How to Check a VPN App for Trackers

A VPN app asks for a lot of trust. It sits between your device and the internet, and you install it precisely because you care about privacy. It would be ironic if the app itself were stuffed with code that reports your behaviour to advertising and analytics companies. That does happen with some apps in every category, and privacy tools are not exempt just because of what they promise.

This article gives you a VPN app tracker test you can run yourself in under an hour. You do not need to be a developer. The method has four steps, from the easiest (reading) to the most revealing (watching what the app contacts), followed by guidance on how to judge what you find and what the test cannot show. We do not name any app or company, and the method works on any VPN app, free or paid.

What a tracker is, in plain terms

Most apps are not written from scratch. Developers include ready-made blocks of code called software development kits, or SDKs. Some SDKs add features such as crash reports, push notifications or payment handling. Others exist to measure and profile users. A tracker in this article means a third-party SDK or request that sends data about you or your device to a company other than the app's maker.

Common kinds are:

• Advertising SDKs that fetch and show ads, and often share an advertising identifier or device details.
• Analytics SDKs that record which screens you open, how long you use the app and sometimes what you tap.
• Attribution tools that measure which ad campaign led you to install.
• Crash reporting tools that send technical details when the app fails. These are usually the least concerning, but they still send device information.

None of these is illegal on its face. The issue is fit. A shopping app is expected to know what you browse in it. A tool whose purpose is to reduce what others learn about you is expected to be cautious about what it shares itself. That is the standard this test applies.

Step 1: Read the store privacy information

Both major app stores ask developers to describe what data the app collects. These are statements by the developer, not independent audits, but they are the cheapest evidence you can get.

On the iPhone App Store, scroll to the section titled App Privacy. Apple explains the format in its developer guidance on app privacy details. You will see groups such as "Data Used to Track You", "Data Linked to You" and "Data Not Linked to You".

On Google Play, open the app page and find the Data safety section. It lists what is collected and shared, whether data is encrypted in transit and whether you can request deletion.

Write down the following in a notes app.

Question	Where to look	Why it matters
Does it say data is used to track you?	App Privacy on iPhone	Tracking means linking your activity across other companies' apps and sites
What categories are shared with third parties?	Data safety on Android	Sharing is a different matter from collecting for the app's own use
Does it collect identifiers, location or browsing history?	Both	A VPN needs little of this to function
Is the label detailed or blank?	Both	"No data collected" on a free app deserves a second look

What to compare

A privacy-focused tool that declares a long list of tracking categories is a mismatch worth noticing. So is the reverse: an app that declares nothing but later turns out to contact many outside companies. Keep your notes, because step 4 gives you something to compare them against.

For a wider checklist before installing on each platform, see how to check a free VPN app on Android and on iPhone.

Step 2: Read the privacy policy for named third parties

The policy is dull, but it contains the names. Open it and use the search function on the page.

Search for these words one at a time: third party, partner, advertis, analytics, affiliate, share, sell, identifier, retain.

For each hit, note:

1. Does it name the companies, or does it only say "trusted partners"?
2. Does it say the data is anonymised, and does it explain what that means?
3. Does it say how long data is kept?
4. Does it describe what happens to browsing data specifically?

Be cautious of sentences that are very broad, such as a promise to "share information with partners for business purposes". That wording allows almost anything. A better policy names categories and reasons, and says what it does not do.

Compare the policy with the store label. If one says "we do not share data with third parties" and the other lists advertising partners, you have found a contradiction. That is a stronger sign than any single tracker.

The article on how free VPNs make money explains why advertising and data partnerships are common in free apps, which helps you interpret what you read. It also helps you understand when a free app's behaviour is predictable rather than shocking.

Step 3: Look at the permissions and the app's own settings

Trackers often come with extra permissions. Check them quickly here, and see our separate article on auditing VPN app permissions for a full walkthrough.

For this test, look for two things.

• Permissions that have nothing to do with the job. Contacts, calendar, microphone or precise location are out of place for a VPN app.
• Settings inside the app. Many apps include a toggle such as "share usage data" or "personalised ads". If the app asks for consent on first launch, notice whether the default is on or off and whether declining is easy.

