The Proton VPN Blog

Shady VPNs could be spying on millions of Americans

Douglas Crawford — Thu, 27 Aug 2026 11:45:20 GMT

After a months-long survey of over 7,000 mobile VPN apps around the world, Proton has found that 85% of those downloaded in the US contain trackers, and around a quarter of those actively track users’ physical location.

Perhaps even more concerning, we also learned that 64 of the 390 VPNs downloaded from the Apple App Store and Google Play in the US are owned by Chinese companies, which are legally bound to share data with their authoritarian government.

Given that most people who use a virtual private network do so specifically to protect their privacy, the risks are obvious. And despite promises to protect the public, Google and Apple allowed these suspect VPNs to be downloaded more than 13.2 million times in June 2026 alone.

Methodology

We examined free-to-pay downloads from the Google Play store. Monthly download counts are estimates from AppTweak for the month of May. For tracker counts, we used data from Exodus Privacy, an open-source platform that analyzes Android apps to detect the code signatures of analytics, advertising, and profiling trackers.

How VPNs should work

When you use a VPN, you expect privacy. A trustworthy VPN stops websites from seeing your real IP address and prevents your internet service provider (and, by extension , your government) from knowing what you do online.

VPNs have become a part of daily life for as many has 100 million Americans. Spend just a few minutes on YouTube and you’ll almost certainly encounter an ad for VPNs, which are typically promoted as a vital tool for privacy, security, and bypassing censorship.

For the most reputable services, this claim largely holds up. But this in itself can create a false sense of security for millions of consumers who are tempted by the free VPNs that feature prominently on the app stores, and it hides the fact that many dubious VPNs are doing the exact opposite of what you’d expect from them.

Who owns your VPN?

When it comes to VPNs, transparency is vital.

You should know who owns the company you’re trusting with your privacy. Our analysis has found that dozens of VPNs available in the US are owned by companies based in jurisdictions with intrusive data surveillance laws. Perhaps unsurprisingly, many go to considerable lengths to conceal this fact.

Of the VPNs we studied, 64 are owned by Chinese companies. Under Chinese law, companies are required to make user data available to the government upon request. What makes this worse is that 31 of these Chinese-owned VPNs actively hide their real ownership behind shell companies registered in places like Singapore, Hong Kong, and the UK.

Users in the US downloaded these shady Chinese apps more than 3 million times over one month.

Where does your data go?

Even VPNs that aren’t directly owned by companies based in countries known for their mass surveillance practices can endanger users’ privacy.

Our analysis found that 85% of VPNs available in the US contain trackers designed to collect and share highly personal user data. This can include your unique device ID (GAID), device model, network type, mobile carrier name, and more.

Trackers sending data to	Downloads in June
China	1.5 million
Russia	1.4 million
Israel	2.6 million
All three	800,000
Five Eyes countries	4.6 million

Many of these US-owned apps entered commercial agreements with foreign companies, embedding their tracking software as part of the deal. They typically see VPN apps (often purchased as off-the-shelf white-label products) as just another popular app category that, like games, can be monetized thorough advertising.

This is simply how the mobile app industry operates. And in a world where app stores take around 30% of sales revenue, it’s not surprising that app providers might choose to monetize their products though privacy-invasive advertising, rather than up-front paid subscriptions.

But VPN apps are not games. Millions of Americans use them to protect their privacy, not to sell their privacy to ad-tech companies, many of which are based in countries with governments that are hostile to privacy, and, in many cases, also hostile to US interests.

Although it’s difficult to know exactly what’s being done with your data, there are worrying signs. Three of the VPN services we looked at are actually owned by market research companies: ‎Phone Guardian Safe WiFi (Sensor Tower), My Mobile Secure VPN (Comscore), and Urban VPN (BiScience, which has been been shown to capture user conversations across several services and share them with AI chat platforms).

Some VPNs track your location

In what many could reasonably see as the ultimate act of betrayal, 64 VPN apps actively track your physical location using GPS and other geolocation data. Anyone with access to this data can see if you are at a protest or meeting with a journalist, lawyer, or source, and ultimately share that information with law enforcement or intelligence services.

These apps include some of the most popular VPNs in the US, such as VPN Proxy Master, VPN-Fast VPN Super, and X-VPN, and collectively they were downloaded more than 3 million times in June. This means roughly 20% of all VPN downloads in our dataset come from apps that track where you are, which is likely the very thing you installed a VPN to prevent.

And this tracking data is often being made available to governments that are difficult to trust.

App stores are profiting from surveillance

Apple and Google publicly tout their privacy credentials. Yet these apps, which can track everything you do online and send your personal data to ad-tech companies, are freely downloadable on their app stores with no warning labels.

