This link explains the inconsistency with what VPN services consider 'logging'. Certainly, there is no way for us to verify their claims without an extremely rigorous independent audit. But even that can be sabotaged.

Regardless though, many VPN service providers vehemently claim that they do not keep logs. An example is NordVPN, which is based in Panama and so there is no domestic legislation that forces it to keep logs:

NordVPN Privacy Policy:

"Our top priority is customer data security. Operating under the jurisdiction of Panama allows us to guarantee our no logs policy, which means that your activities while using the privacy solutions created by NordVPN.com are not monitored, recorded, logged, stored or passed to any third party."

What I do not understand is companies like NordVPN have hundreds of servers around the world, most of which are not in the country that they are originally based in.

Surely, no-logging is impossible for most of their servers? Or are companies compelled to log depending on where they are based? So US legislation would not apply to a VPN server in the US which is run by a company based in Hong Kong - but this doesn't make sense - wouldn't US legislation apply to them regardless of where they are based?

This link says, again, that one of the pros of VPN servers being based in Hong Kong is that companies are not compelled to keep logs (I assume this is in contrast with servers in the US and other countries):

"There are no mandatory data retention laws in Hong Kong. Most Hong Kong-based providers offer a “no logs” service, and international companies are not required to keep logs relating to their Hong Kong servers (although some companies, notably US based ones, choose to do so)."

Surely legislation does not discriminate based on where a company is based? Eg. all companies that operate in the UK are forced to abide by the Data Protection Act (DPA). Whether or not they are based in the UK does not matter. As long as the data that that company possesses remains in the UK, it has to be treated in compliance with UK law.

My assumption here is that any legislation regarding mass surveillance of private citizens is followed by companies the same as legislation regarding anything else (DPA, legislation about the treatment of employees, etc.).

Is there a technical reason for all this?

  • Who would do the forcing?
    – Mark
    Jan 8, 2018 at 4:34
  • The government. Eg. US government, that passes mass-surveillance legislation? If the government argues they need logs to keep track of the movements of terrorists, wouldn't a company saying "we do not keep logs by choice" be condemned as impeding government counter-terrorism efforts? If the law requires all VPN servers in the US to keep logs, wouldn't a company not keeping logs be in violation of the law and hence 'criminal'?
    – user138072
    Jan 8, 2018 at 4:45
  • your friend's mom can't ground you, only your mom can... sometimes moms are in cahoots.
    – dandavis
    Jan 8, 2018 at 5:04
  • I'm voting to close this question as off-topic because this is not a technical question but a pure legal or political question. law.stackexchange.com or politics.stackexchange.com might be more appropriate places to ask this questions. Jan 8, 2018 at 6:09
  • I posted here because I assumed there was a technical reason behind it. If it's a legal loophole, it sounds like a dumb loophole if politicians are trying to claim they need logs to track down criminals (including terrorists).
    – user138072
    Jan 23, 2018 at 10:01


Browse other questions tagged or ask your own question.