault, Amnezia attempted to swap out its servers, only to see the fresh IP addresses blocked within hours.

This technological leap is heavily state-funded. Forbes Russia and Kommersant estimate nearly 60 billion roubles (770million) is being spent to strengthen the filtering system, while The Moscow Times projects a wider RKN budget allocation of 70billion roubles (898 million) between 2026 and 2028.

To compound the technical assault, RKN paired its deep packet inspection with traditional hacking tactics, launching active DDoS attacks on VPN services. This wave of attacks even targeted the Amnezia website, while deploying phishing schemes against the provider's staff.

Mazay Banzaev, founder of Amnezia VPN, believes this escalation is proof that Roskomnadzor had been preparing a new set of rules for the TSPU for a long time, and fully applied them on June 1. He now expects these measures to be extended to other services operating in Russia.

"Such practices have been used in other countries too, Iran and China, for example, but in Russia they have been taken to a new level of automation: on average, a server is blocked within a few hours of users beginning to connect to it," said Banzaev.

Bouncing back with better security

Despite the severity of the attack, Amnezia confirmed that no infrastructure was breached and user data remained secure, crediting regular security audits by independent cybersecurity firm 7ASecurity.

To bypass the new TSPU ruleset, Amnezia has dropped a new version of its AmneziaWG protocol. This update strips out the fingerprint that allowed censors to identify the VPN traffic in the first place. Users must update their AmneziaVPN client to restore their connection, as the provider has intentionally disabled older, vulnerable versions of the app to prevent repeat attacks.

To make up for the downtime, Amnezia is also compensating affected users. Premium subscribers on a 6-month plan will receive one extra month of service, while those on 12-month plans will receive two additional months.

The provider now has its sights set on future expansion, noting that interest in circumventing state censorship continues to surge globally. Amnezia plans to expand its network to 100 locations while developing new, open-source methods to outsmart the censors.

Are you a Google user living in the European Economic Area (EEA), the UK, or Switzerland? If so, you have probably received a message from the tech giant informing you that it will soon start using your IP address for advertising measurement purposes.

Google has so far only used IP addresses to route traffic and display adverts in these regions. However, as reported by Bleeping Computer, from 4 August, it will allow third parties to show you more personalised adverts by tracking your activity via your IP address.

The move raises questions about compliance with the GDPR in the EU and UK, which classifies IP addresses as personal data. Under current regulations, companies must obtain users’ consent before tracking IP addresses for the purpose of personalising adverts.

Indeed, the tracking of IP addresses in the EU is regarded as 'fingerprinting' — an invasive profiling practice that tracks an individual and their devices to link their digital activities. IP addresses can help identify your device, making it much easier for third parties to build a profile and bombard you with targeted ads while potentially exposing your data to hackers.

Google has stated that it is now shifting the burden of complying with the regulations in these regions onto advertisers, reminding them to adhere to its EU User Consent Policy and to obtain valid consent from users in the regions concerned, thereby placing much of the responsibility for managing and tracking IP addresses directly on these companies.

The days when the tech giant promoted a privacy-friendly digital environment now seem a distant memory. However, the best VPNs can help you retain control over your IP address.

What Google’s IP-tracking means for your privacy

Google's new initiative could mark a significant turning point in terms of consent. Above all, it involves the creation of persistent profiles based on users' activities.

By placing the responsibility for obtaining consent on advertisers, while at the same time making it impossible for users to delete their own 'digital footprint' themselves, the Big Tech giant heavily impacts users’ online privacy.

Additionally, advertisers may implement consent banners in ways that are unclear or designed to encourage users to click 'accept', leading regulators to question whether the new system truly respects users' choices.

Although users might soon be able to manage IP-based personalisation, current opt-out options are limited to existing cookies and ad personalisation settings — meaning that, at present, users have little control over this new form of profiling.

It is particularly clarifying that Google itself was previously against the move, having completely U-turned from 2019, when it recognised fingerprinting as 'wrong', claiming it undermines users’ freedom of choice.

However, in 2024, the platform backtracked on its pro-privacy stance and lifted the ban on advertisers' use of fingerprinting, almost immediately raising concerns at the UK's Information Commissioner's Office (ICO), which described the reversal as 'irresponsible'.

Awkwardly for Google, new developments come just one month after the ICO published its 2026 guidance, where it reiterated that tracking a person's digital activity across different websites to build a behavioural profile will continue to require users' explicit consent.

How can a VPN help?

A virtual private network (VPN) gives you control back over these issues, as it spoofs users' IP addresses to minimise tracking — routing your traffic through remote servers and fooling websites you visit into thinking you’re somewhere else.

Leading providers, including NordVPN, Surfshark and Proton VPN, offer services such as ThreatProtection, CleanWeb and NetShield, which provide both shared and dedicated, static IP addresses, as well as blocking trackers, reducing cookie pop-ups and using alternative IDs, making IP-based identification harder.

A handful of secure free VPNs, including ProtonVPN Free, Windscribe Free, and Privado VPN Free, are also worth the game. However, these solutions usually have limitations, often a limited number of servers, which can slow down connection speeds and cause traffic congestion.

In recent years, some top VPNs have also integrated anti-fingerprinting technologies. Windscribe, for example, has added such a feature on its Chrome and Edge browser extensions, while Mullvad VPN developed the Mullvad browser with fingerprinting resistance.

