The VPN advert on YouTube is not selling you privacy

Read this first

Disclosure

I use ExpressVPN. It is the tool I use myself, and it is scored here like the other eight, with its owner's links counted against it like anyone else's. This is not a paid advert. Nobody sponsored this page and there are no affiliate links on it.

I wrote it because I am tired of creators on YouTube and other platforms selling low quality, and sometimes dangerous, security products that are not fit for purpose. In my view many of them check nothing beyond what the sponsor pays for the slot.

Why the advert tells you nothing useful

An advert is bought. The company pays, the presenter reads the script, and the script is written to sell. It will say encryption and no logs. It will not say where the company is registered, who owns it, or which country's courts can order it to act. Those three facts decide whether a knock on the door is possible.

Ownership is the first thing hidden. Kape Technologies, formerly Crossrider, a company linked to adware distribution, owns ExpressVPN, CyberGhost and Private Internet Access. Its media arm has also run VPN review sites such as vpnMentor and Safety Detectives. Three of the nine providers in this article share one owner, and that owner has run sites that rank them.

No logs is a claim, and claims fail when they are tested. Court documents reported in 2016 showed IPVanish giving US Homeland Security a customer's name, email address, IP address and connection logs, after first saying it had no data. In 2017 the FBI used records from PureVPN in a cyberstalking case, when its policy said it kept no logs that could identify a user's activity. In May 2026 French and Dutch police seized 33 servers in 27 countries belonging to a service called 1VPNS, which advertised no logs, and reportedly identified 506 users.

The same test has gone the other way. A server seized from ExpressVPN in Turkey in 2017 reportedly gave nothing usable. Swedish police raided Mullvad in 2023 and left empty handed. PIA says it was subpoenaed for logs in 2016 and 2017 and had none. A Greek court dismissed charges against Windscribe's founder in 2025.

What separates the two groups is not the advert. It is what the company stores, and who can order it to store more.

What you are actually buying

At its simplest a VPN is a relay. Websites see the VPN company's address instead of yours, and your internet provider sees an encrypted connection to the VPN instead of the sites you visit. That is relocation. It moves where you appear to be, and it moves who can see your traffic, from your internet provider to the VPN company.

For watching something from another country's catalogue, that is all you need. It is not, on its own, protection of your identity. Whether the company that now sees your traffic can be made to hand it over, or to start recording it, depends on the five things scored below. It does not depend on the price or on the advert.

Two kinds of government request

Requests about the past

A subpoena, a warrant, a raid or a formal request from a foreign police force asks for what a company already holds. The defence is engineering: nothing stored, so nothing to hand over.

RAM-only servers are the strongest form of it. Memory only holds live connections, and it is wiped when the server is powered off or rebooted. ExpressVPN says its servers wipe on every reboot, and one review reports they reboot every one to two weeks. Memory freed when a session ends is reused by new connections, so on a busy server old sessions get overwritten.

To get anything out of one, investigators would have to seize it while it is switched on, keep it running, capture the memory intact and preserve it as evidence. Even then it would show only the connections live at that moment, not anyone's history.

There is also time. A request from abroad has to go through a formal process in the provider's own country. For a British Virgin Islands operator, that means a written request to the islands' Attorney General. It takes time, and by the time it lands, past sessions have gone from memory.

Orders about the future

A different order asks a company to record from now on. RAM does not help, because the server can write down what happens next. Only the law of the country the company sits in decides whether that can be forced.

The United States has court orders that make a communications provider install and monitor a pen register for up to 60 days. A pen register collects metadata, not content, and the order can be sealed so the provider cannot tell the user. In the Netherlands, the intelligence services can order communication providers to help with live interception, and refusing is a criminal offence.

This is why jurisdiction gets its own scores. Engineering covers the past. Jurisdiction covers the future.

How the scores work

Every VPN here is marked on five things. Each has a fixed rule, so the same facts always give the same score. In every column, high is good and low is bad.

Two worked examples

IVPN. All servers RAM-only (3). Audited repeatedly by a named firm (2). No public seizure or court test found (0). Operator in Gibraltar, outside the fourteen (2). No links (2). Total 9.0.

PIA. All servers RAM-only (3). Audited (2). Subpoenas that PIA says found nothing (0.5). Operator in the USA (0). One link, because Kape adds the UK (1). Total 6.5.

PIA has the stronger real-world test record, and still finishes 2.5 points behind. The gap comes from where the operator sits and who else has a hand on it.

Provider by provider: what the exposure really is

IVPN, 9.0, Gibraltar

Top of the table. RAM-only, annual audits by Cure53, no email needed to sign up, and it takes cash and Monero. Gibraltar is a British Overseas Territory with its own legal system, and foreign requests go through its own process. It scores 0 on the seizure test only because no public case was found, which is a gap in the record, not a failing.

ExpressVPN, 8.5, British Virgin Islands

RAM-only, and audited by PwC, KPMG and Cure53. A server seized in Turkey in 2017 reportedly gave nothing usable. The exposure is Kape, which owns it and is listed with a London headquarters. UK orders can only be served on people in London, and it matters only if they can reach ExpressVPN's systems. No evidence was found that they can. Kape's owner is reported to live in Cyprus and holds it through an Isle of Man company.

Mullvad, 8.5, Sweden

RAM-only, with an account that is just a random number and no email, and cash accepted. In April 2023 Swedish police raided its Gothenburg office at the request of a German investigation and left with nothing. The exposure is simple: it is a Swedish company, Sweden is in the Fourteen Eyes, so Swedish orders can be served on it directly.

