What does “no-logs” actually mean? It’s a claim, not a guarantee.
“No-logs” might be the most repeated phrase in VPN marketing — and one of the most misunderstood. It doesn’t mean a provider stores absolutely nothing about you. It means something narrower than that, and the details are where it actually matters.
Quick Answer
| Type of Data | Logged by a Genuine No-Logs VPN? |
|---|---|
| Browsing history / sites visited | No |
| Your real IP address while connected | No |
| Account email and payment method | Yes — needed to run the business |
| Connection timestamps (session start/end only) | Sometimes, varies by provider |
| Aggregate bandwidth used (not per-session activity) | Sometimes, varies by provider |
What a no-logs policy actually covers
A genuine no-logs policy means the provider isn’t recording what you actually do while connected — the sites you visit, what you download, which apps you use, your browsing history. This is the exact category of logging that would let someone piece together your online activity after the fact.
What “no-logs” usually doesn’t mean
Most legitimate VPN providers still collect some operational data just to keep the lights on. That’s normal, not a red flag on its own:
- Account information — the email and payment method you signed up with
- Connection timestamps — when you connected and disconnected, without any record of what you did in between
- Aggregate bandwidth data — total data used, kept for capacity planning, not tied to your individual activity
- Server selection — which server location you picked, not what you did once you got there
What separates a trustworthy provider from a misleading one usually comes down to exactly where these lines get drawn, and whether they’re spelled out plainly instead of buried three pages into a privacy policy.
Why “trust us” isn’t enough
Anyone can slap “we don’t log” on a homepage. What actually gives that claim weight is independent verification — specifically, a third-party audit where an outside security firm goes through the provider’s server setup and code to check the claim against reality. Providers with recent, published audits from a reputable firm have made their claim something you can actually check, not just take their word for.
There’s a second, rarer form of proof: a real-world test case, where law enforcement or a court demanded activity logs from a provider and got nothing back because there was nothing to hand over. A handful of VPN providers actually have this on record, and honestly, it’s about as strong a proof point as you’ll find for a no-logs claim.
Jurisdiction matters too
Where a VPN company is legally headquartered affects what it can be forced to do, even with a genuine no-logs policy in place. A company based in a country tied to international intelligence-sharing agreements, or one with data retention laws on the books, can face different legal pressure than one based somewhere else. That’s why we call out jurisdiction as its own factor in our reviews instead of just taking a no-logs claim at face value.
How to evaluate a specific provider’s claim
- Read the actual privacy policy, not the marketing page — specifically the “Information We Collect” section
- Check whether the no-logs claim has been independently audited, and how recently
- Look for a documented real-world case where the provider was asked to hand over logs and couldn’t
- Check where the company is legally based and what data retention laws apply there
Bottom line
“No-logs” means something real when it’s backed by a specific, published policy and independent audits, not when it’s just a slogan on a landing page. See our Best VPN for Privacy & Security picks for providers whose no-logs claims we’ve actually weighed against audit history and jurisdiction, not just their own marketing copy.
Red flags that undercut a no-logs claim
Not every “no-logs” claim deserves the same trust. A few patterns are worth watching for. A free VPN with no obvious business model is one — running server infrastructure isn’t cheap, and if you’re not paying with money, your data is a pretty common substitute. A privacy policy that’s vague about what “logs” even covers, tossing the word around without specifying which data categories it applies to, is weaker than one that spells out exactly what is and isn’t collected. A provider that’s been in business for years and has never commissioned an independent audit is asking you to trust it on faith alone. And a provider headquartered somewhere with mandatory data retention laws, without an audit that specifically addresses that legal exposure, is a real concern, not a hypothetical one.
None of this alone proves a provider is lying — plenty of smaller, newer VPNs have perfectly honest policies and just haven’t had the budget for a formal audit yet. But they’re reasons to weigh the claim a little more skeptically instead of just taking it at face value.
Want providers we’ve already checked against this standard? See our best VPN for privacy picks.