VPN Privacy: What a VPN Hides, What It Sees and How We Score It

A VPN swaps one witness for another: your internet provider stops seeing which sites you visit, and the VPN company starts seeing that you exist. How much privacy you actually get depends on what that company records, and VPNRadarLab turns that question into a sub-score out of 10 built from a 15-point checklist. Privacy carries 30% of the overall score across all 377 services in the main ranking, and 45% inside this section's 15 rankings, with the other pillars scaled down proportionally.

Who sees what once the tunnel is up

With the tunnel active, your operator still knows you connected to a VPN server, at what time, and how much traffic moved. It does not know which sites. Websites, in turn, see the VPN server's address rather than yours. The provider learns the most: it receives your real IP every time you connect. Privacy International frames it simply: you change who you trust to see the true source and destination of your traffic, from the ISP to the VPN company. That makes the provider's logging policy the single most important thing to check.

The 15-point privacy sheet

Every criterion is a published fact. If the policy never mentions it, the service earns nothing. The last column counts how many of the 377 services in the main ranking earn each line, with the penalty rows at the bottom:

A written policy is nearly worthless as a differentiator: 303 of 377 services have one, while 35 have an independent no-logs audit. Proof outranks promises, and the audit's three points against the policy's two show it. The positive lines add up to 14.5, so even a spotless record tops out around 9.7 rather than a perfect 10. Alliance membership is graded too: a base in Fourteen Eyes keeps 0.8 of the two jurisdiction points, Nine Eyes keeps 0.6, Five Eyes keeps none.

How the 377 ranked services score on privacy

The distribution is blunt. The median sub-score is 2.3 (the mean is 2.5), 229 services sit below 3, and 49 score zero outright. Only 34 reach 5 or higher, and just six clear 7. A provider that never states whether it records session times simply gets nothing for it. The top group runs CitadelVPN at 9.3, IVPN at 9.0, X-VPN at 8.0, LunoVPN at 7.7, AzireVPN at 7.5 and DuneVPN at 7.3. Mullvad, a name people associate with privacy, lands at 6.9: it earns points for its audited no-logs policy, no stored connection IP or session times, and email-free sign-up with account numbers, but loses jurisdiction points on Sweden, a Fourteen Eyes country, and gets zero for the warrant canary, transparency report and court-tested no-logs lines.

The connection-IP penalty and the 6.0 cap

Storing the address you connect from costs three points and raises a red flag. A red flag caps the overall score at 6.0, no matter how strong security or pricing is. Across the main ranking, 55 of 377 services carry one: 44 for the logged connection IP, 7 for a public security incident, and 4 for Chinese jurisdiction. If you want to compare which policies admit to collecting what, the no-logs ranking goes through them line by line. Bear in mind that VPNRadarLab scores only what providers publish; it runs no leak or speed tests and carries no affiliate links.

What a VPN leaves visible

Changing your IP does nothing about your browser. Tracking scripts read screen resolution, installed fonts and browser settings, and stitch them into a fingerprint, which, unlike a cookie, cannot be deleted with a click. EFF built Cover Your Tracks so you can see how distinctive yours is; Tor Browser is built to reduce fingerprinting in the same way. Cookies still follow you, signing into Google or a shop account links every request to your identity regardless of address, and your phone reports GPS coordinates to any app that asks for them. If email-free registration and crypto payment matter to you, the anonymous VPN ranking filters for exactly that.

FAQ

Can my ISP tell I use a VPN?

Yes. It sees an encrypted connection to one server, its timing and volume. It cannot see the destinations or the content.

Does a high privacy score mean I'm anonymous?

No. The score rates the provider's published practices. Your fingerprint, cookies and logged-in accounts sit outside its reach entirely.

Why is "not stated" scored as zero?

Because the score can only reward published facts. Silence earns nothing, which is exactly why the median sits at 2.3.

Which line should I check first on a provider's page?

Whether an outside firm has audited the no-logs claim, and whether the policy explicitly says the connection IP is not stored. These two lines carry the largest swing on the sheet, at 3 points and 1.5 points (or −3 when the IP is stored).

What the numbers add up to

Trust moves from your ISP to your VPN provider, and the 15-point sheet measures how much of that trust is backed by published evidence. A written no-logs policy earns 2 points, an independent audit 3, and unpublished practices score zero. A stored connection IP costs three points plus a red flag that caps the service at 6.0. The median of 2.3 out of 10 says most providers publish far less than they could, and the six services that clear 7 are listed above.