predators.” It also says that “hackers and cybercriminals can steal your personal
information—such as credit cards, bank account numbers, passwords, and other personal
data—and use it to commit fraud.” The site promises that the VPN will “let you conduct your
online activities (visit the websites you want, make online transactions, download files)
anonymously, without being tracked and spied upon.” It also says that “Hotspot Shield
encrypts your connection and doesn’t log any data that could be tied to you,” and that it will
“never track, log, or store any of your personally identifiable information, including your IP
address.” But free versions of the app allow personalized identifiers (such as ad identifiers and
cookies) and log internet or other network and device activity, as well as geolocation
information. Hotspot Shield’s parent company, Aura, did not respond to repeated requests for
comment.
IPVanish’s web copy was often nuanced, but it did have some sweeping statements, claiming to
“shield your internet traffic from third-party spying,” “keep your online presence and
information private,” “safeguard any connection to handle personal data with uncrackable
security,” “prevent snooping and spying while on public Wi-Fi,” and “prevent your personal data
(mobile banking, emails, social media, etc.) from being stolen by hackers.” A graphic also
promised sweeping protection: “no hackers, no firewalls, no government,” it reads. IPVanish
did not respond to a request for comment.
Kaspersky’s site reads, “When you’re connected to the Internet through a VPN connection, this
private Internet access ensures that you’re not exposed to phishing, malware, viruses and
other cyber threats.” It says, “Your privacy is also guaranteed, as no one will be able to detect
your online behavior.” It also promises privacy (“prevent business and governments from
spying on you”) and security (“ensure that your data is not intercepted by cybercriminals”) and
that it “hides your identity and online activity from businesses and governments recording your
behavior.” It also says that “whether you do shopping, banking, video calls or emails, hackers
can never intercept and steal your data.”
Kaspersky says it uses “military-grade 256 bit encryption” that “prevents criminals from
stealing the data which you send and receive.” It says that “data encryption also ensures that
your online banking and payment details can never be intercepted,” and that, with the VPN,
“you can browse, stream, communicate, and shop safely & away from prying eyes.” The
company says its VPN will protect you from big companies that harvest and sell your personal
data, as well as cybercriminals that intercept name, address, and credit card details each year.
“The marketing statements made on a product page for a VPN refers to the features and
functionality of only the use of a VPN for its intended purpose. A VPN is a private internet
access and a user visiting a product page of any security company should understand that the
features listed are only that of the product in question,” a spokesperson said, adding that all
marketing materials are accurate for the functionality of the VPN. “VPN technology is effective
for several scenarios. For instance, it let users change their IP, including geolocation. Moreover,
it protects against surveillance at the ‘last mile’: all traffic is encrypted, including DNS requests,
SNI, which could tell the provider or an attacker who has connected to the network which sites
the user is visiting. At the same time, after leaving the VPN server, the traffic is no longer