The VPN advert on YouTube is not selling you privacy

Read this first

Disclosure

I use ExpressVPN. It is the tool I use myself, and it is scored here like the other eight, with its owner's links counted against it like anyone else's. This is not a paid advert. Nobody sponsored this page. There are no affiliate links, referral codes, advertising revenue, commissions or commercial arrangements with any VPN named here.

Every VPN name linked on this page goes directly to the provider's public website. The links contain no affiliate or referral tracking. No special price, discount, free period or other deal is being offered through this page, and none should be expected. Following a link earns this site nothing.

I wrote it because I am tired of creators on YouTube and other platforms selling low quality, and sometimes dangerous, security products that are not fit for purpose. In my view many of them check nothing beyond what the sponsor pays for the slot.

This is not a VPN review site. It is a bullshit filter: a barebones comparison designed to strip away the sales pitch and put all nine providers against the same evidence. I am not scoring app design, streaming performance, brand reputation or marketing polish. I am pulling back the curtain on what matters if privacy is the reason you are using a VPN: server design, independent audits, real-world seizure or court tests, jurisdiction, ownership and intelligence-sharing exposure. The aim is not to sell you a winner. It is to show the balance of strengths and weaknesses once the advertising is removed.

Why the advert tells you nothing useful

An advert is bought. The company pays, the presenter reads the script, and the script is written to sell. It will say encryption and no logs. It will not say where the company is registered, who owns it, or which country's courts can order it to act. Those three facts decide whether a knock on the door is possible.

Ownership is the first thing hidden. Kape Technologies, formerly Crossrider, a company linked to adware distribution, owns ExpressVPN, CyberGhost and Private Internet Access. Its media arm has also run VPN review sites such as vpnMentor and Safety Detectives. Three of the nine providers in this article share one owner, and that owner has run sites that rank them.

No logs is a claim, and claims fail when they are tested. Court documents reported in 2016 showed IPVanish giving US Homeland Security a customer's name, email address, IP address and connection logs, after first saying it had no data. In 2017 the FBI used records from PureVPN in a cyberstalking case, when its policy said it kept no logs that could identify a user's activity. In May 2026 French and Dutch police seized 33 servers in 27 countries belonging to a service called 1VPNS, which advertised no logs, and reportedly identified 506 users.

The same test has gone the other way. A server seized from ExpressVPN in Turkey in 2017 reportedly gave nothing usable. Swedish police raided Mullvad in 2023 and left empty handed. PIA says it was subpoenaed for logs in 2016 and 2017 and had none. A Greek court dismissed charges against Windscribe's founder in 2025.

Surfshark shows the middle ground. In April 2026 it says it complied with a legally binding warrant from the Amsterdam District Court. It could not provide browsing history, traffic or IP logs because it says it does not keep them, but it did confirm the account existed and handed over payment-related information that it still held. No activity logs does not mean no identifying data exists anywhere in the company.

What separates the providers is not the advert. It is what the company stores, what can identify an account, and who can order it to store or disclose more.

Providers that refuse paid endorsements.

IVPN and Mullvad both publicly distance themselves from the paid-endorsement model commonly used to promote VPN services.

IVPN says it closed its affiliate programme in protest at paid reviews and misleading recommendations by “best VPN” websites. That wording does not establish whether those recommendations were favourable or unfavourable to IVPN, only that IVPN regarded the practice as misleading. It says it does not buy endorsements, on the view that influencers and YouTube creators without relevant information-security expertise should not recommend VPN services in exchange for payment. This is exactly why this page exists, because I also subscribe to that same philosophy. IVPN also says it rejects surveillance advertising, countdown timers, expiring deals and fake reviews.

Mullvad takes a similar position. It says it has no affiliate programme and does not pay reviewers or influencers to recommend its service. It does buy conventional advertising, including on YouTube, search engines and app stores, but distinguishes paid advertising from paying a reviewer or influencer for an endorsement.

