What Is a No Log Policy? How to Read a VPN’s Privacy Promise
Published October 30, 2026 · Updated November 4, 2026
Short answer: What is a no log policy? It is a VPN provider’s commitment not to collect or retain specified records of your online activity, such as browsing destinations, DNS requests, traffic contents, or identifying connection history. A credible policy limits stored information; it does not mean the company processes no data, and it does not guarantee anonymity. Check exactly which data is excluded, how long other records are kept, and whether independent evidence supports the claims.
For a no log policy explained simply: no logs means no saved history of your internet activity. But the promise matters because a VPN operator sits between you and the internet. This guide separates marketing claims from technical evidence.
What Is a No-Log Policy? A Simple Definition
At its core, what is a no log policy is a question about data retention. A VPN can encrypt the connection from your device to its server and replace your visible public IP address with the server’s address. But the company operating that server may technically process information about connections or destinations. A no-logs commitment describes which of those details it does not persistently record.
Here is a no log policy definition: the VPN promises not to save a usable history linking users to their online activity. Some providers explicitly exclude websites, DNS queries, original IP addresses, timestamps, and session lengths; others make narrower promises.
For a no log policy meaning in practice, distinguish “no activity logs” from “no identifying connection logs.” A provider can avoid one but retain the other. Read its full privacy policy.
The Electronic Frontier Foundation explains that using a VPN moves trust from your internet provider to the VPN company. Scrutinize that new intermediary.
How Does a No-Log Policy Work in Practice?
To understand what is a no log policy, first consider how a typical VPN connection behaves. Your device connects to the VPN server through an encrypted tunnel. The server forwards requests to websites and returns their responses. The operator needs to process enough information to route the traffic correctly, but that does not automatically require saving a history of every connection.
Processing traffic is not the same as retaining logs
The server handles live packets, but can be configured not to save your account, IP, destinations, or session times. Real-time processing is not the same as archiving history.
That is how does a no log policy work in practical terms: the provider combines documented rules with server configuration, access controls, monitoring design, and retention limits. The policy is not a special encryption algorithm. It is an operational promise that should be backed by technical safeguards.
Temporary memory versus permanent records
Services may hold connection state temporarily in memory to enforce device limits. Separate billing and support records may persist. Ask whether temporary information is identifiable, saved to disk, or accessible to staff.
When evaluating what is a no log policy, look for a precise explanation of server telemetry. Aggregated CPU load, bandwidth totals for a server, and the number of current connections are different from a per-user list of visited websites. Aggregated operational metrics are not inherently activity logs, provided they cannot reasonably be linked back to a particular person.
The policy should cover the entire service
A policy should apply across servers, locations, subscriptions, and troubleshooting. If staff can enable logging, safeguards should be explicit. For what is a no log policy to mean more than marketing, production settings must match published rules.
What Data Does a No-Logs VPN Keep or Avoid?
A quick way to answer what is a no log policy is to list the specific categories involved. No two privacy policies are identical, and the table below describes what to investigate, not a guarantee about every provider.
| Data category | Why it matters | What to look for |
|---|---|---|
| Browsing destinations and visited websites | Could reveal activity history | Explicit promise not to record destinations |
| DNS queries | Can expose requested domains | Statement covering DNS logging and leaks |
| Traffic contents | Could expose unencrypted communications | No traffic-content retention; HTTPS still necessary |
| Original IP address | Can link a session to a connection | No persistent source-IP logs |
| Connection times and durations | Can help correlate activity | Clear statement on timestamps and sessions |
| Per-user bandwidth and server assignment | May support account correlation | Whether individual usage is retained |
| Account and payment information | Needed for some billing and support | Data fields, access, retention and deletion |
| Aggregated system metrics | Used to operate servers | Confirmation that metrics are not user-identifiable |
Activity logs show what users do; connection logs show when they connect; account records cover administration. Avoiding the first two does not eliminate the third. That is why what is a no log policy does not mean “stores nothing.”
For example, Mullvad’s June 17, 2026 policy describes numbered accounts without email registration. It states that the company does not retain activity, DNS, connection timestamps, customer IP addresses, or per-user bandwidth records. At the same time, it acknowledges handling some payment and support information and retaining limited operational metrics. That is a more informative disclosure than an unexplained zero-logs badge.
