Which Free VPN Does Not Keep Logs? A 2026 No-Logs VPN Checklist

A plain-English guide to what “no logs” actually means, what it doesn’t mean, how to verify it, and which free VPNs in 2026 genuinely hold up under scrutiny.

Which Free VPN Does Not Keep Logs? A 2026 No-Logs VPN Checklist

A plain-English guide to one of the most misunderstood claims in the VPN industry, what “no logs” actually means, what it doesn’t mean, how to verify it, and which free VPNs in 2026 genuinely hold up under scrutiny.

What “no logs” actually means: and what it doesn’t

A true no-logs policy means the VPN stores nothing that could identify your online activity: no browsing history, no connection timestamps, no session durations, no bandwidth use per session, no IP addresses. In practice, the term is used loosely by many providers, the devil is in which specific data types each provider defines as “logs.”

The starting point is the definition, because it matters more here than almost anywhere else in privacy technology.

When a VPN says “no logs,” the plain-English version of what you’d want that to mean is: if you asked them tomorrow to hand over everything they know about what you did online last month, they would have nothing to give. Not because they deleted it. Not because they won’t give it. Because it was never collected in the first place.

That’s the standard a genuinely trustworthy no-logs policy should meet. The problem is that the term is applied to everything from that standard down to “we don’t store a verbatim copy of your browsing history, but we do store your IP address and connection times for 30 days.”

Both can be marketed as “no logs.” Only one of them is actually private.

The confusion exists because there are multiple categories of data a VPN could collect, and providers define “logs” differently. Some providers use narrow definitions, “no logs means no browsing activity logs”, while storing connection metadata that can be nearly as revealing. Understanding the categories is the only way to evaluate a claim accurately.

The three types of VPN logs

VPN logs fall into three broad categories: activity logs (what you actually did online), connection logs (when you connected, for how long, from what IP), and aggregated usage logs (total bandwidth with no individual identity). Only providers that collect none of the first two categories, and keep the third truly anonymized, deserve to be called genuine no-logs VPNs.

Activity logs, the most serious

Activity logs record what you actually do online while the VPN is connected:

Websites and domains you visited

URLs you accessed

Search queries you made

Content you downloaded or uploaded

Specific apps you used

These are the most privacy-invasive type of log. A VPN collecting activity logs is barely different from your ISP watching you directly. Almost no reputable VPN, free or paid, collects these, and providers that claim “no logs” usually mean “at minimum, no activity logs.”

Connection logs, the grey zone

Connection logs record metadata about your VPN sessions, not the content of what you did:

Your real IP address at connection time

Timestamps of when you connected and disconnected

Duration of each session

Bandwidth used per session

Which VPN server you connected to

Your device identifier

This is where “no logs” claims most frequently mislead. Connection logs don’t record what websites you visited, but they record when you were online, for how long, from what location, and how much data moved. That information, especially real IP address combined with timestamps, can be combned with external data sources to build a meaningful picture of your activity.

Many providers who market themselves as “no logs” collect some or all of this metadata. Some store real IP addresses for days or weeks “for abuse prevention.” Others record timestamps in aggregate but not per-session. The differences matter, and they’re often buried in a long privacy policy rather than in the headline claim.

Aggregated usage data, typically acceptable

Some VPNs collect high-level operational statistics: total bandwidth through a server, number of simultaneous connections, load across the network. When this data is genuinely aggregated, no individual session identifiable, no IP address, no timestamp linked to any account, it’s operationally necessary and not a privacy risk.

The test is whether the data could be used to identify you. Aggregate server load statistics can’t. Session-level bandwidth records attached to your account can.

Why “we don’t log” isn’t enough on its own

A privacy policy is a legal document, not a technical guarantee. A provider can claim “no logs” in marketing, include carve-outs in the fine print, and still collect metadata that falls outside their narrow definition of “logs.” The only external verification that carries real weight is an independent technical audit of the server infrastructure, and even audits have limits.

Here’s the honest problem: you can’t verify a no-logs claim from the outside. You’re relying on the provider’s word, filtered through their legal team, shaped by their business interests, and not always consistent with their technical reality.