Finally, using a privacy-first browser like Mozilla Firefox, which incorporates an ad-blocker, free proxy, and fingerprinting protections, will help minimise IP-tracking for ad personalisation, making unpleasant ads a distant memory.

• US football fans turned to VPNs to avoid hydration break ads
• Planet VPN saw a 57 per cent surge on the first day of the World Cup
• A VPN lets you access international coverage of games

VPN downloads in the US have surged as football fans seek ways to enjoy the World Cup without being interrupted by 'hydration break' ads, according to the latest data from Planet VPN.

Introduced this year by FIFA, hydration breaks have significantly altered the football tournament's viewing experience, with fans around the world complaining online that the interruptions are heavily disrupting the momentum during matches.

But whilst in the UK broadcasters use these minutes to provide tactical analysis of the games or to show players taking a breather, in the US viewers are forced to sit through minutes of non-stop adverts.

Desperate to have a smoother experience, Americans have massively turned to the best VPN apps to watch international live broadcasts instead.

Nobody likes ads

Planet VPN recorded a staggering 57% spike in downloads just on the opening day of the tournament. Its new users on iOS almost doubled, while premium subscriptions in the US more than tripled since the tournament began.

Perhaps unsurprisingly, downloads peaked at +343% on 19 June —precisely the same day as the match between the US and Australia.

For Konstantin Levinzon, co-founder of Planet VPN, it is obvious that football fans are turning away from Fox’s lengthy ad breaks to tune in to international broadcasters, where interruptions are filled by experts such as Roy Keane and Wayne Rooney.

It is a huge business for US television: according to a recent BBC report, these adverts could generate over £189 million. However, fans seem to hate them, especially when broadcasters interrupt the live coverage for ads — and only return after the match has started, as Fox did during the opening match between Mexico and South Africa.

Needless to say, a virtual private network (VPN) is a huge asset in such situations. It allows you to route your internet traffic through servers located all over the world to bypass geographical restrictions that would otherwise prevent you from accessing local streaming platforms.

This way, no matter where you are, you can access your preferred coverage and watch ad-free content on BBC iPlayer and ITVX in the UK, SBS on Demand in Australia, or RTE Player in Ireland — streaming football exactly as if you were in a London or Dublin pub.

And let’s not forget that VPNs encrypt your browsing data and protect it from cybercriminals. Levinzon reminds users to choose a VPN by taking certain specific features into account: "We always recommend choosing a VPN provider that doesn't track users without consent or keep logs of their activity, sticking to trusted, legal streaming services to keep your data secure."

The perfect World Cup ally

VPNs are the perfect companion for the World Cup. In the US, for example, where most games sit behind a paywall, VPNs enable viewers to virtually ‘travel’ to other countries where the same matches are free to watch.

Additionally, streaming demand places high strain on servers during major matches, when millions of fans log in at the same time, causing ISP peering issues, network congestion, and mid-match buffering. If you use a VPN, you are basically leaving the ‘data traffic jam’ everyone else is stuck in for a smoother experience.

Furthermore, VPN speeds are further optimised via modern protocols such as WireGuard, while additionally offering a wide range of traffic routing and speed optimisation features.

The icing on the cake? You can access commentaries from all over the world — from Brazil to Turkey to India. Their locations will affect their perspective and focus, hopefully making your experience even richer.

• Malaysia beefs up action against VPN used to facilitate crimes
• Misuse includes bypassing the new under-16 social media ban
• Officials have stressed that owning or using a VPN is not an offence

Malaysia is set to take action if VPN are used to facilitate criminal activities or help residents bypass the new social media age limit.

According to local reports, Deputy Home Minister Datuk Seri Dr Shamsul Anuar Nasarah said the government is working closely with the Malaysian Communications and Multimedia Commission (MCMC) to counter VPNs and borrowed identities that are being used to slip past newly enforced social media age limits.

For the many people who reach for the best VPN services to protect their browsing, encrypt their traffic, or simply keep their data out of advertisers' hands, the reassuring takeaway is that the tool itself is not the target. What the authorities want to reach is the small share of activity where a VPN is used as a shield for something illegal.

What Malaysia actually announced

The comments came during a question-and-answer session on cybercrime and age verification. Shamsul Anuar explained that police would draw on public complaints and their own investigations to identify cases where VPNs or identity-masking tools are being abused, and that such misuse could be treated as an added element of an offence.

He was clear that the crackdown is aimed at conduct, not software. The minister framed the effort as part of Malaysia's wider push to protect children online, pointing to a sharp rise in offences.

This sits on top of Malaysia's under-16 social media ban, which took effect on 1 June 2026 under the Online Safety Act 2025. Large platforms including Facebook, Instagram, TikTok, and YouTube must now verify users' ages and block under-16s from registering, with non-compliance carrying penalties reported at up to RM10 million.

VPNs enter the picture because they are an obvious way to make it look as though a user is somewhere the rules do not apply. Age verification laws elsewhere, such as Australia and the UK, have repeatedly triggered spikes in VPN sign-ups, with many often being adults looking to protect the sensitive documents these systems ask them to hand over.

What it means for everyday VPN users

For most people, this is not a reason to stop using a VPN, and it is not a ban in disguise.