Why Does a No-Log Policy Matter?
The value of what is a no log policy is reducing historical information a provider could expose or disclose. Records never retained cannot later be retrieved from an archive.
It reduces the consequences of certain data breaches
A breach can expose previously collected records. Not retaining browsing history removes one sensitive target. Data minimization reduces exposure, not the possibility of a breach.
It limits historical connection tracking
IP addresses, timestamps, and exit-server assignments can help correlate sessions if retained. Still, your ISP sees the VPN connection, and websites may recognize your login or cookies.
It makes provider accountability testable
Privacy statements are easier to assess when they specify fields, retention periods, and exclusions. The US Federal Trade Commission’s VPN guidance discussed research examining almost 300 VPN apps; some apps in that study lacked encryption, requested surprising permissions, or shared data with third parties. The study is older, but it illustrates why users should not assume that every app marketed for privacy actually practices data minimization.
So what is a no log policy worth to an ordinary user? It is one meaningful privacy control in a broader security plan—not a replacement for secure websites, password hygiene, or careful account management.
How Can You Verify a VPN’s No-Logs Claims?
A marketing page cannot independently establish what is a no log policy in operation. Use several kinds of evidence together, and pay attention to what each can and cannot prove.
1. Read the exact policy language
Search for “IP address,” “DNS,” “session timestamp,” “traffic,” “diagnostics,” “analytics,” and “retention.” Determine whether the service collects data only in aggregate or associates it with an account. A statement such as “we do not sell browsing history” does not establish that browsing history is never stored.
2. Inspect an independent no-logs audit
A useful audit identifies its assessor, date, examined systems, method, findings, and limitations. A review of production VPN infrastructure is more directly relevant to activity logging than a generic app penetration test. Check whether the complete report is public or only a marketing summary is available.
When asking what is a no log policy and whether one is trustworthy, remember that audits are point-in-time assessments. They cannot guarantee that the configuration will remain unchanged next year. IVPN made precisely this distinction in a June 2026 explanation, noting that its last dedicated no-logs audit was in 2019 despite continuing to commission other security reviews.
3. Look for transparency reports and legal disclosures
Transparency reports describe legal requests and responses. They can support a privacy claim but remain provider disclosures.
4. Examine technical choices
Open-source apps do not reveal all server behavior. RAM-only servers reduce certain storage risks but do not prevent observation or export of data elsewhere.
What is a no log policy without verifiable details? Merely an untested assertion. Strong evaluation combines policy wording, technical architecture, audit scope, and a record of transparent conduct.
Real-World Examples: Audits and Transparency Reports
Real providers offer instructive examples of what is a no log policy backed by different kinds of evidence. These examples are about evaluating documentation, not declaring a permanent privacy winner.
Proton VPN: repeated independent checks
Proton VPN reported its fifth consecutive annual no-logs audit in June 2026, conducted by Securitum. Its published findings say that the examined infrastructure did not indicate recording of browsing activity, DNS queries, traffic contents, destination services, or user-identifiable connection metadata. See the audit announcement and linked reports.
Its July 2026 transparency report stated that 458 legally binding information orders had been received since launch in 2017, including 47 through June 2026. Proton reported that it could not provide the requested identifying connection data in any of those cases because it did not keep the necessary logs. These are provider-reported figures, not a promise that every request anywhere receives the same legal outcome.
Mullvad: minimize identifiers from the start
Mullvad uses numbered accounts rather than requiring an email address at signup. Its published policy distinguishes activity information it does not log from payment, support, and aggregated maintenance data it does process. This demonstrates that the answer to what is a no log policy can involve data minimization at registration as well as server configuration.
IVPN: auditing has limits
IVPN says its dedicated no-logs audit occurred in March 2019 and explains why it instead directs later audits toward changing infrastructure and security components. That is a useful reminder: the existence or absence of a recent no-logs badge is not the full trust assessment. Examine the provider’s ongoing transparency and what auditors actually reviewed.
Compare evidence on its own terms. A transparency report, an infrastructure audit, a public logging policy, and an open-source client offer different kinds of assurance; none alone guarantees future behavior.
What a No-Log Policy Cannot Protect
What is a no log policy does not mean your internet activity becomes untraceable.