There are documented cases where this matters:

The IPVanish case (2016): IPVanish marketed itself as a “zero logs” VPN, then provided detailed connection logs to the Department of Homeland Security, logs that led to the arrest of a user in a criminal investigation. The company was acquired before the case came to light, but the logs clearly existed and were clearly useful. “Zero logs” did not mean “zero logs.”

The PureVPN case (2017): PureVPN advertised a “no logs” policy, then provided the FBI with logs of a user’s connection history. A spokesperson said the company logs “just enough information to ensure their service is not being abused.” The user was convicted. The logs were real.

These aren’t ancient history chosen for shock value, they’re the most prominently documented cases in a pattern that continues. The lesson isn’t that all no-logs claims are lies. It’s that a claim alone isn’t evidence. For a no-logs claim to carry weight, it needs external verification and, ideally, a technical architecture that makes logging structurally impossible rather than merely contractually prohibited.

What a real no-logs audit looks like

A genuine no-logs audit involves an independent security firm examining the VPN provider’s actual server infrastructure, the configurations, the code, the data flows, to verify that logs are not being generated or stored. It’s not a review of their privacy policy, not a penetration test, and not a general certification of the company’s trustworthiness.

The gold standard for a no-logs claim in 2026 is an independent technical audit. But “we’ve been audited” also varies. These distinctions matter:

What a real audit covers:

Direct inspection of server configurations to verify no logging software is running

Code review of the VPN software to verify no data is being transmitted back to company servers

Review of the data flows between user devices, VPN servers, and company infrastructure

Examination of databases and storage systems for any retained session data

Sometimes a “surprise audit” where the firm shows up unannounced to inspect live systems

What a real audit does not cover:

Future behavior, the audit confirms the state of the infrastructure on the day of inspection, not that it will remain the same

Everything the company does with data outside the VPN infrastructure itself

Third-party services embedded in the VPN app (analytics SDKs, crash reporters)

What happens under a legal order after the audit

Firms that have done credible no-logs audits:

Cure53 (independent German security research firm, audited Mullvad, ProtonVPN, and others)

Deloitte (audited Surfshark and others)

PricewaterhouseCoopers (audited ExpressVPN)

KPMG (audited NordVPN)

Leviathan Security Group (audited various providers)

The most credible audit programs are recurring, the same firm returning every year or two, rather than a one-time certificate used indefinitely in marketing materials. Proton VPN, as of 2026, has completed five consecutive annual audits. That pattern of repeated third-party verification carries more weight than a single audit completed years ago.

The no-logs checklist: what to look for

Before diving into which specific free VPNs do and don’t keep logs, here is the framework for evaluating any VPN’s no-logs claim:

Privacy policy:

Policy explicitly states no IP addresses are stored

Policy explicitly states no connection timestamps or session durations are stored

No broad carve-outs for “abuse prevention,” “legal compliance,” or “troubleshooting”

Policy updated within the past 12 months

Technical architecture:

RAM-only servers, or documented equivalent

DNS resolved inside the encrypted tunnel by the VPN’s own resolver

Kill switch always-on by default (not just available as an option)

IPv6 handled inside the tunnel or blocked by default

No third-party analytics SDKs in the mobile app (check with Exodus Privacy on Android)

External verification:

Independent audit completed by a named security firm

Audit is recent (within 18 months) and recurring, not a one-time certificate

Full audit report publicly available (not just a press release summary)

Company has faced real-world legal demand and produced no useful user data

Business model:

Revenue model clearly explained, you understand how the company makes money

If free, subsidized by a paid tier with the same architecture

Parent company does not have a history of data monetization

No acquisition history that changed the privacy posture

Jurisdiction:

Based outside Five Eyes and major surveillance alliancesNo mandatory data retention requirements in home jurisdiction

Published transparency report, even if empty

If a VPN passes all or most of these checks, the no-logs claim is meaningfully more trustworthy than one that doesn’t. If it fails on the audit row, no independent verification at all, treat the claim as unverified regardless of how compelling the marketing copy is.

Free VPNs and logs: the business model problem

Most truly free VPNs have a fundamental tension: operating VPN infrastructure is expensive, and genuine zero-logs architecture requires real engineering investment. Many free VPNs resolve this tension by monetizing user data, which is directly at odds with a no-logs claim. The free VPNs that genuinely don’t keep logs either have a paid tier that subsidizes the free plan, or have a mission-driven model (non-profit or open-source) with transparent funding.