An app that makes you accept everything to continue is telling you something about how it treats choice.

Step 4: Watch what the app contacts

This is the most revealing step. The idea is simple: use the app for a few minutes with nothing else running, and look at the list of internet domains your device contacts. You are looking for names that belong to advertising, analytics and tracking companies.

What you need

• A spare phone or a phone that you are willing to dedicate to the test, ideally with no other apps active.
• Access to a list of domains your network is asked to look up. You have three common options:
  1. Your home router's log or DNS settings, if it records lookups.
  2. A DNS filtering service that offers a query log for your own network.
  3. A network monitoring app on your phone that lists connections per app. These apps typically run locally, and some use a local VPN profile to do so, which means they cannot run at the same time as your VPN app. Check that the one you pick is reputable and that you understand its permissions.

The procedure

1. Disconnect from any VPN. The goal is to see the app's own requests on your network.
2. Close all other apps on the test phone.
3. Clear the log or note the time.
4. Open the VPN app, wait on the first screen for two minutes without tapping anything, then sign in or browse its screens for another five.
5. Close the app and wait a minute.
6. Export or read the list of domains requested during that window.

Reading the list

A domain name usually tells you who runs it. Make three groups.

Group	Examples of what the names suggest	How to treat it
The app's own services	Names that match the developer or the service's own website	Expected
Infrastructure	Content delivery networks, app stores, certificate and time services	Usually fine
Third-party tracking	Names of ad networks, analytics dashboards, attribution services, social network widgets	Count them and compare with your notes

Search any unfamiliar name in a search engine together with the word "domain". Public tracker lists will often say what it is. Count how many different tracking companies appear before you have even signed in.

Example: Priya tests a free app on a spare phone. In seven minutes the log shows the developer's own domain, two infrastructure domains, and nine names that look like ad and analytics services. The store label said the app collected only "diagnostics". The mismatch is the finding, and she decides not to use that app on her main phone.

How to judge what you found

There is no magic number, but these guidelines are fair.

1. Zero to two third-party analytics or crash tools, named in the policy. Common and reasonable for any app.
2. Several advertising or attribution services in a privacy tool. A warning. Ask whether the benefit is worth it.
3. Tracking contacts before you have consented to anything. A stronger warning, because it suggests data leaves your device by default.
4. Contradictions between label, policy and observed behaviour. The most serious sign, because it points to poor care or poor honesty.

Also consider the purpose. If you use a VPN on a hotel network for a weekend, you may accept a small trade-off. If the app will be on your phone permanently, the bar should be higher.

The red flags for free VPNs article places these results in a wider context, and the explainer on tracking cookies shows why a VPN alone does not stop trackers on websites.

Limits of this test

• It sees destinations, not contents. You can see that an app talked to a company, not what it sent.
• Apps can be quiet during your test. Some trackers wake up later or only after sign-in or an update. Repeat the test after a week.
• Local filtering can distort results. If your router already blocks some tracking domains, you will see fewer, so know what your network does.
• Encrypted DNS hides lookups. If the app or phone uses encrypted DNS, your router may not see the domain list. Use a method that works on the phone itself.
• A clean result does not prove the app is trustworthy. It only means you did not see this particular problem.

A VPN also does not remove trackers inside other apps or websites, so one clean VPN app should not make you relax about the rest.

A quick checklist

1. Read the store privacy label and write down its claims.
2. Search the policy for named partners and for broad wording.
3. Check permissions that do not match a VPN's job.
4. Watch the domains the app contacts for five minutes without a VPN.
5. Compare all three sources and note contradictions.
6. Decide, and repeat the test after updates.

Summary

A tracker test compares what an app says about itself with what it actually does. Read the store label, read the policy for named third parties, check permissions, and watch the domains the app contacts for a few minutes. Judge the result against the job the app claims to do: a privacy tool full of advertising code is a mismatch, while a single crash reporter is normal. Remember the limits, since you see destinations rather than contents and a quiet app on test day may behave differently later.

If you prefer a straightforward prepaid option and a free app you can check yourself, the download page and the pricing page are good places to start.