A no-logs VPN claims it does not record your browsing activity, IP address, or connection timestamps. This matters because if the VPN does not store logs, there is nothing to hand over to law enforcement or expose in a data breach. But the claim is easy to make and hard to verify.
What VPNs Typically Log (and Claim Not To)
Traffic logs: the websites you visited and when. Most VPNs genuinely do not store these. Connection logs: when you connected, from which IP, and for how long. Many VPNs claim no-logs but store connection metadata. DNS query logs: which domain names you looked up. Problematic if stored, since it reveals your browsing even without full traffic logging. Payment data and account information: most VPNs store this by definition (you have an account). Mullvad is the exception -- you can pay with cash or crypto and there is no account email required.
How to Verify No-Logs Claims
Independent audits: the most credible verification. Firms like Cure53, Deloitte, and PwC have audited VPN providers' no-logs claims. ExpressVPN, NordVPN, ProtonVPN, and Mullvad have all undergone audits. An audit from a credible firm provides meaningful assurance. Court cases: when a VPN provider is subpoenaed and genuinely cannot provide logs, that is the strongest evidence. ExpressVPN was subpoenaed in the 2017 Turkish authorities investigation and could not provide logs. IPVanish in 2016 DID provide logs to the FBI despite claiming no-logs. Track record matters more than current marketing.
Jurisdiction
Where a VPN is incorporated matters for legal requests. VPNs based in Switzerland (ProtonVPN), Panama (NordVPN), or the British Virgin Islands (ExpressVPN) are outside the US and EU law enforcement jurisdictions. However, jurisdiction is less important than the actual logging policy and auditing -- a US-based VPN with a genuine no-logs policy is more protective than a Swiss VPN that stores connection metadata.