Running VPN infrastructure at scale isn’t cheap. Servers cost money. Bandwidth costs money. Engineering teams cost money. Security audits cost money. When someone offers you a VPN for free, the question is always: where does the money come from?

The answers fall into a few categories:

Data monetization, the free VPN collects your browsing behavior, sells it to advertisers or data brokers, and uses that revenue to operate the infrastructure. This is the most common model for apps marketed as “free VPN” on app stores. In 2019, the CSIRO studied 283 Android VPN apps and found that 38% contained malware or malvertising code and 72% used third-party tracking libraries embedded in the app. A VPN that runs tracking SDKs is not a no-logs VPN regardless of what its privacy policy says, the tracking happens at the app layer, below the VPN’s own privacy policy.

Bandwidth resale, some “free” VPNs monetize by routing other users’ traffic through your connection, effectively turning your device into part of their network. Hola VPN, at one point one of the most downloaded free VPNs, operated this model. Your bandwidth was being sold. Your IP address was being used by others. The privacy implications are serious: if another user does something illegal through your IP address, you’re the one with exposure.

Paid tier subsidy, the most sustainable and legitimate model. The free plan is genuinely free, subsidized by revenue from paying subscribers. The infrastructure is the same, the no-logs architecture is the same, and the free tier is essentially a product demo that converts some fraction of users to paid. Proton VPN, Windscribe (to a point), and OllaVPN use this model.

Grant or non-profit funding, organizations like the Tor Project fund development through donations and grants. The privacy mission comes first. This model is genuinely trustworthy but rare.

The practical implication for evaluating free VPNs: if you can’t find a clear answer to “how does this company make money,” the answer is almost certainly “your data.” The combination of zero revenue transparency and a “no logs” claim is a red flag, not reassurance.

Which free VPNs genuinely don’t keep logs in 2026

The free VPNs with the strongest genuine no-logs credentials in 2026 are Proton VPN Free (recurring independent audits, transparent funding, open source), Windscribe Free (transparent policy, strong architecture, clear paid-tier business model), and OllaVPN Free (zero-logs architecture, in-tunnel DNS, audited, lifetime free with no data caps). Most other free VPNs either collect connection metadata, lack independent verification, or have revenue models that are incompatible with genuine no-logs operation.

Proton VPN Free

Proton VPN is Swiss-based, operated by Proton AG, the same company behind ProtonMail. Its free plan offers unlimited bandwidth (with slower speeds and fewer server choices than the paid tier), a strict no-logs policy that covers both activity and connection logs, and five consecutive independent audits as of 2026, conducted by Cure53. The full audit reports are publicly available, not just summaries.

The business model is transparent: Proton VPN Free is subsidized by ProtonVPN’s paid subscribers and by Proton’s other paid products. The company has faced real-world legal demands and the outcome, no useful user data was produced, was consistent with the no-logs architecture. The ProtonMail case (where metadata associated with an activist’s account was provided to Swiss authorities) is sometimes cited as a counter-example, but it involved ProtonMail’s own account metadata, not ProtonVPN traffic logs.

What the free plan limits: server choices (three countries), one device, slower speeds. The no-logs architecture itself is not limited.

Windscribe Free

Windscribe is a Canadian VPN with a genuinely transparent privacy policy, a clear paid-tier business model, and a strong technical reputation in the privacy community. Its free plan offers 10 GB per month of bandwidth, a reasonable server selection, and a no-logs policy that covers both activity and connection logs. Windscribe publishes its client code as open source for the desktop apps

The company’s founder has a track record of unusually candid public communication, engaging directly with critics in technical forums, publishing detailed explanations of architecture decisions, and being honest about what the product can and cannot protect against. This isn’t a substitute for an audit, but it adds context

What the free plan limits: 10 GB monthly bandwidth cap. Otherwise the privacy architecture is the same.