Digital rights groups, however, have been sharply critical of the age-verification model underpinning the ban.

ARTICLE 19, alongside local partners, has argued the measure was rushed, is disproportionate, and risks normalising surveillance while exposing people's identity documents and biometric data to misuse.

• Proton, Windscribe, and PureVPN launched a satirical campaign to make fun of the gaming sector's digital shift
• PlayStation said it will stop releasing games on discs in 2028
• The satirical stunt highlights growing consumer concerns about digital ownership, server shutdowns, and game preservation

The ongoing debate over digital ownership in the gaming industry, which follows Sony's announcement to stop releasing PlayStation games on discs by 2028, has found an unlikely group of critics in VPN firms.

In a coordinated display of industry satire, several of the market's best VPN providers have begun openly trolling the gaming sector's controversial shift away from physical media.

Leading the charge is Swiss privacy company Proton, which first released a parody announcement on Thursday declaring that "in response to the gaming industry removing physical offerings moving forward, we've decided to fill in the gap by making our services entirely physical, starting 1st April 2027."

The stunt took direct aim at the frustrations gamers face as digital storefronts increasingly replace physical discs.

Rival providers quickly jumped on the bandwagon. Both Windscribe and PureVPN also took to X to join the trend, adding their own satirical jabs at the gaming industry's expense.

Earlier this week, Windscribe sparked a different conversation online when it parodied Mullvad's recent political donation crisis.

Encrypted letters and human password managers

Proton's fake announcement outlined a hilarious reverse-digitalization strategy, presenting the idea of making completely physical versions of inherently digital services.

According to the satirical campaign, Proton Mail will soon post "encrypted letters hand-delivered by team," while its passcode service will be replaced by "someone who follows you around and remembers your passwords for you."

The jokes extended to the company's flagship networking and storage products. Proton VPN humorously claimed it would send its clients to one of their 90 plus server locations so they could browse online "like a local." Meanwhile, Proton Drive users were promised a folder would be shipped to them with "an additional folder available on request".

Artificial intelligence wasn't spared from the joke, either. The company announced its AI assistant, Lumo, would become an actual "smart" employee sent to a user's location to "answer questions, help with work, and draw things."

Even David Peterson, Proton VPN General Manager, joined in the fun and said that "using the Secure Core option to fly you via Iceland is the most private option, but may cause some latency."

While Proton has no intention of substituting its digital services for physical ones, the broader message resonated strongly with the gaming community.

A joke with a serious message for gamers

Behind the coordinated trolling from Proton, Windscribe, and PureVPN lies a genuine consumer rights issue. The gaming industry has aggressively pivoted toward digital storefronts and subscription models, leaving players increasingly concerned that purchasing digital titles merely grants a license for using games, not owning them.

The problem of game preservation has become a hot-button topic. As noted by the campaign's underlying message, there is a very real danger that digital games could become permanently unavailable in the case of "server shutdowns, changes in licensing agreements, or the publisher removing their products from online stores."

Physical media, while fading from retail shelves, offer tangible, long-term ownership, a stark contrast to the volatile nature of digital libraries. Many players argue that physical copies provide much stronger consumer protections.

By playing on the irony of current digitalization trends, Proton and its peers successfully weaponized satire to champion consumer rights.

The campaign aligned perfectly with the VPN companies' overarching aim of protecting users' privacy and giving them more freedom regarding their personal data. Ultimately, it proves that these privacy giants aren't afraid to have a little fun while sparking a crucial conversation around digital ownership.

• India is reportedly working on new VPN regulations
• Companies could be forced to establish an office in the country
• VPNs found workaround to previous restrictions

India is working on an expansive new legal framework to clamp down on virtual private networks (VPNs), with proposals reportedly including mandatory local offices, designated compliance officers, and even prison terms for non-compliance.

According to The Indian Express, the upcoming rules aim to make VPN providers legally liable when citizens use their tools to circumvent government-mandated content blocks.

"In the last few months, we have been observing that users are able to bypass content, accounts, and online services that have been blocked by the government on various grounds by using VPN services," an anonymous senior government official told reporters.

This new set of rules is also seen as necessary, officials admitted, as the controversial data retention law enforced in 2022 by the Indian Computer Emergency Response Team (CERT-In) has proved to be unsuccessful.

The directive legally requires VPN firms, data centers, and cloud providers to log sensitive user information — including real names, verified IP addresses, and usage patterns — for up to five years, and surrender it to authorities upon request.

Yet, major VPN companies, including the likes of ExpressVPN, NordVPN, Hide.me, Surfshark, and Proton VPN, found a simple way to avoid compliance — removing their physical servers from the country.

"They have simply refused to comply. So, the need for a full-fledged law is being felt," the senior official told The Indian Express.

What's at stake for India's VPN users?

Beyond encrypting user data to boost privacy and security, virtual private networks (VPNs) spoof IP addresses, allowing users to bypass local, state-enforced geo-restrictions.

This capability has become critical for local internet users. Last month, India experienced a massive spike in VPN downloads after the government temporarily blocked the messaging app Telegram due to concerns over exam fraud.

Just weeks earlier, the Ministry of Electronics and Information Technology (MeitY) ordered VPN firms to actively block access to the decentralized prediction platform Polymarket, threatening legal repercussions if they refused.

