Popular VPN Apps Found Leaking User Data, New Research Warns

Millions of people rely on Virtual Private Networks (VPNs) to protect their online privacy and secure their internet activity. However, a new study suggests that many popular VPN apps are failing to deliver the protection users expect.

New Research Raises Serious Concerns

Researchers from the University of Michigan Engineering have revealed that several widely used VPN applications are exposing sensitive user internet data instead of protecting it.

To conduct the study, security experts developed MVPNalyzer, the world's first automated framework designed to evaluate the security of mobile VPN apps at scale.

The research was presented at the Network and Distributed System Security (NDSS) Symposium 2026.

What the Researchers Found

The team analyzed 281 popular Android VPN apps and discovered several alarming security issues.

Key Findings

29 VPN apps were leaking users' DNS and browser traffic, defeating the primary purpose of using a VPN.
More than 20% of VPN apps transmitted internet data without encryption.
Over 60% of the apps lacked even basic security protections, increasing the risk of cyberattacks.

Why It Matters

VPN services are widely trusted to keep browsing activity private and secure. However, the study shows that many applications fail to meet even fundamental security standards.

Instead of protecting users, some VPN apps may expose sensitive internet activity through data leaks or weak security practices.

Goal of the Research

According to the researchers, the purpose of this study is to help:

Users make more informed decisions when choosing VPN apps.
Regulators better understand how VPN services actually operate.
Security researchers evaluate VPN applications more effectively.
Encourage the VPN industry to improve its security standards and accountability.

Conclusion

The findings highlight an important reminder that not every VPN app provides the level of privacy it promises. As online security becomes increasingly important, users should carefully evaluate VPN services rather than assuming all of them offer the same level of protection. The research also places greater pressure on developers to improve security practices and meet higher standards for protecting user data.