While app stores require VPN developers to submit their identities and their privacy policies, they rely heavily on self-reporting and do little to verify what they are told. Apple and Google check that the paperwork exists, but they don’t independently audit whether a VPN actually behaves in the way its privacy policy claims.

Despite their privacy claims, Apple and Google prioritize profits over the best interests of their users. They typically take around a 30% commission on all revenue generated from in-app purchases and subscriptions. Apple, in particular, seeks to justify this commission by claiming it is necessary to cover the costs of reviewing and curating apps to keep users safe (despite credible evidence that it pockets up 78% of these fees as pure profit).

The profit-centric model is also amply illustrated by Apple’s willingness to cooperate with authoritarian orders from the Chinese government, which has resulted in 66 of the 100 most popular apps worldwide being unavailable to iOS users in China.

Many of these are news apps (including the likes of The New York Times, BBC News, and Reuters), showing that Apple is happy to assist the Chinese government’s censorship regime in exchange for access to the highly lucrative China market. It even threatened to remove Proton VPN because the App Store description said our app could be used to “unblock censored websites.”

The result? Authoritarian-linked VPNs that have access to all your traffic, including your web browsing, app usage, and personal information, are tracking your online behavior for advertising purposes.

So what can be done about it?

To permit these suspicious apps to exist on their platforms is a dereliction of duty to both consumers and developers. This is unacceptable. We therefore urge Apple and Google to:

Perform more stringent forensic security and ownership checks on VPN apps (not simply rely on self-reporting)
Remove all apps that fail to meet these checks from their app stores
Provide greater transparency about all VPN apps so that people can make informed decisions about which ones can be trusted. This includes providing information on where a company is (really) based and what it’s doing with your data

For such transparency to be effective, Apple and Google must use a tiny portion of their vast resources to investigate services and ascertain that they are what they purport to be.

What you can do to stay safe

To safely protect your privacy with a VPN:

Use a service with transparent ownership that’s located in a country with real privacy laws
Only trust VPNs that have been independently audited

There’s no excuse

Because all of your internet activity passes through its servers, any VPN has the potential to access a great deal of highly personal information about you, your life, your political leanings, what you like to buy, and your hobbies and interests. Even if privacy is not a primary concern when picking a VPN app, you should be worried about shadowy, unaccountable companies with links to places like China and Russia, where the government has unrestricted access to all data.

In total, 85% of the apps we studied in the US are behaving in ways contrary to how they are marketed and what you’d reasonably expect from a VPN service. This is inexcusable.

Many of these apps may claim that this data collection is only done to optimize performance. But the fact that they can collect this data — and that so much of it is sent to places like Russia and China — is cause for grave concern.

Thankfully, there are reputable VPN services that genuinely care about protecting your privacy. This includes Proton VPN, which offers 100% free VPN service with open-source apps, no ads, no data limits, and a strict no-logs policy that’s independently audited and backed by Swiss privacy laws.

How can we do this? It’s quite simple. We transparently fund our free plan with a premium service that offers a range of advanced (but entirely optional) features. Because at Proton, we believe that privacy shouldn’t come with strings attached.

Cover image by Bernard Leonardo.

Website: https://dranreboel.myportfolio.com
IG @dranreboel https://www.instagram.com/dranreboel/
LI https://www.linkedin.com/in/bernard-leonardo-271b56210/

How to delete your Instagram account and erase your data

Proton Team — Wed, 26 Aug 2026 17:21:16 GMT

Whether you’re trying to curb screen time, reduce your online presence, evade an online stalker, or protect your privacy from the likes of Meta, deleting social media is often a first step. But there’s a little more to it than simply deleting apps from your phone. With Instagram, you’ll probably want to not just delete your account, but permanently erase your data as well.

Not ready to ditch your Instagram handle all together? You can also make your account private or temporarily disable it and come back any time.

How to delete Instagram
How to disable Instagram
How to download your data before deleting Instagram
How to make Instagram private
How to protect your privacy on Instagram
Ditch the app
You don’t owe Meta your data

How to permanently delete your Instagram account and data

Ready to delete your Instagram presence for good? Deleting your account is a permanent, irreversible option that will remove your photos and videos, as well as all your interactions with other accounts, including likes, follows, and comments on other profiles.

Open the app and:

Tap your Profile icon → Menu (☰) → Settings and Privacy.
Go to Accounts Center Profiles and personal details Instagram → Manage.
Select Delete account and tap Continue

That’s all that’s required on your part to delete your account. But there is a caveat. Instagram gives you a 30-day grace period to change your mind. During the 30 days after your deletion request, you can opt to reactivate your account, halting the deletion of your information and media. After 30 days, the information will be gone for good.

