Is Norton VPN safe? Logging policy, audits and jurisdiction

Privacy and jurisdiction 2.3/10 and security 3.9/10 (segment medians 1.3 and 2.5). No red flag in our data. Independent no-logs audit: Not stated.

In 10 seconds

Kill switch
Jurisdiction in 5 Eyes

Privacy

Jurisdiction: USA, 5 Eyes
Legal entity: Gen Digital Inc. (EEA controller NortonLifeLock Ireland Ltd)
No-logs policy: Yes no browsing activity logged
Independent no-logs audit: Not stated
Data retention: connection events 12 mo; bandwidth/device/analytics 18 mo; crash 90 days
Shared with third parties: Google Firebase/Crashlytics; resellers for billing
Trackers on the website: Yes Your privacy choices/Do Not Sell link

What the privacy policy says is collected

Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.

Email✕ Yes
IP at sign-upNot stated
Connection IP✓ No
Session times✕ Yes
Bandwidth✕ Yes
Device info✕ Yes
App analytics✕ Yes
Crash reports✕ Yes

Security

Kill switch: Yes
DNS leak protection: Not stated
Open-source apps: No
Two-factor sign-in: Not stated

For everyday protection in a café or at the airport, Norton VPN does the job: it has a kill switch, WireGuard, its own Mimic protocol and Double VPN. Our data shows no public incidents, and among antivirus VPNs it ranks above the median. Its one weak spot is that the no-logs promise rests entirely on the company's word.

What Norton keeps about your connections

The privacy policy says browsing history is not recorded and the device's IP address is not collected. Quite a lot of service data is stored, though. The day of connection (without the exact time) and location are kept for 12 months. Total traffic in megabytes, device data and app analytics are stored for 18 months. Crash reports are sent only with consent and kept for 90 days. Firebase analytics from Google can be switched off in the settings, and that is the first thing to do after installation.

A promise without verification

Norton does not publish an independent audit of its no-logs policy. It does not publish a separate security audit of its apps either, and the app code is closed. Norton runs a bug bounty program, but it does not replace an external audit. That is why Norton gets 2.3 out of 10 for privacy in our rating. Services whose claims have been verified by an auditor are collected in our list of VPNs with an audited no-logs policy.

The US and 5 Eyes

The owner, Gen Digital, is registered in the US, a 5 Eyes alliance country. Norton says that when authorities come asking, it simply has no data on websites visited, DNS queries or destination addresses. For users in the EU, the data controller is NortonLifeLock Ireland Ltd. How different countries affect access to your data is covered in our overview of VPN jurisdictions.

Does Norton protect against DNS leaks?

The service does not say. Two-factor login and RAM-only servers are not mentioned either.