OllaVPN Free (Lifetime)

OllaVPN offers a lifetime free plan with no data caps, no time limits, and no advertisements, subsidized by its paid tier. The no-logs architecture covers both activity and connection logs; the company does not collect real IP addresses, session timestamps, or session durations. DNS is resolved inside the encrypted tunnel by OllaVPN’s own unbound resolver, your ISP cannot see the domains you visit, and no third-party DNS provider receives your queries.

The technical architecture goes further than most: the kill switch is always-on and cannot be accidentally disabled; post-quantum cryptography (hybrid X25519 + ML-KEM-768) is applied to every connection including the free plan; peer isolation is enforced at multiple independent layers. No account or email address is required to use the free plan, there is no account to link your traffic to.

OllaVPN’s architecture has been independently audited. The free plan is a genuine product, not a funnel with meaningful restrictions, the only difference from the paid plan is speed (10 Mbps on free, 10 Gbps on paid) and the number of devices (one on free, five on paid).

What about the others?

Several well-known names appear in “best free VPN” lists that warrant more careful scrutiny on the logs question:

Hotspot Shield Free, owned by Pango (formerly AnchorFree). The free version has historically shown advertising and has a privacy policy with carve-outs for analytics partners. The no-logs claim covers browsing activity but not all connection metadata.

TunnelBear Free, 500 MB monthly limit (2 GB with a tweet). Canadian-owned, acquired by McAfee in 2018. Has undergone annual security audits by Cure53. The audits are publicly available and cover the no-logs architecture. A legitimate option within the narrow bandwidth limit.

PrivadoVPN Free, 10 GB monthly. Swiss-based. Decent independent verification. A credible option, though less well-audited than Proton VPN

Hide.me Free, 10 GB monthly, Malaysian jurisdiction. Has published a no-logs claim and has faced some independent scrutiny. Less comprehensive audit history than the top tier.

Hola Free VPN, mentioned above. Not recommended. The peer-to-peer bandwidth-resale model is fundamentally incompatible with a genuine no-logs claim and creates serious privacy and liability risks for users.

Any VPN app prominently featured on an app-store “free VPN” list without a named business model, treat with significant scepticis. The CSIRO research from 2019 remains the most comprehensive analysis of the free VPN ecosystem, and the results were troubling. The landscape has improved since then, but the economic pressures that drove the bad behaviour haven’t changed.

Red flags that should make you walk away

The most reliable red flags for a VPN that doesn’t actually honour its no-logs claim: no independent audit (or an outdated one), a privacy policy with broad carve-outs for “abuse prevention” or “legal compliance,” a revenue model that isn’t clearly explained, third-party analytics code in the app, and a company that’s been acquired without a clear statement about data policy continuity.

These are the patterns that, individually or in combination, should make you look elsewhere

No independent audit, or an old one. A one-time audit from 2019 that’s been cited in every press release since then isn’t the same as a current audit. The infrastructure changes; the audit needs to keep pace.

Privacy policy full of “except” and “however.” Phrases like “we don’t log your activity, except for abuse prevention purposes” or “we may retain connection metadata for troubleshooting” effectively carve out the data most likely to identify you. Read the full policy, not the summary.

The “no logs” claim only covers activity logs. If the policy says “we don’t store your browsing history or the content of your traffic” but doesn’t explicitly address IP addresses and connection timestamps, assume those are being collected.

Analytics SDKs in the mobile app. A VPN can have a perfectly accurate no-logs policy for its server infrastructure while embedding third-party analytics libraries in its iOS or Android app that report your behavior to Facebook, Adjust, AppsFlyer, or others. Check the app’s network requests with a tool like Exodus Privacy (for Android) or Charles Proxy.

Ownership by a company with a different privacy model. Several consumer VPNs have been acquired by companies whose core business is advertising or data brokerage. Kape Technologies (previously known as Crossrider, a company that had published adware) owns ExpressVPN, CyberGhost, Private Internet Access, and Zenmate. That context doesn’t automatically mean those VPNs log user data, ExpressVPN in particular has maintained strong independent audits, but it’s context worth knowing when evaluating claims.

Revenue model unexplained. If you genuinely can’t find an explanation of how a free VPN makes money, and the app is polished and well-marketed, the most likely answer is that you are the product.

Never verified by a real-world legal demand. This is a high bar, but the VPNs with the strongest credibility have faced government requests and produced nothing, not because they refused, but because nothing existed. Proton VPN and Mullvad have documented histories of this outcome.