How to temporarily disable your Instagram account

If you’d rather just take a break from Instagram, you can deactivate your account, which effectively hides it until you decide to reactivate it. This is a temporary measure that you can choose to do on a weekly basis, indefinitely.

When your account is disabled, followers won’t be able to see your photos or videos, and you won’t appear in searches. Similarly, your likes, comments, and follows won’t appear in the app. Once you reactivate your account, all of this information will reappear.

Keep in mind that you can’t sign in to your account when it’s disabled. You’ll have to reactivate it to view your own content and that of others.

To temporarily disable your Instagram account:

Tap your Profile icon → Menu (☰) → Settings and Privacy.
Go to Accounts Center → Profiles and personal details → Manage Accounts → Instagram → Manage.
Select Deactivate account and tap Continue.

To reactivate your Instagram account, sign in to the app again. Doing this will reactivate your account, making your profile visible again.

How to download your data before deleting your account

Before permanently deleting your account, you can download and save your data, including your photos and videos, to keep and store elsewhere. To do this:

Tap your Profile icon → Menu (☰) → Settings and Privacy.
Go to Accounts Center → Your information and permissions → Export your information and tap Create export.

You can export your information to a device or external service either in HTML or JSON formats. You can download all of your information or pick and choose categories, such as comments, likes, saved posts, and media. You can also specify a time range for a custom date or all of time.

Information exports default to medium quality for photos and videos, but you can opt for higher or lower quality depending on the amount of space you have available for storing.

Tap Start export when you’re ready.

How to make your Instagram account private

Looking to share a little less on Instagram, but still want to view other people’s content through the app? You can always opt to make your profile private. Public profiles are viewable by all Instagram users. With a private account, only approved followers can to view your content.

Similarly, you can limit who’s able to view your Instagram stories, and even compile a close friends list for stories, only showing a select few certain updates.

To go private:

Tap your Profile icon → Menu (☰) → Settings and Privacy.
Go to Accounts Center → Account privacy and toggle the Private account switch on.

How to protect your privacy on Instagram

Making your profile private is one way to ensure only the users you approve can view your content, but there are other ways to help guarantee you aren’t making yourself vulnerable to data breaches and hacks.

Meta’s privacy center within your app settings has tons of details on how to achieve this within Instagram, beginning with the option to private message other users using end-to-end encryption. If your teen is using the app, you can implement controls for age-appropriate use and content.

You can change or reset your Instagram password at any time and add two-factor authentication and additional recovery methods in the case of a problem accessing your account. You can block other profiles from seeing what you share, and from messaging you. In addition, you can review your tags on other users’ photos and posts before approving them.

Instagram allows UK users to pay a subscription fee for an ad-free experience, though experts disagree on how much safer this makes the app when it comes to your personal data.

Be sure to update your Meta privacy settings and clear your search history regularly. The Instagram app automatically deletes your search history after 30 days, but you can set it to wipe clean as often as every three days. This feature is under Your information and permissions in the Accounts Center. Tap Search history and Keep searches for to adjust the time frame.

Finally, adjust the amount of information Instagram shares with businesses in the Accounts Center under Your information and permissions. Tap Your activity off Meta technologies to adjust your settings.

If you’re concerned about your privacy, ditch the app

If you can’t live without Instagram but are concerned about your privacy, one of the most powerful steps you can take is to ditch the app and access your account through a web browser. Meta is able to collect far less information about you through a browser than through its apps, and most mobile browsers can even send notifications from Instagram website to your phone.

With a good VPN, you can also easily hide your real IP address (the single most revealing piece of data a website can collect about you) from Meta.

Get Proton VPN

Memorialize an Instagram account

Meta offers a way to remember loved ones who have died by memorializing their social media presence. You memorialize someone’s account on their behalf or designate someone to memorialize your own when you die. You can designate a contact for this within the app any time. Alternatively, you can tell Instagram to simply delete your profile after you pass.

To memorialize or delete the account of someone who has not already set a preference within the app, contact Instagram with proof of death, including an obituary or news article, to have the profile changed.

Final thoughts on Instagram’s privacy and data collection policies

Instagram doesn’t exist to help you stay in touch with people. It exists to keep you scrolling long enough to profile you and sell that profile to advertisers, and Meta has built an entire company around making that as hard to opt out of as possible. Deactivation at least pauses this, but deleting your account puts an end to it.

However, for many of us, the benefits of sharing our lives and letting others share their with us outweighs privacy concerns. In this case, a private account, a wiped search history, and using the browser instead of the app are small ways to claw back a bit of what you’re currently handing over for free.

You don’t owe Meta your data just because deleting the account feels like a hassle. The hassle is the point, it’s designed that way.

