NordVPN

No VPN activity or IP logs — a genuine and independently audited commitment — but the no-logs promise applies only inside the tunnel; outside it, NordVPN collects email addresses, payment details, device data, and feeds a substantial analytics and advertising stack.

No data sale to third parties — but sharing with a large network of US-based advertising and analytics partners is extensive, intra-group sharing covers the full Nord Security product family, and tracking data sharing for advertising is framed as not legally constituting a 'sale' while functionally achieving similar outcomes.

Self-service account deletion, in-app privacy preferences for analytics/advertising, and GDPR-standard rights — but the one-year post-subscription marketing window is opt-out not opt-in, and the ad tracking opt-out is routed through cookie banners rather than primary account settings.

Independently audited no-logs policy is a genuine security commitment; Panama jurisdiction offers real legal protection from Five Eyes surveillance — but the advertising data infrastructure undermines the privacy brand, external audit scope is not detailed in the policy, and security promises are largely described in general terms.