The proposed framework aims to hand New Delhi the necessary legal teeth to force VPN providers into enforcing these content bans on the government's behalf. Digital rights groups frequently criticize India's aggressive approach to censorship; according to data trackers, the country consistently leads the world in government-imposed internet shutdowns.

While specific details of the draft framework remain scarce, leaked proposals suggest that offshore VPN companies will be required to establish a physical corporate presence in India and appoint local compliance officers to act as direct government liaisons.

Criminal penalties for non-compliance are also on the table, including potential prison sentences for local employees if an order is ignored.

However, serious questions remain over how authorities plan to enforce these rules. For many global VPN providers, simply keeping their physical servers outside of Indian borders has previously been enough to circumvent local jurisdiction.

It is also unlikely that premium, strict no-logs services will fundamentally alter their server infrastructure to comply with New Delhi's demands — especially after resisting a similar ultimatum four years ago.

Dr. Pete Membrey, Chief Research Officer at ExpressVPN, pointed back to the company's 2022 decision to become the first major provider to pull its physical servers from India, confirming that its stance remains.

"We’ll evaluate when a proposal is published," Membrey told TechRadar, adding that "ExpressVPN will continue to work hard to keep users connected to the open and free internet, no matter where they are located."

A Surfshark spokesperson also said that the company remains committed to upholding the privacy of its users.

TechRadar reached out to India's Ministry of Electronics and Information Technology (MeitY) and CERT-In for further clarification on the draft framework and an expected enforcement timeline. Neither agency responded prior to publication.

• Brazilian YouTube channel CazéTV hit a record 12.4 million concurrent viewers by streaming the World Cup for free in 4K
• Fans use VPNs to bypass local paywalls and access the legal broadcast
• While the Portuguese commentary limits global appeal, fans can still use a VPN to find other free international streams

The 2026 World Cup is in full swing, and millions of football fans have found a new, entirely legal way to dodge expensive broadcaster paywalls: YouTube.

Viewers across the globe are turning on the best VPN to access CazéTV, a Brazilian YouTube channel that is currently streaming all 104 matches of the tournament for free in gorgeous 4K.

Run by 32-year-old Casimiro Miguel, a streamer who originally started on Twitch, CazéTV has become the breakout broadcast story of the tournament. During Brazil's opening game, the channel peaked at an astonishing 12.4 million concurrent viewers. This shattered records, becoming the largest live audience in YouTube's history and marking the first time a solo streamer channel has crossed the 10 million mark.

The global appetite for this high-quality, cost-free feed is staggering. With the stream geographically licensed only to Brazil, international fans are masking their IP addresses to get in on the action.

The YouTube revolution vs traditional paywalls

For years, major rights-holders have argued that steep paywalls are the only viable way to fund live sports. CazéTV, which fun fact, counts football legend Cristiano Ronaldo as a stakeholder, is a direct challenge to that outdated model. While Brazil's longtime broadcast giant, Globo, carries just 55 matches, CazéTV is legally broadcasting the entire tournament without asking fans for a dime.

Yegor Sak, founder of VPN provider Windscribe, notes that this unprecedented surge reflects years of consumer frustration.

"One channel on YouTube is out-broadcasting the official rights-holders, in 4K, for free, and pulling the biggest live audience the platform has ever seen," Sak said. "The paid broadcasters should find that alarming. Fans know exactly what they want, and it isn't another paywall."

Because broadcast rights are sold country by country, fans are often forced to pay premium subscriptions to watch their national teams. However, tuning into a foreign YouTube channel via a VPN is not piracy; it is simply consumers seeking out the best legal value.

"The barrier was always artificial," Sak added. "CazéTV just proved the appetite was there the whole time."

Language barriers and global alternatives

"People aren't trying to do anything wrong, they're looking for value," Sak explained. "When a free, legal, high-quality stream exists and your local broadcaster wants money on top of a subscription you already pay for, the choice makes itself."

However, there is a catch for international audiences. Because CazéTV is a Brazilian broadcast, all commentary is in Portuguese. While the stunning 4K visuals are universally understood, the language barrier does somewhat limit the stream's ultimate 'global' appeal for those who want tactical analysis in their native tongue.

Interestingly, other FIFA partners do have agreements in place that give them the option to show full matches on YouTube and strengthen coverage, but major networks have largely neglected this route, likely because it doesn't align with their subscription-heavy financial models.

If Portuguese commentary isn't for you, there are still plenty of ways to bypass the paywall. If you're wondering should I use a VPN to watch the World Cup, the answer is a resounding yes. By routing your connection through servers in countries like the UK or Australia, you can easily access free, English-language broadcasts on platforms like BBC iPlayer or SBS.

Just remember that if you are streaming on the go, it is worth tweaking these 5 VPN settings to keep your connection fast so you don't suffer buffering during a crucial penalty shootout. With a reliable provider, you can watch the World Cup 2026 for free from anywhere, entirely on your own terms.

• Spain's LaLiga anti-piracy blocks disrupted at least 554,507 legitimate domains between January and June 2026, OONI reveals
• Blocking just 4 to 20 IP addresses during a one-hour match window knocked out over 400,000 unrelated websites
• Researchers also uncovered alarming TLS Man-in-the-Middle (MitM) interception tactics on one Spanish ISP

Football fans in Spain aren't the only ones feeling the impact of LaLiga's aggressive war on illegal streaming. A staggering new report shows that the league's court-authorized anti-piracy campaign has accidentally disrupted access to more than 500,000 legitimate websites, taking down everything from human rights platforms to vital cloud infrastructure.

