Proton’s analysis of more than 7,000 mobile VPN apps finds millions of Americans may be using VPN services that track their data, monitor their location, or are linked to foreign companies
Proton today published a new report examining the privacy practices and ownership of mobile VPN applications, finding that a significant number of services available to U.S. consumers may expose users to the very privacy risks VPNs are intended to protect against.
After conducting a months-long analysis of more than 7,000 mobile VPN apps worldwide, Proton found that 85% of VPN apps available in the United States contain trackers designed to collect and share user data. The information collected can include unique device IDs, device models, network information, mobile carrier data, and other details.
The findings are particularly concerning because VPN users typically choose these services specifically to improve their privacy and security.
Millions of Downloads for VPNs Containing Trackers
Proton’s analysis found that tracking is widespread among VPN apps available in the U.S. The company identified 64 VPN apps that actively track users’ physical locations using GPS and other geolocation data.
Those apps include popular services such as VPN Proxy Master, VPN-Fast VPN Super, and X-VPN. Collectively, the apps were downloaded more than 3 million times in the U.S. in June 2026, representing roughly 20% of all VPN downloads in Proton’s dataset.
Location data can be particularly sensitive. According to Proton, access to such information could potentially reveal whether a person is attending a protest or meeting with journalists, lawyers, or other sensitive contacts.
Chinese-Owned VPNs Account for Millions of U.S. Downloads
Proton also examined the ownership of VPN services available through the Apple App Store and Google Play in the United States.
Of the 390 VPNs studied in the U.S., 64 are owned by Chinese companies. Proton found that 31 of those Chinese-owned VPNs conceal their ownership behind shell companies registered in locations including Singapore, Hong Kong, and the United Kingdom.
Those Chinese-owned VPN apps were downloaded more than 3 million times by U.S. users over a single month. Proton notes that Chinese companies can be required under Chinese law to make user data available to the government upon request.
VPN Tracking Data Is Being Sent Around the World
The report also found that VPN apps containing trackers that transmit data to companies in foreign countries accounted for millions of U.S. downloads.
According to Proton’s analysis, VPN apps with trackers sending data to companies in:
- Israel: 2.6 million U.S. downloads
- China: 1.5 million U.S. downloads
- Russia: 1.4 million U.S. downloads
- Five Eyes countries: 4.6 million U.S. downloads
An additional 800,000 downloads came from apps containing trackers that send data to companies in all three of China, Russia, and Israel.
Proton says many U.S.-owned VPN apps use third-party tracking technology through commercial agreements, including white-label VPN products that incorporate tracking software to monetize users through advertising.
Apple and Google Allowed More Than 13.2 Million Downloads
Despite the privacy concerns identified in the report, Proton found that Apple and Google allowed the VPN apps examined in its research to be downloaded more than 13.2 million times in the U.S. during June 2026.
Proton argues that app stores currently rely heavily on developer-provided information and do not independently verify whether VPN applications actually behave according to the privacy policies they provide.
The company is calling on Apple and Google to conduct more stringent security and ownership checks on VPN applications, remove apps that fail those checks, and provide consumers with greater transparency regarding VPN ownership and data practices.
Proton Calls for Greater Transparency
“Millions of Americans use VPNs to protect their privacy, not to sell their privacy to ad-tech companies,” Proton said in its report.
The company recommends that consumers look for VPN providers with transparent ownership, operate in jurisdictions with strong privacy protections, and have undergone independent security audits.
Proton also points to its own VPN service as an example of a privacy-focused alternative, noting that Proton VPN offers a free plan with no ads or data limits, open-source apps, and a no-logs policy that has been independently audited.
The research was based on free-to-paid downloads from the Google Play Store, with monthly download estimates provided by AppTweak. Proton used data from Exodus Privacy, an open-source platform that analyzes Android applications for code signatures associated with analytics, advertising, and profiling trackers.
Read the full Proton report: Shady VPNs could be spying on millions of Americans