For coverage, IVPN says it provides journalists and reviewers with demo accounts without compensation and may financially support creators it considers qualified to evaluate privacy and security technology. Mullvad says it does not pay for reviews or influencer endorsements. These are the providers’ own stated policies. Marketing practice is not included in the scoring system used in this article.

For coverage, IVPN says it gives journalists and reviewers demo accounts with no compensation, and that it financially supports creators it judges to have the background to evaluate VPNs. Those are IVPN's own statements of policy. The scores in this article do not count marketing practice.

What providers say on their own sites about paid promotion

What you are actually buying

At its simplest a VPN is a relay. Websites see the VPN company's address instead of yours, and your internet provider sees an encrypted connection to the VPN instead of the sites you visit. That is relocation. It moves where you appear to be, and it moves who can see your traffic, from your internet provider to the VPN company.

For watching something from another country's catalogue, that is all you need. It is not, on its own, protection of your identity. Whether the company that now sees your traffic can be made to hand it over, or to start recording it, depends on the five things scored below. It does not depend on the price or on the advert.

Two kinds of government request

Requests about the past

A subpoena, a warrant, a raid or a formal request from a foreign police force asks for what a company already holds. The defence is engineering: nothing stored, so nothing to hand over.

RAM-only servers are the strongest form of it. Memory only holds live connections, and it is wiped when the server is powered off or rebooted. ExpressVPN says its servers wipe on every reboot, and one review reports they reboot every one to two weeks. Memory freed when a session ends is reused by new connections, so on a busy server old sessions get overwritten.

To get anything out of one, investigators would have to seize it while it is switched on, keep it running, capture the memory intact and preserve it as evidence. Even then it would show only the connections live at that moment, not anyone's history.

There is also time. A request from abroad has to go through a formal process in the provider's own country. For a British Virgin Islands operator, that means a written request to the islands' Attorney General. It takes time, and by the time it lands, past sessions have gone from memory.

Orders about the future

A different order asks a company to record from now on. RAM does not help, because the server can write down what happens next. Only the law of the country the company sits in decides whether that can be forced.

The United States has court orders that make a communications provider install and monitor a pen register for up to 60 days. A pen register collects metadata, not content, and the order can be sealed so the provider cannot tell the user. In the Netherlands, the intelligence services can order communication providers to help with live interception, and refusing is a criminal offence.

This is why jurisdiction gets its own scores. Engineering covers the past. Jurisdiction covers the future.

How the scores work

Every VPN here is marked on five things. Each has a fixed rule, so the same facts always give the same score. In every column, high is good and low is bad.

Two worked examples

Mullvad. All servers RAM-only (3). Repeated qualifying infrastructure audits, but the latest was completed in June 2024 and is now over 24 months old (1.5). A raid by Swedish police that found nothing (0.5). Operator in Sweden, in the Fourteen Eyes only (1). No links beyond Sweden (2). Total 8.0.

PIA. All servers RAM-only (3). Audited (2). Subpoenas that PIA says found nothing (0.5). Operator in the USA (0). One link, because Kape adds the UK (1). Total 6.5.

Both run RAM-only servers and both have a record under pressure. The 1.5-point gap comes from the audit recency rule, where the operator sits and who else has a hand on it.

Provider by provider: what the exposure really is

IVPN, 6.5, Gibraltar

IVPN uses LUKS full-disk encryption across its main gateway network, with only a small RAM-only pilot, so under this page's fixed rule it scores 1 of 3 for RAM-only servers. Cure53 audited its VPN gateway infrastructure in 2023. IVPN has published newer audits of other parts of its service, but the latest qualifying gateway or no-logs audit is now over 24 months old, so the audit score is 1.5 rather than 2. No email is needed to sign up. You can pay by card, PayPal, Bitcoin, Bitcoin Lightning, Monero or cash. Cash is only taken on plans of one to three years and is not refundable. Gibraltar is a British Overseas Territory with its own legal system, and foreign requests go through its own process. It scores 0 on the seizure test only because no public case was found, which is a gap in the record, not a failing.