According to a June 2026 report published by the Open Observatory of Network Interference (OONI), Spain's IP-based blocking campaign caused widespread collateral damage between January and June 2026.

The nonprofit organization, which specializes in measuring global internet censorship, found that at least 5.8% of the 9.2 million most popular internet domains were blocked at least once during football match broadcasts.

The sheer scale of this collateral damage highlights a fundamental flaw in current anti-piracy tactics. Because much of the modern web relies on shared hosting and content delivery networks (CDNs), attempting to block a single illegal stream by banning its IP address often drags hundreds of thousands of innocent websites down with it.

If you want to bypass these broad regional blocks, using the best VPNs is increasingly becoming a necessity for Spanish internet users trying to maintain access to the open web.

The collateral damage of La Liga's anti-piracy blocking

The collateral damage stems directly from how the internet is built. Providers like Cloudflare, Amazon, Microsoft, and Meta use shared reverse-proxy architectures, meaning thousands of entirely unrelated domains sit behind a single IP address.

OONI’s data shows that blocking as few as four to 20 IP addresses in a typical one-hour LaLiga broadcast window was enough to make over 400,000 unique domains completely inaccessible.

Throughout the observation period, OONI discovered the enforcement impacted 7,441 unique IP addresses across 36 infrastructure providers. Cloudflare bore the brunt of the outages, with the report identifying over 501,000 impacted domains hosted behind just 2,218 blocked IPs.

Among the collateral damage were benign and critically important websites, including those belonging to Amnesty International and Greenpeace.

Beyond the widespread outages, the anti-piracy tactics have introduced alarming security vulnerabilities.

OONI researchers noted in a post on X that they "detected TLS Man-in-the-Middle (MitM) attacks on Digi Mobil (AS57269), raising privacy and security concerns."

This privacy invasion affected 7,334 unique IPs hosting over 10,759 domain names, exposing Spanish users to potential data interception just to stop them from streaming football matches.

As we covered on Tuesday, there is growing pushback against these reckless enforcement measures. European ISP groups have strongly argued that rightsholders must be liable for collateral damage in piracy blocking, as erroneous court orders from rightsholders like LaLiga are repeatedly breaking the internet.

While OONI admits its methodology has limitations and likely understates the true scale of the impact, the findings paint a bleak picture of IP-based blocking. When taking down a handful of pirate streams knocks out half a million legitimate websites, the cure may very well be worse than the disease.

• Windscribe has released a satirical statement mocking Mullvad's PR crisis
• Mullvad's co-founder donated roughly $500,000 to Sweden's populist Örebro Party, sparking user backlash
• Mullvad confirmed the donation "is not part of Mullvad's values or mission"

Rival providers in the best VPN market rarely miss an opportunity to capitalize on a competitor's misstep, and the ongoing controversy surrounding Mullvad is no exception.

In a satirical response to the recent news that a Mullvad co-founder made a massive political donation, Windscribe has issued a mock apology regarding its own CEO’s financial contributions.

Earlier this week, it was revealed that Mullvad VPN co-founder Daniel Berntsson donated 5 million Swedish kronor (around $514,000) to the controversial populist Örebro Party in Sweden. Berntsson, who stated the donation was made personally to support the party's anti-corruption stance, contributed a sum that accounted for 72% of the party's total income last year.

The disclosure forced Mullvad into damage-control mode. The firm quickly clarified that the private donation "is not part of Mullvad's values or mission," and offered refunds to any users who wished to cancel their subscriptions over philosophical disagreements.

Seizing the moment, Windscribe posted its own tongue-in-cheek statement on social media, assuring users that it wanted to "get ahead of any potential public outcry". The company explained that it would be hypocritical to criticize Berntsson's financial support without disclosing that Windscribe CEO Yegor Sak has also made monetary donations to organizations supporting causes he believes in.

"Let us make one thing clear: we are not here to lie," the statement read. "Yes, our CEO has made donations to a specific side, but today we want to come clean and make things right."

The dogs versus cats debate

Rather than backing a divisive political movement, Windscribe revealed that Sak, the proud owner of a corgi named Snoop, had donated personal funds to Save Our Scruff, a dog rescue in Toronto.

Anticipating that a strict pro-dog stance could "cause division within our userbase", the company quickly added that it had corrected the imbalance.

"So today, we are making one thing clear — we support cats as well, and Yegor has personally donated to the local Annex Cat Rescue organization to support their work," the post noted.

While Windscribe’s parody is light-hearted, it underscores a serious point about brand identity in the cybersecurity industry. VPN users are notoriously privacy-conscious, and they often evaluate a provider's ethical compass just as rigorously as its encryption protocols.

When the executives behind a VPN support controversial causes, it can severely test user trust, regardless of the company's official stance or strict no-logs policies.

Windscribe concluded its post by mimicking the standard corporate PR playbook, asking users to forgive its "lack of transparency" in the pet debate. The company emphasized that Sak's donations are a reflection of his personal beliefs and will not impact the safety or operation of the software.

