How to Compare VPN Transparency Reports

You have two browser tabs open. One provider has a glossy page called "Transparency", the other has a dense PDF full of tables. Both claim to be open about how they handle data and legal requests, yet you cannot tell which one says more. That is the problem a VPN transparency comparison solves: a repeatable way to put different documents on the same footing so that you can see what each one actually states, what it leaves out and what it simply asserts.

This article is about the comparing, not about what a transparency report is in the first place. If you need that background, start with what a VPN transparency report contains and come back. Here we build a sheet, read numbers in context, translate vague wording into checkable statements and talk about the limits of the whole exercise. We do not name or rank any company; the method works on any pair of reports.

Why side-by-side reading beats reading one report at a time

A single report is persuasive almost by design. It is written by the provider, laid out by their designer and structured to put the best foot forward. When you read it alone, your brain fills in the blanks generously. When you put two reports next to each other, the blanks become visible. One report lists the number of legal requests; the other never mentions requests. One names the period covered; the other says "recently". One says what happened when a request arrived; the other only says the company "values privacy".

Comparison also protects you from two opposite mistakes. The first is being impressed by length: a forty-page report may contain less checkable information than a two-page one. The second is being impressed by neatness: a report with a perfect row of zeros looks reassuring, but the zeros mean little if nothing explains the counting method.

A good comparison does not try to produce a winner. It produces a list of questions answered, questions unanswered and questions you still want to ask the provider. That list is more useful than a score, because you can bring it to a support chat or a purchase decision.

Step 1: Build a simple comparison sheet

Open a spreadsheet or a plain table on paper. Put one provider per column and these rows down the side. The point is to copy what each document says, in your own words, and to write "not stated" when a row cannot be filled in. Do not guess.

Row	What to write down
Legal entity	The company name and country named in the report
Services covered	Which products, apps or brands the report applies to
Period covered	Start and end dates, or "not stated"
Publication date	When the report itself was published
Update schedule	Yearly, twice a year, "when needed", or nothing
Request categories	Types listed, such as legal orders, takedown notices, law enforcement, civil claims
Counts	Numbers received, numbers answered, numbers refused
Outcome description	What was handed over, if anything, and in what general form
Method note	How the numbers were counted and who checked them
Independent review	Whether any outside party reviewed the report, and which

Ten rows is plenty. Fill in each column from the document itself, quoting short phrases where possible. If you find yourself writing "seems to say", change it to "not stated". After that, you can add a column for questions you want to ask.

A note on keeping notes honest

Write the sheet before you decide which provider you prefer. If you fill it in while rooting for one of them, you will unconsciously read their vague sentences kindly and the other one's strictly. A useful trick is to cover the provider names with "A" and "B" while you take notes, then reveal them at the end.

Step 2: Check scope before anything else

The scope rows come first because they decide whether the rest is meaningful. Three questions matter.

Which entity wrote it? Large providers can consist of several companies in different countries: one that sells the product, one that owns the network, one that runs support. A report written by the sales entity may say nothing about the entity that operates the infrastructure. Compare the company name in the report with the one in the terms of service. If they differ, note it, because the report may not describe the party that handles your data.

Which services does it cover? Some reports apply to the main app but not to browser extensions, free tiers or bundled products. Others cover "our services" without defining them. A report that clearly lists the products it covers is stronger than one that does not.

Which dates does it cover? A period such as "1 January to 31 December 2025" is checkable. "Over the past years" is not. If the period is a full year and the document was published long afterwards, note the delay. Some delay is normal because collecting and checking numbers takes time, but a gap of several years suggests the document is not kept up.

Traveller example: Mei is choosing a VPN before a two-month trip. Provider A's report says it covers "all consumer apps" between two specific dates. Provider B's report says it covers "the VPN service" without dates. Before reading a single number, Mei already knows A has made a more checkable claim than B.

Step 3: Read request counts in context

Numbers are where people tend to go wrong, in both directions. A big number is not automatically bad and a small one is not automatically good.

Three pieces of context change what a count means.

The size of the service. Ten requests to a service with a few thousand users is a very different situation from ten requests to a service with millions. Reports rarely give exact user numbers, so do not compute precise rates. Just remember that counts scale with how many people use the service and how visible the provider is.

The kind of request. A report may group together legal orders from courts, informal enquiries from authorities and automated copyright notices. Those are not the same thing. If a report lumps them into one number, write that down. If it separates them, check that the categories are described.

What happened next. The most informative part of any report is the outcome. Typical outcomes are: the provider answered, the provider answered in part, the provider rejected the request, or the provider had nothing relevant to hand over. A report that says "we received 12 requests and could provide only account-level details such as an email address and payment status in 2" tells you far more than "we received 12 requests".

A worked example with invented numbers

Imagine two reports for the same year.

• Report A: "Legal requests received: 6. Requests answered in full: 0. Answered in part: 2, with subscription details only. Rejected as invalid or outside our jurisdiction: 4."
• Report B: "Requests received: 0."

At first glance B looks cleaner. But A explains the categories, the outcome and the type of data involved. B gives only a total. Before you can prefer B you need to know whether B counts informal requests, whether it covers all services and whether it would still publish a report if it received any. A is not necessarily more private than B, but A has told you much more, so you can reason about it. B has told you a number, and a number alone cannot be reasoned about.

Step 4: Translate vague wording into checkable statements

Marketing language is slippery. The fix is to translate each sentence into a version that could, in principle, be proved wrong. If you cannot do that, the sentence is decoration.