Websites can still identify you if you sign in, share personal information, or retain tracking cookies. Browser fingerprinting, advertising identifiers, GPS, and account histories remain separate concerns. A VPN’s policy cannot delete data that a social network, search engine, or shopping site collects directly.
A VPN is not an antivirus. No-logs rules do not stop phishing, malware, DNS leaks, or traffic intentionally excluded from the tunnel.
HTTPS still matters. A VPN encrypts the path between your device and the VPN endpoint; HTTPS protects connections to secure websites beyond that endpoint. Without end-to-end protection, information may remain visible to parties handling the final connection.
What is a no log policy does not override the law. Authorities may seek records a provider actually possesses; obligations vary by jurisdiction.
Use the EFF’s 2026 VPN selection guidance as a reminder that VPNs do not offer complete anonymity. Pair them with safe browsing, device updates, and best account security practices for protection beyond the tunnel.
How to Choose a VPN With a Credible Policy
If you are evaluating what is a no log policy before buying a subscription, use this checklist. It helps distinguish a detailed commitment from vague advertising:
- Name the records that must never be retained. Look for browsing destinations, DNS queries, source IP addresses, timestamps, and linkable session history.
- Check what the service still stores. Read the separate privacy policy for account records, payment information, telemetry, support tickets, and retention periods.
- Verify the audit’s scope and age. An app security test does not necessarily evaluate VPN-server logging. Prefer recent, accessible and specific assessments.
- Review transparency practices. Look for legal-request disclosures, incident reporting, and explanations of operational changes.
- Check practical security features. DNS-leak prevention, a suitable kill switch, supported protocols, and clear app updates matter alongside the data policy.
- Protect your login. Use unique credentials and supported two factor authentication apps or passkeys when available.
- Match your threat model. Decide whether your main goal is reducing ISP visibility, improving public-Wi-Fi privacy, or connecting to a workplace service.
For enterprise environments, see google authenticator openvpn. Authentication verifies access; it does not verify logging practices.
For a broader routine, review best cybersecurity tips for beginners and the personal cybersecurity checklist. They address account and device risks that a VPN cannot eliminate.
Frequently Asked Questions
Is a no-log policy the same as zero data collection?
No. What is a no log policy usually concerns activity and identifying connection history, not necessarily billing, account administration, aggregate server monitoring, or support messages. Read the provider’s full privacy disclosures to understand those categories.
Can a VPN know my IP address without saving it?
Yes. A server ordinarily needs to process your source IP while establishing and maintaining a live connection. The privacy question is whether it retains a usable identifying record after processing. Temporary network handling and persistent logging are not identical.
Can an audited no-logs VPN be trusted forever?
No. An audit covers a stated scope and period. Software, personnel, logging settings, and legal conditions can change. Repeated audits, transparency reports, and limited collection provide stronger evidence than a one-time certificate but cannot guarantee the future.
Are free no-logs VPNs automatically unsafe?
No. A paid price does not guarantee privacy, and a free tier is not proof of hidden data collection. Assess the operator’s revenue model, policy, technical safeguards, and evidence. Proton says its no-logs commitment also applies to its free VPN plan; users should verify the latest terms before relying on that claim.
Does a no-logs policy hide everything from my internet provider?
No. Your internet provider can usually see your connection to a VPN endpoint, timing, and approximate data volume. A correctly configured encrypted tunnel can conceal the specific websites and payloads carried through it from that local observer. The VPN provider becomes an important new party to trust.
Can websites still track me when I use a no-logs VPN?
Yes. Signing in to an account, using browser cookies, or sharing identifiable information can reveal who you are. What is a no log policy does not change the tracking practices of the sites you visit.
Do no-logs policies apply to business VPNs?
Not necessarily. A corporate VPN may intentionally retain access and security records for compliance, troubleshooting, and incident response. Check the employer’s published policy rather than assuming a commercial consumer VPN’s standards apply.
Final Verdict
What is a no log policy? It is a specific commitment to avoid retaining selected records that could connect a person to their internet activity. The best versions are precise about what is excluded, transparent about account data, and supported by meaningful independent examination.
No-logs protection lowers some privacy risks, but it does not create total anonymity or remove the need for HTTPS, secure devices, and careful account practices. Judge the evidence, not the slogan.