"Our service and applications are not affected by these donations," the statement concluded. "They remain secure and dedicated to providing our users with the best VPN on the market."

• Researchers found "VPN Go" extensions for Chrome and Firefox secretly harvesting copied text
• The clipboard theft was not there at launch and arrived through a later update
• Anything copied while the extension was active should now be treated as exposed

Security researchers at Socket found two browser extensions distributed under the "VPN Go: Free VPN" branding, one listed on the Chrome Web Store and one on Firefox Add-ons, to secretly harvest copied text.

Both present themselves as free VPN tools with working proxy features. Underneath, Socket says, both also run a clipboard stealer that continuously watches copied text and sends it to infrastructure controlled by the attacker.

According to Socket, the clipboard theft was not present when the extensions first appeared. It was added later, through an ordinary-looking update, after the extensions had already built up a base of trusting users. That staged approach is exactly what makes this kind of threat so hard to spot, and why even a fairly cautious user can end up exposed.

For anyone weighing up a no-cost privacy tool, it is worth knowing that not every free option behaves like this, and the best VPN services are tested precisely so you do not have to take this kind of gamble. But this case shows how thin the line can be between a useful free extension and a data-harvesting one.

What Socket's research uncovered

Socket says the earliest analyzed builds behaved like ordinary proxy extensions, with no confirmed clipboard theft.

On Chrome, that changed with version 1.1, when the extension added a script that reads the clipboard and ships those chunks off to a hardcoded address. The Firefox version followed the same path slightly later, moving the same theft loop into its background script.

Once active, the monitoring is relentless. The Chrome content script checks the clipboard roughly every half a second, according to Socket's analysis, while the Firefox build polls every 1.5 seconds.

Each newly copied value is tagged with a session identifier so it can be reassembled on the other end, then sent out over plain HTTP. All of this was happening while the two apps' privacy policies stated that the tools did not collect, store, or share user data and did not keep activity logs.

TechRadar has reached out to VPN Go for comment, but both email addresses bounced, and both extensions have since been pulled from their stores.

Why clipboard stealers are dangerous for users

The reason clipboard theft is so effective is that it abuses something completely routine. People copy and paste sensitive information all day, and it's not careless to do so. Password managers rely on exactly that: copying long, unique passwords into your accounts.

An extension that can silently read the clipboard has access to all of this information; it just has to wait for you to copy the right thing. If you have used either of the two extensions in question, you should treat any information you've copied during that time as exposed.

Researchers have repeatedly found free VPN extensions doing things their users never agreed to. Recent reporting has covered a free Chrome VPN extension caught taking screenshots of every page its users visited, and a malicious free VPN extension that resurfaced after being removed, returning in a more evasive form.

The pattern is consistent enough that it is worth treating any unknown free VPN extension with caution by default. That caution matters: TechRadar's own polling found that nearly 1 in 4 readers use free VPNs despite knowing the risks.

How to stay safe

If you want the protection a VPN offers without rolling the dice, stick to providers with a track record and independent testing behind them.

A reputable paid service, or one of the carefully vetted best free VPN options, is a far safer bet than an unknown extension promising unlimited access for nothing. As the saying goes, when the product is free, there is a decent chance that you are the product.

• European ISPs urge the EU to hold rightsholders financially liable for taking down innocent websites
• Aggressive anti-piracy blocking in Italy, Spain, France has caused widespread collateral damage
• EuroISPA warns that extending blocking orders to DNS and VPN providers is technically flawed and legally disproportionate

Aggressive site blocking by copyright holders is breaking the internet, and Europe's internet service providers (ISPs) want those rightsholders to foot the bill.

In a recent submission to the European Commission, EuroISPA, an umbrella group representing over 3,300 European ISPs, has strongly criticized the collateral damage caused by imprecise anti-piracy campaigns.

Grounded in research including an April 2026 study by the Centre for European Policy Studies (CEPS), the organization is officially demanding that copyright holders who cause excessive network outages be held accountable and pay for the resulting damages.

For the average user, this growing internet censorship means legitimate web services, educational sites, and cloud platforms are randomly going dark just to stop illegal sports streams. It's a blunt approach that is now threatening the global infrastructure of the web, including the best VPN services.

TechRadar has contacted EuroISPA for a comment on the specific collateral damage of targeting VPNs, and we will update this article if we receive a response.

The current situation in Europe

Over the last few years, major copyright holders like sports leagues have obtained sweeping court orders to block piracy sites using IP-level blocking. But because thousands of legitimate websites often share a single IP address, this method is causing chaos.

The collateral damage is already staggering. In Italy, the "Piracy Shield" system misfired so badly that an erroneous order took Google Drive offline for over 12 hours in October 2024.

We already reported how La Liga’s war on piracy is breaking the internet in Spain. Now, a June 2026 report by the Open Observatory of Network Interference (OONI) revealed that by blocking just a handful of shared IP addresses during match broadcasts, the league inadvertently took down human rights platforms, government domains, and environmental sites, impacting a total of over 500,000 domains.

Despite these massive disruptions, copyright holders face zero direct liability.

To fix this, the ISP group argued that rightsholders should be "held accountable for collateral damage caused by overbroad blocking actions."

According to EuroISPA, compensation mechanisms should be clearly defined and enforceable to ensure that "the burden of enforcement errors does not fall on innocent intermediaries and their users."