One incident to know about. In August 2026 IVPN disclosed that an attacker exploiting a flaw in BTCPay Server, the software it hosts to take Bitcoin payments, extracted its Lightning node credentials and moved out its operating funds. IVPN says no customer data or customer funds were affected, its VPN infrastructure was not involved, and Lightning payments were down from 7 to 10 August. The scoring rules have no line for incidents, so it does not change the score.

Its privacy policy lists what it keeps. At sign-up: an account ID, the creation date, the plan and the device limit. For each payment: the amount, currency, timestamp and a transaction ID linked to the account. While you are connected: a temporary record that the account is logged in, deleted when the session ends. Accounts and their linked data are deleted 90 days after they end, and payment records are kept without a link to any account.

IVPN says it will comply with a court order from an authority with jurisdiction over it, but cannot hand over what it does not hold. If it were ever forced to keep connection logs, it says it would try to tell customers and then move jurisdiction or close. It says it operates 58 locations in 41 countries, and that its ownership, company structure and team are public.

It also says it uses no advertising or social trackers and no third-party analytics. Its privacy policy discloses one thing to know: a self-hosted Matomo script that records browser details and an IP address with the last two octets dropped.

ExpressVPN, 8.5, British Virgin Islands

RAM-only, and audited by PwC, KPMG and Cure53. A server seized in Turkey in 2017 reportedly gave nothing usable. The exposure is Kape, which owns it and is listed with a London headquarters. UK orders can only be served on people in London, and it matters only if they can reach ExpressVPN's systems. No evidence was found that they can. Kape's owner is reported to live in Cyprus and holds it through an Isle of Man company.

Mullvad, 8.0, Sweden

RAM-only, with an account that is just a random number and no email, and cash accepted. Mullvad has repeated infrastructure audits, including a fourth infrastructure audit by Cure53 completed in June 2024. That qualifies for the named-firm and repeat points, but it is now more than 24 months old, so the audit score is 1.5 rather than 2. Newer audits have covered its apps and web systems, not the VPN infrastructure measured by this scoring rule. In April 2023 Swedish police raided its Gothenburg office at the request of a German investigation and left with nothing. The exposure is simple: it is a Swedish company, Sweden is in the Fourteen Eyes, so Swedish orders can be served on it directly.

CyberGhost, 8.0, Romania

RAM-only, with three Deloitte Romania audits: 2022, 2024 and a third announced in February 2026. The operator is Romanian, outside the fourteen. The exposure is the same as ExpressVPN's: Kape has owned it since 2017, and its London headquarters adds the UK.

Surfshark, 7.5, Netherlands

RAM-only, with Deloitte no-logs assurance reports in 2023 and 2025, so it now receives the full 2 audit points. It moved from the British Virgin Islands to the Netherlands in October 2021, and customers who signed up since then contract with Surfshark B.V. Dutch intelligence law lets the services order communication providers to help with live interception, and refusing is a criminal offence. Those orders can be served on it directly. In April 2026 Surfshark says it complied with a legally binding warrant from the Amsterdam District Court: it had no browsing, traffic or IP logs to provide, but it did disclose confirmation that the account existed and payment-related information. Under this page's fixed seizure or court rule, that does not earn the 0.5 point for "nothing found". It has shared a group with NordVPN since 2022.

NordVPN, 6.5, Netherlands (registered in Panama)

RAM-only, with Deloitte and PwC audits reported. The operating company, nordvpn S.A., is registered in Panama, and Nord says Panama has no mandatory data retention law. But the company is listed in a credit database with an establishment in Amsterdam, and the group holdings sit in the Netherlands and in a UK-registered company, Nordsec Ltd. The founders and Nordsec's director live in Lithuania. It is scored at the Dutch tier, and its one link is the UK holding company.

PIA, 6.5, USA

RAM-only according to its own transparency report, with Deloitte audits reported for 2022, 2024 and 2025. PIA says it was subpoenaed for logs in 2016 and 2017 and had none. The exposure is where it sits. It is a US company, and US law provides sealed monitoring orders that run forward. It is also owned by Kape.