Jurisdiction matters: where the VPN is based

A VPN’s legal jurisdiction determines which government can compel it to produce data and under what legal process. VPNs based in privacy-friendly jurisdictions (Switzerland, Iceland, Panama, British Virgin Islands) face fewer mandatory retention requirements and more procedural hurdles before data can be compelled. But jurisdiction is relevant only if the VPN actually has data to produce, a genuine no-logs architecture matters more than geography.

VPN providers are subject to the laws of the country where they’re legally based. Those laws determine:

Whether the government can compel data retention

What legal process is required before a court order for user data can be issued

Whether the VPN must notify users of legal demands

Whether orders from foreign governments can be enforced

Countries frequently cited as favorable for VPN jurisdiction:

Switzerland, not an EU or Five Eyes member; strong domestic privacy law; Proton VPN is based here

Iceland, strong privacy culture, not Five Eyes, good legal framework

Panama, no mandatory data retention laws; NordVPN is based here

British Virgin Islands, a British Overseas Territory but outside the UK’s legal framework for most purposes; ExpressVPN was originally based here

Countries less favorable for VPN privacy:

United States, Five Eyes member; National Security Letters can compel data production with gag orders

United Kingdom, Five Eyes member; Investigatory Powers Act creates broad surveillance authority

Australia, Canada, New Zealand, Five Eyes members with similar surveillance frameworks

The important caveat: jurisdiction matters only if data exists to hand over. A genuine no-logs VPN based in the US is meaningfully more private than a logs-keeping VPN based in Panama, because the US VPN has nothing to give, while the Panamanian one has everything. Jurisdiction is the second line of defense, not the first.

RAM-only servers: what they are and why they matter

QUICK ANSWE

RAM-only servers store all data in volatile memory rather than on hard drives. When the server powers off or reboots, whether by design, by accident, or under seizure, every byte of data it ever held is permanently gone. For a no-logs VPN, RAM-only servers add a physical layer of enforcement: even if a no-logs policy were violated and data were stored, it would be automatically erased at reboot.

Traditional servers write data to hard drives. If a law enforcement agency seizes a server (which has happened to multiple VPN providers), any data on those drives is potentially recoverable, even data the VPN intended to delete.

RAM-only servers flip this: all data lives in volatile memory (RAM), which requires constant power to maintain. The moment power is cut, the data is gone. No recovery is possible.

For a VPN that genuinely logs nothing, RAM-only servers add physical insurance: even if something was inadvertently stored during a session, a server reboot wipes it. Some providers also configure servers to reboot regularly on a schedule, ensuring temporary data is continuously cleared.

VPNs with documented RAM-only infrastructure (as of 2026):

ExpressVPN (TrustedServer technology, independently audited)

NordVPN (colocated servers, some RAM-only)

Surfshark (RAM-only on most servers)

OllaVPN (RAM-only across infrastructure)

RAM-only is increasingly a baseline expectation for a credible no-logs claim, rather than a premium differentiator. A VPN without it is worth asking why.

Five myths about no-logs VPNs

Myth 1: “If a VPN has a no-logs policy, I’m fully anonymous online.”

A no-logs VPN protects you against your ISP seeing your traffic, and against the VPN provider being compelled to hand over your data. It does not make you anonymous against websites tracking you via cookies and fingerprinting, against social media platforms where you’re logged in, against your own device’s advertising ID, or against a global passive adversary correlating timing attacks. No-logs is a meaningful privacy property, it’s not anonymity.

Myth 2: “A no-logs VPN means the company can never know anything about me.”

Even a VPN that stores no activity or connection logs will typically know your payment method (which may link to your identity), your email address if you created an account, and possibly your device’s network-layer identifiers during the connection handshake itself. The no-logs property applies to what’s retained after the fact, not to what’s momentarily processed during the session.

Myth 3: “If a VPN has been audited, the audit proves they’re trustworthy forever.”

An audit is a snapshot. It confirms the state of the infrastructure on the day the auditors examined it. If the VPN makes subsequent changes to its architecture, the audit doesn’t cover those changes. This is why recurring audits, the same firm, every year or two, matter much more than a single historical audit certificate.