VPNs and DNS providers in the crosshairs

As traditional ISPs push back, rightsholders are shifting their aim to other internet infrastructure intermediaries, creating new legal headaches and a dangerous precedent for internet freedom.

In its submission to the European Commission, EuroISPA said to be "deeply concerned" by the approach taken in certain Member States. "Most notably Italy, Spain, France and Austria, where network blocking measures have escalated beyond local access providers to target global infrastructure providers with no direct relationship to the infringing content," the group wrote.

In France, a court backed the Professional Football League (LFP) in January and ordered top VPNs to block illegal football streams for the third time. At the same time, the MPA has pressed for VPNs to have a role in the anti-piracy row in Europe as well. And Italy also plans to require VPN and DNS providers to block pirated content.

However, VPNs and DNS resolvers lack the technical architecture to implement these hyper-local blocks safely. As EuroISPA noted in its submission, they "lack the technical means to apply geographically restricted blocks and are frequently neither based in nor subject to the jurisdiction of the issuing Member State."

Experts have repeatedly warned that DNS resolvers aren't a censorship tool, and that network blocking is never going to be the solution.

Ultimately, EuroISPA argues that "because the Internet is designed to be global and redundant, domain or IP blocking is inherently incomplete and prone to over-blocking."

Forcing rightsholders to pay for their mistakes might be the only way to protect the open internet.

• Mullvad VPN's co-founder Daniel Berntsson donated 5M SEK to the Örebro Party
• Mullvad confirms the donation "is not part of Mullvad's values or mission"
• Örebro party's leader, Markus Allard, is known for controversial views

Daniel Berntsson, co-founder and co-owner of Mullvad VPN, has donated 5 million Swedish kronor (around $514,000) of his personal funds to the controversial populist Örebro Party.

First reported by local news outlet Flamman, the 2025 donation accounted for 72% of the party's total income last year.

"This is a donation from me personally," Berntsson told reporters, saying that he supports the party's anti-corruption stance. In a post on social media, Mullvad confirmed that it was a "private donation," which "is not part of Mullvad's values or mission."

The disclosure has sparked backlash online, with some users threatening to switch VPN providers. The Örebro Party and its leader, Markus Allard, are known for controversial populist stances, particularly regarding "remigration" policies.

Mullvad's response

Speaking to TechRadar, Mullvad co-CEO Fredrik Strömberg confirmed that neither Mullvad VPN AB, its parent company Amagicom AB, nor its sister company Tillitis AB played any role in supporting the political party.

"Speaking for myself, I don’t like that he made this donation, and I know this view is shared by many of my colleagues. Speaking as the co-CEO of Mullvad, we will continue to protect the universal right to privacy," Strömberg said.

The firm also addressed the controversy publicly. In a statement posted to X, the team reiterated that Mullvad operates as a "political company" dedicated to fighting for freedom of speech, freedom of information, and the universal right to privacy.

"We also live these values by being tolerant in our daily work," the post continues. "No matter what their other opinions are and no matter whether the founders or anyone else in Mullvad dislike them. The founders themselves fundamentally disagree on several important issues."

Mullvad said it would "gladly refund" any customers who choose to cancel their subscriptions or switch to another provider due to philosophical disagreements.

The news has attracted criticism, in fact.

One Reddit user said they "deeply regret recommending Mullvad to people over Proton," adding that they will personally switch to Windscribe.

Asked about users thinking of dropping their Mullvad subscription, Strömberg told TechRadar that people should feel safe using Mullvad regardless of their political affiliation.

Why is the donation so controversial?

Defining itself outside the traditional left-right spectrum, the Örebro Party began as a local party in Örebro before launching its parliamentary election campaign this year.

Berntsson's donation appears to have been vital in elevating the party's campaign capabilities ahead of the upcoming election.

According to data collected by DonationWatch, 2025 was the most lucrative year in the party’s history, netting a total of 5.58 million SEK. For comparison, the party received just 202,000 SEK in total donations throughout 2024.

While tech founders are entirely free to hold personal political affiliations, this incident raises broader questions regarding the growing influence of tech wealth in political campaigns. It also forces a conversation about whether privacy-focused firms should be entangled with political groups—regardless of where they sit on the ideological spectrum.

Ultimately, the number of users who choose to cancel their Mullvad subscriptions in protest will serve as a strong indicator of how deeply the privacy-conscious community values neutrality.

• NordVPN discovered adware campaign operating across 50,000 websites
• The malware collects highly specific device data to profile and track you
• The adware can detect and bypass ad blockers with domains that change daily

Who doesn't love a free movie? Unfortunately, a recently uncovered cyber threat is proving the old adage true: if the product is free, you are the product. NordVPN’s Threat Intelligence team has exposed a highly sophisticated adware campaign that has successfully infected at least 50,000 active websites, turning the hunt for free content into a cybersecurity minefield.

The campaign is specifically targeting high-risk corners of the internet, including illegal streaming platforms, torrent portals, underground forums, and adult websites.

Once a user lands on an infected page, the adware — a type of malware that hides behind online ads — deploys invasive tracking scripts to build a persistent profile of the user's device, harvesting data that ranges from their hardware specs to whether they use a crypto wallet.

"If you’re not paying for a product, you are often the product," says Marijus Briedis, CTO at NordVPN, explaining that what looks like a free stream or download can quickly become a gateway to tracking, scams, and malware.