Windscribe, 6.5, Canada

RAM-only, after it rebuilt its network following a 2021 incident. A Greek court dismissed charges against its founder in 2025. Windscribe says Dutch authorities seized a server and found only a stock install, but only the company has confirmed that, so it counts for half a point. Its infrastructure was audited by PacketLabs in 2024, but reviews report no published independent audit of its no-logs policy. It is a Canadian company, and Canada is in the Five Eyes.

ProtonVPN, 6.0, Switzerland

The best jurisdiction on paper: Switzerland is outside every alliance, and its law does not force VPN providers to log today. Four annual Securitum audits are reported for 2022 to 2025. But Proton says it uses hard disks with full-disk encryption instead of RAM-only servers, so it scores 1 of 3 there. And its jurisdiction is under threat, as the Swiss section below explains. Its total is the lowest here.

EU GDPR: what it does and what it does not

GDPR is the EU's data protection law and has applied since 25 May 2018. It covers how companies handle the personal data of people in the EU. It reaches beyond the EU: a company anywhere that offers services to people in the EU, or monitors their behaviour, has to follow it and must appoint a representative in the EU. Fines can reach 20 million euros or 4 percent of annual worldwide turnover, whichever is higher.

For a VPN user that means rights over your own data, such as access and erasure, and a duty on the company to collect no more than it needs. Sweden, the Netherlands and Romania are EU states, so it applies directly to Mullvad, Surfshark and CyberGhost. It also reaches providers outside the EU that sell to people in it.

What it does not do is stop a government. Processing for national security sits outside EU law, and police use of personal data is covered by a separate law, the Law Enforcement Directive. GDPR governs how a company treats you. It does not switch off an intelligence agency's own powers, and it does not stop the Dutch interception orders described above.

The UK left the EU and now has its own version, the UK GDPR, built on the same rules.

What Switzerland is doing

Switzerland is outside the EU and all the eyes, and for years that made it the default answer for privacy. Its current law does not force VPN providers to log. That is now under threat.

The Swiss government has proposed rewriting the ordinance on surveillance of post and telecoms traffic, known by its German initials VÜPF. The draft would apply to VPN, email and messaging providers with as few as 5,000 users. They would have to identify customers with a government document, keep IP addresses and connection data for six months, and be able to decrypt what they have encrypted. It is an ordinance issued by the government, not a law passed by parliament.

The first consultation closed on 6 May 2025 with a near-uniformly hostile response. In February 2026 the justice department said it had commissioned an external risk impact assessment and would prepare a second consultation. As of June 2026 there was no binding timetable, and the Federal Council had not said the project was dead. A paused law is not a buried one.

Proton, the best known Swiss provider, froze new Swiss data-centre spending and put the servers for its new AI assistant in Germany, with facilities also being built in Norway. It says its headquarters, legal entity and core Mail and VPN infrastructure stay in Geneva. Its chief executive has said the company would leave if the amendment passes.

That leaves ProtonVPN exposed either way. If the rule passes and Proton stays, it has to log. If it leaves, the places it is already building servers, Germany and Norway, are inside the alliances, and the company and its data would still sit under alliance-state law. That is why it scores 1 point on intel protection, and why having no RAM-only servers matters.

What to do with this

Read the advert as what it is: a paid script. Then ask the same five questions of any VPN, the ones in the table. Does it run RAM-only servers? Has a named firm audited it, recently and more than once? Has its no-logs claim been tested by a seizure or a court? Which country is the operator in? Who else, in which country, owns it or can pull it?

Then look at what it costs in year three, not year one. The deal in the advert is the introductory price.

No provider scores 10, and every one loses points somewhere. Nobody here is out of reach of every possible order, so pick on evidence, not on the advert.

About these ratings: the method is this site's own. It is based on public sources and company statements, checked on 28 September 2026. Companies change owners, servers and laws, so check current details before you rely on any of this. This page is information, not legal advice.