CyberGhost, 8.0, Romania

RAM-only, with three Deloitte Romania audits: 2022, 2024 and a third announced in February 2026. The operator is Romanian, outside the fourteen. The exposure is the same as ExpressVPN's: Kape has owned it since 2017, and its London headquarters adds the UK.

Surfshark, 7.0, Netherlands

RAM-only, with Deloitte audits reported for 2022 and 2023. It moved from the British Virgin Islands to the Netherlands in October 2021, and customers who signed up since then contract with Surfshark B.V. Dutch intelligence law lets the services order communication providers to help with live interception, and refusing is a criminal offence. Those orders can be served on it directly. It has shared a group with NordVPN since 2022.

NordVPN, 6.5, Netherlands (registered in Panama)

RAM-only, with Deloitte and PwC audits reported. The operating company, nordvpn S.A., is registered in Panama, and Nord says Panama has no mandatory data retention law. But the company is listed in a credit database with an establishment in Amsterdam, and the group holdings sit in the Netherlands and in a UK-registered company, Nordsec Ltd. The founders and Nordsec's director live in Lithuania. It is scored at the Dutch tier, and its one link is the UK holding company.

PIA, 6.5, USA

RAM-only according to its own transparency report, with Deloitte audits reported for 2022, 2024 and 2025. PIA says it was subpoenaed for logs in 2016 and 2017 and had none. The exposure is where it sits. It is a US company, and US law provides sealed monitoring orders that run forward. It is also owned by Kape.

Windscribe, 6.5, Canada

RAM-only, after it rebuilt its network following a 2021 incident. A Greek court dismissed charges against its founder in 2025. Windscribe says Dutch authorities seized a server and found only a stock install, but only the company has confirmed that, so it counts for half a point. Its infrastructure was audited by PacketLabs in 2024, but reviews report no published independent audit of its no-logs policy. It is a Canadian company, and Canada is in the Five Eyes.

ProtonVPN, 6.0, Switzerland

The best jurisdiction on paper: Switzerland is outside every alliance, and its law does not force VPN providers to log today. Four annual Securitum audits are reported for 2022 to 2025. But Proton says it uses hard disks with full-disk encryption instead of RAM-only servers, so it scores 1 of 3 there. And its jurisdiction is under threat, as the Swiss section below explains. Its total is the lowest here.

EU GDPR: what it does and what it does not

GDPR is the EU's data protection law and has applied since 25 May 2018. It covers how companies handle the personal data of people in the EU. It reaches beyond the EU: a company anywhere that offers services to people in the EU, or monitors their behaviour, has to follow it and must appoint a representative in the EU. Fines can reach 20 million euros or 4 percent of annual worldwide turnover, whichever is higher.

For a VPN user that means rights over your own data, such as access and erasure, and a duty on the company to collect no more than it needs. Sweden, the Netherlands and Romania are EU states, so it applies directly to Mullvad, Surfshark and CyberGhost. It also reaches providers outside the EU that sell to people in it.

What it does not do is stop a government. Processing for national security sits outside EU law, and police use of personal data is covered by a separate law, the Law Enforcement Directive. GDPR governs how a company treats you. It does not switch off an intelligence agency's own powers, and it does not stop the Dutch interception orders described above.

The UK left the EU and now has its own version, the UK GDPR, built on the same rules.

What Switzerland is doing

Switzerland is outside the EU and all the eyes, and for years that made it the default answer for privacy. Its current law does not force VPN providers to log. That is now under threat.

The Swiss government has proposed rewriting the ordinance on surveillance of post and telecoms traffic, known by its German initials VÜPF. The draft would apply to VPN, email and messaging providers with as few as 5,000 users. They would have to identify customers with a government document, keep IP addresses and connection data for six months, and be able to decrypt what they have encrypted. It is an ordinance issued by the government, not a law passed by parliament.

The first consultation closed on 6 May 2025 with a near-uniformly hostile response. In February 2026 the justice department said it had commissioned an external risk impact assessment and would prepare a second consultation. As of June 2026 there was no binding timetable, and the Federal Council had not said the project was dead. A paused law is not a buried one.

Proton, the best known Swiss provider, froze new Swiss data-centre spending and put the servers for its new AI assistant in Germany, with facilities also being built in Norway. It says its headquarters, legal entity and core Mail and VPN infrastructure stay in Geneva. Its chief executive has said the company would leave if the amendment passes.

That leaves ProtonVPN exposed either way. If the rule passes and Proton stays, it has to log. If it leaves, the places it is already building servers, Germany and Norway, are inside the alliances, and the company and its data would still sit under alliance-state law. That is why it scores 1 point on intel protection, and why having no RAM-only servers matters.

What to do with this

Read the advert as what it is: a paid script. Then ask the same five questions of any VPN, the ones in the table. Does it run RAM-only servers? Has a named firm audited it, recently and more than once? Has its no-logs claim been tested by a seizure or a court? Which country is the operator in? Who else, in which country, owns it or can pull it?

Then look at what it costs in year three, not year one. The deal in the advert is the introductory price.

No provider scores 10. The top score is 9.0, and it loses its point only because no public seizure or court test was found. Nobody here is out of reach of every possible order, so pick on evidence, not on the advert.

About these ratings: the method is this site's own. It is based on public sources and company statements, checked on 28 September 2026. Companies change owners, servers and laws, so check current details before you rely on any of this. This page is information, not legal advice.