According to NordVPN, the scale of the threat is immense. Every single month, hundreds of thousands of the company's users encounter infection attempts tied directly to this specific adware kit.

How the adware campaign works

The operation works by loading a hidden JavaScript tag the moment a real person visits an infected website. To ensure maximum profit, the adware utilizes a fingerprinting module to build a persistent visitor ID stored directly on your device, allowing operators to track you even without using traditional cookies.

The sheer volume of data collected by this script is staggering. It scopes out your CPU cores, RAM, operating system, and installed plugins.

But it goes further than standard tracking. The adware actively hunts for browser-injected crypto wallet tools like MetaMask, checks for motion signals like accelerometer and gyroscope availability, and even uses favicon checks to figure out if you are logged into YouTube.

This highly specific profile is then likely sold to third parties or used to target you with customized scams.

"This campaign shows how cybercriminals turn user attention, personal data, and risky browsing habits into revenue at industrial scale," said Briedis.

Perhaps the most alarming aspect of this adware is how aggressively it hijacks your browsing experience.

You don't even need to click on a visible advertisement to fall victim. Simply clicking on an ordinary, non-advertising part of the infected webpage can trigger a redirect, immediately sending you to phishing campaigns, malware download sites, or push-subscription traps.

If you think your current ad blocker is enough to keep you safe, think again. The adware actively detects when filtering protections are running in your browser. If it spots an ad blocker, it switches to a proxy bypass mechanism, dubbed "adblock-proxy-super-secret" by its creators, which generates at least three brand new domains every 24 hours.

This constant shifting allows the malware to effortlessly dodge standard security blocklists. It even hides its malicious behavior if it detects a search engine bot, ensuring the infected pirate sites look completely harmless to Google.

How to stay safe

To protect your digital life, NordVPN's CTO Marijus Briedis recommends taking the following precautions:

• Avoid "free" premium content: Stay away from piracy and illegal streaming sites, as these environments are hotbeds for adware and phishing.
• Use tracker protections: Employing reputable ad and tracker blockers limits malicious scripts from executing in your browser.
• Reject push notifications: If a sketchy website asks for permission to send you notifications, deny the request immediately.
• Update your software: Keep your browser and security tools up to date to ensure they can catch the latest malicious scripts and deceptive redirects.

The World Cup draws millions of viewers who want nothing more than to stream the action live. For many fans, this doesn’t just mean watching any broadcast; it means accessing their home country’s service to hear commentary in their native language.

Yet when you travel abroad, live sports streaming often hits a brick wall. Streaming platforms are increasingly aggressive in detecting and blocking VPN connections, making it surprisingly tricky to access familiar home broadcasts from your hotel room or airport lounge.

Understanding how these apps spot your connection and knowing how to bypass their defenses with the best VPN services is key to keeping your viewing experience uninterrupted.

Why streaming services block VPNs (and how they do it)

Streaming services block VPNs because they have strict licensing deals based on location.

Broadcasters pay for exclusive rights to show matches in specific countries. If a user logs in via a VPN to watch games they aren’t licensed for, it breaks those agreements.

To honor these agreements, platforms have no choice but to block these workarounds. For football fans, this creates a frustrating loop: you try to connect, the app spots something is amiss, and you’re hit with an error message before kickoff.

The most common method streaming services use to spot VPN traffic is maintaining a huge, updated blacklist of IP addresses known to belong to data centers. If your connection comes from one of these flagged numbers, you’re blocked immediately.

Beyond IPs, platforms analyze behavior. A genuine user travels slowly over days, whereas a VPN user might appear in London one minute and New York the next, triggering alerts.

Even if your main traffic is hidden, small background requests such as DNS queries can slip outside the VPN tunnel, revealing your real location.

Some services use deep packet inspection to recognize the unique “fingerprints” of popular VPN protocols. If the data looks like it’s running through a tunnel rather than regular browsing, it gets flagged.

How to avoid VPN detection

Navigating these streaming app blocks starts with picking the right settings. While protocols like WireGuard are the best option for raw speed, they don’t inherently hide your traffic better from detection systems than other VPN protocols.

The real key is often the server you choose. Just because one server is blocked doesn’t mean the whole country is out of reach. Sometimes a heavily used server gets flagged while a smaller, less popular one flies under the radar. If you run into trouble, start by switching locations before tweaking anything else.

Before you even test a connection, make sure your browser isn’t working against you. Clearing your browser’s cache and cookies is crucial because old location data stored there can contradict your new IP address and trigger an immediate block, making a good server appear broken.

If problems persist, experiment with your protocol. Although WireGuard is the default choice of many VPN providers – and the fastest – OpenVPN over TCP can sometimes work better on restrictive networks, particularly when those networks block or interfere with UDP traffic.

The best streaming VPNs counter blacklists and leaks by rotating fresh IPs, maintaining private networks to avoid data center flags, and using obfuscation to mask traffic.

Don’t let distance stop you from streaming the World Cup

Knowing how streaming services block access can help you watch the World Cup online from anywhere.

Choose a quality VPN, configure it properly, and stay ahead of detection tricks to keep your connection steady.

For answers on which VPN works best for specific services or where to watch your national team this summer, check our streaming guides and full World Cup coverage.