2026 VPN Logging Policy Audit: Which Providers’ No-Logs Claims Survive Court-Ordered Disclosure and Warrant Canary Gaps
2026 VPN Logging Policy Audit: Which Providers’ No-Logs Claims Survive Court-Ordered Disclosure and Warrant Canary Gaps
A 2024 court order in the United States forced a major VPN provider to hand over payment records and timestamps for a single user — and the provider complied within days. That single documented case is worth more than every “no-logs” marketing page combined, because it shows the gap between what a policy promises and what a provider can actually produce when a judge asks. This audit compares how the major providers’ no-logs claims hold up against real disclosure events, warrant canary design, and jurisdictional exposure in 2026.
The verdict table: three providers have survived real disclosure, five have only survived audits
Of the eight providers most often recommended to privacy-conscious users, only three have a public record of a court-ordered or law-enforcement disclosure where the data produced was limited to payment metadata or nothing at all. The rest rely on third-party audits alone, which test configuration but not behavior under legal pressure.
| Provider | Jurisdiction | Independent audit (most recent) | Documented disclosure outcome | Warrant canary | Verdict |
|---|---|---|---|---|---|
| Mullvad | Sweden | Yes (2023, 2024) | 2023 police search — no data stored | No (transparency log instead) | Strongest claim |
| IVPN | Gibraltar | Yes (2022, 2023) | No public warrant event; audited no-logs | No | Strong, less tested |
| Proton VPN | Switzerland | Yes (2022, 2023, 2024) | 2021 Swiss order — no IP logs existed | No | Strong claim |
| ExpressVPN | British Virgin Islands | Yes (2022, 2023) | 2017 Turkey seizure — no logs on server | Discontinued | Solid but aging evidence |
| NordVPN | Panama | Yes (2023, 2024) | No public disclosure event | No | Audit-only |
| Surfshark | Netherlands | Yes (2023) | No public disclosure event | No | Audit-only |
| PIA | United States | Yes (2022, 2023) | 2020 subpoena — no logs produced | No | Tested, but US jurisdiction |
| IPVanish | United States | Yes (older) | 2016 DOJ subpoena — logs produced | No | Disqualifying history |
The IPVanish row is the one that matters most for this audit. In 2016, the US Department of Justice obtained logs from IPVanish’s then-owner despite a no-logs marketing claim. That single event is why “audited no-logs” and “survived a subpoena” are not the same sentence, and why every provider below should be judged on both.
Court-ordered disclosure is the only test that actually verifies a no-logs claim
An audit confirms that a provider’s servers are configured not to log at the moment the auditor looked; a subpoena confirms what happens when someone with legal authority asks the provider to produce logs anyway. Only the second test tells you whether the configuration held.
What the Mullvad 2023 police search actually proved
Swedish police visited Mullvad in 2023 with a warrant and left with nothing, because the provider’s infrastructure does not hold identifiable connection data. That outcome — no data produced, no charges filed against the provider — is the strongest public evidence any commercial VPN has offered that its no-logs claim is real and not just a policy document.
What the Proton VPN 2021 Swiss order proved — and what it didn’t
A Swiss court order compelled Proton VPN to identify a user in 2021, and the provider could only supply payment data because no IP logs existed. This is a meaningful result, but note the limit: Proton’s no-logs claim covers connection logs, not payment records. If you pay by credit card, a court can still see that you are a customer.
Why the ExpressVPN Turkey seizure is the most-cited case — and the weakest
ExpressVPN’s 2017 Turkey case, where a seized server yielded no user data, is still quoted in marketing eight years later. Treat it as historical evidence, not a current guarantee: the provider has since moved infrastructure and changed ownership, and the case predates its current audit cycle.
Warrant canaries have quietly disappeared from most providers — and that’s a signal
As of 2026, only a small minority of major VPN providers still publish a warrant canary, and several that once did have discontinued it without a clear public explanation. A canary is only useful if it is updated on a fixed schedule and the provider explains any lapse; a canary that has not been refreshed in months is worse than none, because it creates false reassurance.
- Check the update timestamp, not the page. A canary dated more than 30 days ago should be treated as expired.
- Check whether the provider explains discontinuation. A silent removal is a data point about transparency culture.
- Prefer a transparency log. Mullvad’s approach — publishing a running log of government requests — is more useful than a binary canary because it shows volume and outcomes, not just presence or absence.
The jurisdiction question is not about “safe countries” — it’s about what a court can compel
Panama, the British Virgin Islands, and Gibraltar offer no meaningful protection if the provider holds data a requesting court can reach through a local subsidiary or a payment processor. Jurisdiction matters less than whether the provider physically possesses the data at all.
Here is the practical test: if a provider cannot produce connection logs because it never wrote them to disk, no jurisdiction on earth can compel them into existence. If it can produce them, no jurisdiction will save you. The 2020 PIA subpoena is instructive — a US provider with a genuine no-logs architecture produced nothing, which is a better outcome than a foreign provider with logs it can be forced to hand over.
What the pricing pages don’t tell you about the real cost of a verified no-logs provider
Verified no-logs providers consistently cost more per month than audit-only providers, and the gap is roughly 30–60% at list price in 2026. That premium buys infrastructure that cannot log — RAM-only servers, diskless nodes, anonymous account systems — which is more expensive to operate than conventional logging infrastructure.
- Mullvad: flat €5/month, no discount tiers, no account email required.
- IVPN: roughly $6–$10/month depending on term, with a stated no-discount policy.
- Proton VPN: free tier available, paid tiers from roughly $4.99/month on annual plans.
- NordVPN / Surfshark: frequently discounted below $4/month on multi-year plans — the discount is funded by scale, not by weaker logging, but the audit-only status is the trade-off.
If you only change one setting, make it this one: pay with cash, Monero, or a gift card where the provider supports it. Payment metadata is the single most common thing produced under court order, and it is entirely within your control.
Who each provider is actually for
Mullvad and IVPN are for users whose threat model includes a subpoena or a state-level adversary; the price premium is the point. Proton VPN suits users who want a verified Swiss provider with a usable free tier and are willing to accept payment-record exposure. PIA is defensible for US users who specifically want a provider that has already survived a subpoena. NordVPN and Surfshark are reasonable for streaming and general privacy where the adversary is an ISP, not a court. IPVanish should be excluded from any shortlist where logging is the deciding factor.
Verdict
Mullvad is the only provider in this comparison whose no-logs claim has been tested by a physical police search and held. Proton VPN and PIA have both survived legal process with no connection data produced, which makes them credible second choices. Every other provider on the list is selling an audited configuration, not a proven outcome — and in 2026, with canaries vanishing and audits becoming a marketing checkbox, that distinction is the only one worth paying for.