Vague wording	What you can ask instead
"We respect your privacy"	Which categories of data does the company hold, and for how long?
"We only share data when legally required"	How many times in the reporting period, and what was shared?
"Independently verified"	By whom, covering which dates, with what scope, and is a summary public?
"Industry-leading transparency"	Which specific items are published that others do not publish?
"We have never received a request"	For how long, for which entity and does that include informal enquiries?
"Minimal data"	Minimal compared with what, and what exactly is on the list?

Make this a habit while filling the sheet. Wherever you find a phrase in the left column, add a row to your questions list. You will usually end up with five or six questions for each provider. Many will be answered by the privacy policy or the terms, so read those next. The privacy policy checklist is a good companion for that second step.

Watch the absolutes

Statements that use absolute words such as "never", "always" or "all" are only as strong as the evidence behind them. A report that says "we have never disclosed a customer's browsing activity" is a claim about the past; ask whether the provider explains what data exists to be disclosed in the first place. If there is no description of the data held, the absolute carries little weight.

Step 5: Look at what is missing

The most valuable comparison step is also the easiest to forget: noting absences. Go through your sheet and count the "not stated" cells in each column.

Common gaps include the following.

1. No method note. The report gives numbers but never says how they were collected.
2. No outcome detail. Requests are counted, yet there is no description of what was provided.
3. No definitions. Words such as "request", "order" or "legal process" are used without saying what they include.
4. No schedule. There is no sign of when the next report will appear.
5. No contact for questions. The report does not tell you where to send follow-up questions.
6. No history. Only one report exists, so there is nothing to compare year to year.

A provider with two or three gaps is not necessarily hiding something; small companies often publish a first, rough report. But if one provider has two gaps and the other has seven, you have learned something real, and you can say so without guessing at motives.

Consistency across documents

Also compare the report with the provider's other pages. If the transparency page says one thing about data handling and the privacy policy says something different, that mismatch is more important than any number. Likewise, check that the report agrees with the app store listing and help pages on basic facts such as which company operates the service. For more on cross-checking sources, how to compare VPN providers covers a wider scorecard.

Step 6: Handle independent reviews carefully

Some reports mention an independent audit or review. Treat that as a row on your sheet, not as a trump card. Ask four questions:

• Who performed it, and are they named?
• What exactly was reviewed: infrastructure, policies, apps, or a particular claim?
• Which dates does the review cover, and has the service changed since then?
• Is the result public in full, in summary, or only described by the provider?

An audit of one claim at one moment does not certify everything else. The explainer on VPN audits goes deeper into what an audit can and cannot tell you. When comparing, use the answers to put audits on the same footing: a named reviewer with a stated scope and date is more informative than a logo and the phrase "independently audited".

Limits: what a comparison cannot do

Be realistic about the exercise. A transparency report is a document the provider writes about itself. Several things follow from that.

• It describes the past. It does not guarantee how the provider will behave next year or under a different owner.
• It reports what the provider chose to count. It cannot show what was not counted.
• It covers legal requests, not technical risks. A provider can have a clean report and still suffer a breach or ship a buggy app. Reports are about disclosure, not engineering quality.
• It cannot tell you about your own risk. If your main worry is public Wi-Fi at a cafe, the legal-request count matters less to you than whether the app actually connects reliably. Think first about what you need protection from; the trust model article helps with that.
• It is not a substitute for testing. Your own checks of leaks and connection behaviour are still necessary.

A VPN also cannot make you anonymous or protect you from phishing, and a good report does not change that. Use the report as one input among several.

Common mistakes when comparing reports

1. Rewarding zeros. Zero requests may be the true figure, or it may reflect narrow scope or a narrow definition.
2. Punishing detail. A provider that reports ten requests honestly can look worse than one reporting none, even though it has told you more. Do not penalise disclosure.
3. Mixing years. Comparing one provider's 2025 numbers with another's 2022 numbers is unfair to both.
4. Ignoring the entity. A report from one company tells you nothing about a sister company.
5. Trusting design. Charts and badges are not evidence. Look for sentences with dates, names and counts.
6. Scoring too early. Giving each provider a number out of ten before you have finished reading produces false precision. Use plain words: answered, not answered, unclear.
7. Reading only one language. If a provider publishes the report in several languages, check that the numbers match across versions.

A thirty-minute routine you can reuse

When you do not want to build a full sheet, use this shortened routine.

1. Find the report on each provider's site (give up after five minutes; if you cannot find it, note that).
2. Write the entity, services and period for each.
3. Write the three numbers that matter: received, answered, refused. Mark "not stated" if absent.
4. Copy the one sentence that best describes the method.
5. List two vague phrases and turn them into questions.
6. Compare the lists and decide which questions to send to support, if any.

Student example: Arun is choosing between two services for his laptop. He runs the routine, finds that one report clearly states entity, period and outcomes while the other has only a total, and sends a short message to the second provider asking what the total covers. The reply, or the lack of one, becomes part of his decision. He has not proved anything about either company, but he has replaced a vague impression with a short list of known and unknown facts.

Summary

Comparing transparency reports is mostly an exercise in discipline. Put each report in a column, check the scope before the numbers, read counts alongside the kind of request and the outcome, translate vague wording into questions, count the gaps and keep independent reviews in their proper place. The result is not a verdict on who is trustworthy, but a clearer view of who has told you more and where to ask next. Remember that a report is the provider speaking about itself, so combine it with the privacy policy, your own testing and a clear sense of what you need a VPN for.

If you decide a simple prepaid option fits what you need, the pricing page shows what is available.