Part of the topic: 🔐 Online security
VPN statistics 2026: usage, audits and facts
Key numbers about VPNs – usage, reasons, audits and risks. Every figure links to its source; we update this page regularly.
42% of US adults used a VPN on personal or work devices in 2026, up from 32% in 2025 (online survey of 1,008 US adults, August 2026).
General privacy (56%) and general security (51%) are the top reasons US VPN users give for using a VPN.
27% of US VPN users use a VPN to access international or non-local media, and another 27% to reduce online tracking; 25% want to hide their activity from their internet provider.
43% of US VPN users used a free VPN in 2026, up from 28% in 2025.
25.5% of Germans use a VPN, and 61.7% know what a VPN is, according to a survey commissioned by NordVPN (151,400 respondents in 18 countries, August 2020 to March 2023).
In Germany, 38% of VPN users mainly want to protect their online privacy, and 33.3% mainly want to protect their devices and online accounts.
About half of respondents in a Statista Consumer Insights survey in Germany had used a VPN service at some point; NordVPN was the most used provider, used by about 19% in the previous 12 months, followed by Avira Phantom VPN (about 10%) and CyberGhost (about 7%).
The global VPN market reached an estimated USD 54.1 billion in 2025 and is projected to reach USD 155.9 billion by 2034 (CAGR 12.11%, 2026–2034).
NordVPN's no-logs policy was independently verified for the sixth time by Deloitte Lithuania (assessment from 10 November to 12 December 2025).
Surfshark's no-logs policy was first verified by Deloitte in January 2023, and Deloitte confirmed it again in 2025.
ExpressVPN has completed 23 independent third-party audits; the latest, by KPMG, confirmed its no-logs server infrastructure (TrustedServer) as of 28 February 2025.
Proton VPN passed its fourth consecutive independent no-logs audit, carried out by the European security firm Securitum in August 2025.
A security audit by Assured Security Consultants (August 2025) found no critical, high- or medium-severity issues in Mullvad's website and public web services; one low-severity issue was fixed.
On 20 September 2022 the EU Court of Justice ruled (joined cases C-793/19 SpaceNet and C-794/19 Telekom Deutschland) that EU law precludes general and indiscriminate retention of traffic and location data. IP addresses may be retained for a period limited to what is strictly necessary to fight serious crime.
Germany's federal cabinet approved a bill in April 2026 that would require internet providers to store their customers' assigned IP addresses for three months. As of 18 October 2026 it was still before the Bundestag (bill 21/6581; legal committee hearing on 7 October 2026).
A study of 283 Android VPN apps by CSIRO, ICSI/UC Berkeley and UNSW found that 18% used no encryption at all and 84% leaked user traffic.
Of the top 100 free VPNs that Apple's US App Store offered in 2024, 20 were secretly owned by Chinese companies, and none of them clearly disclosed this.
36% of Americans at least suspect they had a security incident after using public Wi-Fi, and 19% are certain; 18% admit logging into their bank on public Wi-Fi (survey of 1,014 US adults, July 2025).