Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Six of the providers we review have faced a real demand. Four of them had nothing to hand over. Two produced exactly what they had advertised not to keep.
And the tunnel is rarely where an investigation succeeds. In the most cited case the suspect used Tor, a VPN, anonymous messaging and offshore email — and also, in some of the attacks, his own employer’s computer.
⚠️ So the honest answer is that a VPN is not an anonymity tool. Treating it as one is the risk this page exists to correct.
The Documented Record
Mullvad, 2023. Swedish police arrived at the Gothenburg office with a search warrant and left with nothing, because no customer data existed to seize.
ExpressVPN, 2017. Turkish investigators seized a server during a criminal inquiry and recovered nothing usable from it.
Private Internet Access, 2016 and 2018. Two federal subpoenas in United States cases, and nothing produced on either occasion.
Windscribe, 2025. A co-founder faced criminal charges in Greece with Interpol involved. The case collapsed because the company held no user data.
⚠️ Two went the other way. PureVPN supplied connection logs in 2017, and IPVanish supplied user details in 2016. Both advertised no logs at the time.
What Actually Decided Those Cases
Architecture, not jurisdiction. Mullvad operates from Sweden inside the Fourteen Eyes arrangement and still had nothing. PureVPN was registered offshore and had records.
The question a warrant asks is what exists. A favourable country changes which court issues the order. It does not change what the company can produce when the order arrives.
⚠️ Which is why we weigh real tests above audits. An audit reports what was true on a chosen date. A warrant reports what was true on the day it arrived — and only sixteen of twenty-three providers have even been audited.
Nothing here is a guarantee about the future. A company that held nothing in 2018 can change its systems, its owner or its country — and several did exactly that during 2026.
One Provider Rewrote Its Own Promise
This one deserves naming, and it is uncomfortable for us to publish.
NordVPN wrote in 2017 that it “will not comply” with requests from foreign governments and law enforcement agencies. The wording was unambiguous.
That post was later edited. It now says the company will comply only if requests arrive according to laws and regulations, and NordVPN confirmed to PCMag that it will honour lawful requests.
⚠️ The context was a takedown. A Europol-led operation seized fifteen servers from VPNLab, a separate provider, and Europol indicated that its refusal to cooperate was a factor.
The current position is the defensible one. No company can promise to ignore lawful orders. But the promise changed after publication. And this is the provider we rank first and earn most from, which is exactly why we are saying so.
Where Investigations Usually Succeed
Outside the tunnel. Encryption covers the journey between your device and the provider. It covers nothing about the accounts you signed into or the payment that bought the subscription.
The Ryan Lin case is the standard illustration. He used Tor, a VPN, anonymous texting and offshore email across a sixteen-month campaign of harassment. Reporting describes a work computer as leaving the traces that connected him to it.
⚠️ So the layers did not fail — one habit did. That is the pattern worth understanding, and it is why the page on what a VPN hides is the shorter and more useful answer to most versions of this question.
We are not publishing a checklist. This page exists to correct a belief, not to describe how anyone might avoid an investigation.
What This Means for an Ordinary Reader
If you are not under investigation, none of this applies to you. A VPN moves visibility from your internet provider to a VPN company, and that is the whole transaction.
If you have a real threat model, a VPN is not the answer on its own. Journalists and activists need advice from people who do that work, not from a review site. Besides, some of the measures that matter most cost nothing.
⚠️ And nothing here is legal advice. We are not lawyers, and what any authority can compel varies by country — our legality pages cover the jurisdictions we have examined.
The useful takeaway is narrow. Ask which providers have been tested, what happened, and whether the architecture holds records at all.
How We Research
Our own page on no-logs claims supplies the documented cases and names its sources for each: Mullvad’s 2023 blog post and reporting on the Gothenburg warrant, published accounts of the 2017 Turkish server seizure, reporting on the two Private Internet Access subpoenas, Windscribe’s account of the Greek prosecution, and court reporting on the PureVPN and IPVanish disclosures. For the NordVPN wording change, the company’s statement to PCMag and the Europol operation against VPNLab, we draw on TechRadar’s report. TechRadar also supplies the detail about a work computer in the Ryan Lin case. We have not reproduced any of the operational advice those sources contain, and we do not run our own tests. Our method lives on the About Us page.
Police and VPNs FAQ
They can compel a provider to produce what it holds. Of the six providers in our catalogue that have faced a real demand, four had nothing to give and two produced connection records. What decided the outcome was the architecture rather than the country.
No, and treating it as one is the mistake worth correcting. A VPN moves visibility from your internet provider to the VPN company. It does not cover the accounts you sign into, the payment that bought the subscription, or the device itself.
Mullvad in a 2023 Swedish police search, ExpressVPN in a 2017 Turkish server seizure, Private Internet Access in two federal subpoenas, and Windscribe in a 2025 Greek prosecution. All four produced nothing. PureVPN and IPVanish produced records in 2017 and 2016.
Its wording changed. A 2017 blog post said the company would not comply with requests from foreign governments. The post was later edited to say it will comply only where requests arrive according to laws and regulations, which the company confirmed publicly.
Less than people assume. Mullvad operates from Sweden inside the Fourteen Eyes arrangement and still had nothing to surrender, while a provider registered offshore had records. The country decides which court issues an order, not what the company can produce.
The Verdict
Four of six held nothing, and two handed over records. That is the entire documented history, and it turns on what each company’s systems retained rather than on where it was registered.
The tunnel is rarely the weakest link. Accounts, payments, devices and a single habit account for more than encryption ever does.
And one provider quietly rewrote its promise. The current wording is the honest one, and the change is worth knowing about the company we rank first.