Myth 4: “The no-logs policy in the privacy policy is legally binding.”

Privacy policies are legally complex. Depending on jurisdiction, a company that violates its own privacy policy may face regulatory action, but the policy isn’t a contract between you and the provider in the way a signed agreement is. In practice, users have limited recourse when a provider’s behavior doesn’t match its stated policy.

Myth 5: “Free VPNs always sell your data.”

Not true, though the base rate of data selling is much higher among free VPNs than among paid ones. The free VPNs covered in this guide, Proton VPN Free, Windscribe Free, OllaVPN Free, have transparent business models and genuine no-logs architectures. “Free VPNs sell your data” is a useful heuristic that’s accurate for most of the market, not a universal law.

The no-logs VPN evaluation checklist

Your complete due-diligence checklist for evaluating any VPN’s no-logs claim

Privacy policy review:

Policy explicitly states no IP addresses are stored

Policy explicitly states no connection timestamps or session durations are stored

No broad carve-outs for “abuse prevention,” “legal compliance,” or “troubleshooting”

Policy updated within the past 12 months

Technical architecture:

RAM-only servers, or documented equivalent

DNS resolved inside the encrypted tunnel by the VPN’s own resolver

Kill switch always-on by default (not just available as an option)

IPv6 handled inside the tunnel or blocked by default

No third-party analytics SDKs in the mobile app (check with Exodus Privacy on Android)

External verification

Independent audit completed by a named security firm

Audit is recent (within 18 months) and recurring, not a one-time certificate

Full audit report publicly available (not just a press release summary)

Company has faced real-world legal demand and produced no useful user data

Business model:

Revenue model clearly explained, you understand how the company makes money

If free, subsidized by a paid tier with the same architecture

Parent company does not have a history of data monetization

No acquisition history that changed the privacy posture

Jurisdiction:

Based outside Five Eyes and major surveillance alliances

No mandatory data retention requirements in home jurisdiction

Published transparency report, even if empty

If a VPN passes all or most of these checks, the no-logs claim is meaningfully more trustworthy than one that doesn’t. If it fails on the audit row, no independent verification at all, treat the claim as unverified regardless of how compelling the marketing copy is.

How OllaVPN handles your logs: by default

We built OllaVPN around one question: what would a VPN look like if privacy were a technical property rather than a marketing claim?

The result for the logs question specifically:

No activity logs, ever. We do not store any record of the websites you visit, the content you access, or the apps you use while connected.

No connection logs, ever. We do not store your real IP address, connection timestamps, session durations, or per-session bandwidth. When your session ends, there is nothing left that connects your identity to your activity.

RAM-only server infrastructure. All VPN server data lives in volatile memory. A server reboot, whether scheduled, accidental, or compelled, wipes everything automatically. There are no hard drives to seize.

DNS inside the encrypted tunnel. Your DNS queries, the lookups that reveal every domain you visit, go through OllaVPN’s own unbound resolver, inside the tunnel. Your ISP cannot see them. No third-party DNS provider receives them. If you want to understand why this matters, the DNS leak guide explains it in full.

No account required on the free plan. You don’t give us an email address to get started. There is no account to link your session to. No identifier on our side connects your download to your traffic.

Post-quantum cryptography on every connection. The hybrid X25519 + ML-KEM-768 handshake means that even if someone captures your encrypted VPN traffic today and stores it, they cannot decrypt it with a future quantum computer. For the specific threat of state-level adversaries harvesting VPN traffic for future analysis, this is meaningful. The post-quantum guide explains the “harvest now, decrypt later” threat model in detail.

Kill switch always on, cannot be disabled. If the tunnel drops for any reason, all traffic stops until it’s back. Your real IP address does not briefly appear to the sites you’re visiting.

Independent audit. The architecture has been independently verified by a named security firm.

OllaVPN plans:

Lifetime free · $0 · 10 Mbps No logs. No caps. No ads. No email required. Every country. Kill switch. In-tunnel DNS. PQC-ready.

Paid plan · $2 / month · 10 Gbps Same no-logs architecture. Faster. Five devices on one account

Download free, no email, no card. The no-logs architecture is on from your first connection.