A consumer watchdog is accusing 17 virtual private network (VPN) apps, used to encrypt internet traffic and hide IP addresses, of having undisclosed connections to China. The claim, made in a report published on Thursday, June 12, by the Tech Transparency Project, points to four free apps on the Google Play Store, six on Apple’s App Store and seven more available on both.
The companies behind the apps “are obliged to hand over their users’ browsing data to the Chinese government under the country’s national security laws,” raising serious privacy and security concerns, the report said.
Investigators reportedly traced several of the apps to Qihoo 360, a Beijing-based cybersecurity firm that the U.S. Department of Defense has labeled a “Chinese military company.” Qihoo 360 has been under U.S. sanctions since 2020.
Consumers using such apps could have their browsing history, IP addresses, and connection logs collected and handed over to Chinese authorities. And depending on the VPN’s configuration, the encryption meant to obscure online activity could become ineffective.
Although Western-based companies can be compelled to share data with law enforcement, a handful of reputable VPN providers are legally able to employ strict no-logging policies. For example, police left empty-handed after executing a search warrant on the Swedish VPN company Mullvad in 2023.
“It would be hard for U.S. users to avoid the Chinese VPNs,” the report said. “The ownership of many appeared deliberately opaque, with several concealing their structure behind layers of offshore shell companies.”
Apps obscure Chinese owners
The Tech Transparency Project, a nonprofit research organization, linked the apps to China “by piecing together corporate documents from around the world,” its report said. None of the apps clearly disclosed their Chinese ownership.
The report follows similar research the organization published on April 1, which alleged that more than 20 of the top 100 free VPNs in the Apple App Store in 2024 “showed evidence of Chinese ownership.”
Following an inquiry from the Financial Times, Apple stopped offering numerous apps linked to Qihoo 360, including Thunder VPN, Snap VPN and Signal Secure VPN. However, according to the new report, two other apps — Turbo VPN and VPN Proxy Master — remain.
App stores profit
Users can download the apps for free, though several offer in-app purchases.
“That means Apple and Google may be profiting from these Chinese-owned VPNs when Americans pay for subscriptions or other add-ons,” the report said.
Neither Google nor Apple has addressed the specific apps highlighted by the report.
Peter Micek, general counsel at the human rights advocacy nonprofit Access Now, told NBC News the availability of apps linked to Qihoo 360 is concerning.
“It seems like this project has done the homework and due diligence that Apple and Google should have done,” Micek said. “And it does seem like those ties would constitute indirect contact with, transactions with folks who are sanctioned.”
Tech companies, he said, can sometimes face significant fines for violating sanctions.
