VPN Transparency Reports: Request Counts, Zero Disclosures and Blind Spots
Of 543 consumer VPNs in our data, 90 say they do not offer it. Below: the services that rank highest for it.
A VPN transparency report is a public tally, written by the provider itself, of the data requests it received over a stated period and what happened next. Police and courts want to know who connected to a server at a given minute, rights holders complain about torrent traffic, and the report shows how many demands ended with user data actually leaving the company. Treat it as one side's claim: useful, yet nobody outside the firm signs off on the arithmetic.
What a VPN transparency report lists
The typical request a VPN gets looks the same every time: an investigator holds one shared exit address and one timestamp and wants a name behind it. The report sorts demands by legal weight and shows what each produced.
| Report line | What it counts | What to check |
|---|---|---|
| Subpoenas and court orders | Formal demands from a judge or prosecutor | Whether any led to disclosure |
| Warrants and seizure orders | Attempts to search offices or take servers | What was taken and what it held |
| Emergency and informal requests | Urgent demands, foreign police letters without local legal force | Whether a local court ever backed them |
| National security letters | US demands, possibly under gag orders | Reported only as ranges like 0–499 |
| Copyright notices | DMCA complaints over torrenting from the exit IP | Kept apart from state requests |
| Data handed over | Cases where something actually left the company | The single most telling column |
Copyright notices are often far more numerous than government requests, because anti-piracy monitoring of torrent swarms keeps flagging the same shared exit address. Formats vary: some providers count only legal requests while others add abuse complaints or file the separate EU content-moderation report, a different document. Access Now keeps an index of companies publishing such reports and criticises how differently the formats are built, which makes direct comparison hard.
How often providers publish one
No rulebook exists. Google put out the first report in 2010, and after the Snowden disclosures of 2013 the practice spread widely, with big tech settling into semi-annual or annual publication. VPN brands vary more: OVPN has posted monthly since 2014, NordVPN goes quarterly with separate coverage of government inquiries and DMCA, and Malwarebytes Privacy VPN puts out one annual file hosted by AzireVPN. Continuity matters more than frequency: a blank quarter or categories that quietly vanish between periods deserve the same suspicion as an expired canary.
What the numbers prove and where they stop
A long unbroken run of reports with zero data disclosed is consistent with a provider keeping no records a court could take. That is the ceiling. The tally is self-reported and unchecked by any outside party, so a firm that would lie in its privacy policy could lie here as well. Gagged orders stay out of the document, and US national security demands appear only as a band starting at zero. Reports also look backwards only: whether a judge ordered targeted logging last week, they cannot say.
Reading "zero data disclosed" and the country breakdown
Two zeros mean different things here. A quiet record can simply mean nobody has asked yet, so it shows little. Zero disclosed after dozens of real requests carries weight: it shows the provider was tested and had no records matching the timestamps. Check that the period is recent and that all request types are in the count.
The country breakdown shows which jurisdictions target the provider. A demand from abroad usually needs approval by a court in the provider's home country before it has to act, so a spike from one country often traces to a single investigation, not a policy change.
How the report fits with a warrant canary and a no-logs audit
A warrant canary signals the gagged requests a report cannot mention, so the two work as a pair; some providers replaced their canary with more detailed reporting instead. An independent no-logs audit is the one where an outside firm actually inspects the servers and configuration.
Transparency reports in the VPNRadarLab ranking
Of 377 services, 20 publish a transparency report, 78 explicitly do not, and 279 simply do not mention one. The trait adds 1 of the 15 points in the privacy and jurisdiction sub-score (30% of the main score), while an audit earns 3 and a canary 1. The ranking of VPN providers publishing such reports lists the 21 services that qualify; 8 of them also run a canary and 10 carry an audit, so fewer than half combine all three signals.
FAQ
Are VPNs required by law to publish a transparency report?
No, it is voluntary almost everywhere. The EU content-moderation reports some services must file are a different document under a different obligation.
Can a provider fake its figures?
Yes. Nobody checks the tally from outside, so treat it as a claim, not evidence.
Does a high request count mean a VPN is unsafe?
No. Popular services draw more letters from more countries. The disclosure column is what matters.
The transparency report in brief
It counts the legal and copyright requests a provider received and states how many produced user data. It comes out anywhere from monthly to annually, is self-reported and unchecked, and stays silent about gagged orders. Weigh the "zero data disclosed" line only when requests were received and answered with nothing, and read it alongside a canary and an audit rather than on its own.
Top services: Transparency reports
- CitadelVPN8.87
- X-VPN6.47
- IVPN6.46
- Proton VPN6.09
- LunoVPN5.98