Vietnam’s new fake news fines triple VPN demand

Douglas Crawford — Fri, 14 Aug 2026 19:07:57 GMT

On July 1, 2026, new rules took effect in Vietnam that penalize social media users who the government deems sharing fabricated or false information. In the weeks since, the Proton VPN Observatory has noticed a sharp increase in sign-ups for our VPN service (+150 over the baseline, and triple the figures we saw at the beginning of the month).

What’s notable is that signups began to spike on July 7, when the first reported fine under the decree (2.5 million VND against a man in Lào Cai province for a rude Facebook comment aimed at local police) was widely reported in local media.

What happened?

The Vietnamese government is now imposing fines on people who share what it defines as fake, false, distorted, or defamatory content on social media. The penalty structure has two tiers:

20–30 million VND (roughly $794–$1,190) for sharing content judged to harm the reputation of state agencies or organizations, or the honor and dignity of individuals. This is a category that also covers the posting of graphic, violent imagery, unauthorized sharing of copyrighted journalism or creative work, promoting banned goods or services, misrepresenting Vietnam’s territorial maps, or linking to content already banned under Vietnamese law.
30–50 million VND (roughly $1,190–$1,984) for content judged to distort history, deny “revolutionary achievements,” undermine national unity, insult religion, incite discrimination, leak state secrets or private information below the criminal threshold, or spread information that causes public panic or disrupts government operations (assuming it doesn’t already meet the bar for criminal prosecution).

Several of these categories, such as “undermines national unity,” “harms the reputation of organizations,” “causes public panic,” are highly ambiguous and and leave considerable room for interpretation. As one dissident publication put it, “police still decide the truth.”

Other contributing factors

Correlation, of course, is not the same as proven causation. Other less direct events that have likely contributed to such a steep rise in VPN signups include:

The “Chuyện với Thanh” case

A book by FPT co-founder Nguyễn Thành Nam, reinterpreting Hồ Chí Minh’s early life, was denounced in June as insulting the national leader. The publisher was fined and suspended before Nam and a colleague were criminally charged under Article 117 (anti-state propaganda). State TV confirmed the arrests on July 7.

Roblox VNG lockdown

Vietnam’s local Roblox version (run by publisher VNG) went fully live on August 13, 2026, blocking around 80% of games, disabling chat, and capping daily play at 3 hours. Unusually, it also prevented Vietnamese users from bypassing these restrictions by using a VPN to reach Roblox’ international servers.

No explanation has been provided as to why these changes have been made, but they may be linked to unease that Roblox could be used as a communications platform by those seeking to evade government scrutiny.

Unsurprisingly, this hasn’t gone well. It should be noted, however, that while this incident may have helped to raise awareness of VPNs, VNG has gone to great lengths to ensure VPNs are of limited use for bypassing its restrictions.

An increasingly repressive regime

It is clear that the Vietnamese government is becoming increasingly intolerant of dissent — and consequently suspicious of social media and similar channels (like Roblox), over which it can spread.

As always, the best way to protect your online activity from government scrutiny and access the free international press is to use a reputable VPN. Use our internet censorship simulator to see which apps and online services are blocked around the world.

Get Proton VPN

Is TikTok banned again in Oman?

Douglas Crawford — Fri, 14 Aug 2026 19:01:52 GMT

TikTok does appear to be banned in Oman, though the exact reason and cause are not clear, and the government has previously refused to acknowledge that it bans tech platforms.

In April 2025, the Omani Telecom Regulatory Authority (TRA) “clarified” that TikTok connection issues were due to “technical reasons” and that TikTok was not banned. (They did not explain to reporters how technical reasons would affect only TikTok and not other internet services.)

Now, for the second time in about 18 months, Omanis are experiencing problems accessing TikTok. Starting August 13, 2026, users began to complain on Reddit and other social media platforms that TikTok appears to be banned. At the same time, the Proton VPN Observatory recorded a significant (+350% increase over the baseline) jump in sign-ups for our VPN service.

No official TikTok ban has been announced, and it seems likely the Omani government will again blame technical reasons for the current issues experienced by TikTok users.

Posters on Reddit, however, have suggested the government may be interfering with TikTok access following the sentencing of a woman to one year in prison and deportation for producing and publishing content that violated public morals during a live broadcast on social media.

Whatever the reasons for this disruption, Proton VPN can help — simply connect to one of our VPN servers located outside Oman to hide your online activity from Omani ISPs and appear to access the internet from that (unrestricted) location.

Get Proton VPN

How and why we built Proton protocols: a new VPN client engine

Antonio Cesarano — Wed, 12 Aug 2026 16:01:07 GMT

Over the past few months, Proton VPN has been working on Proton protocols, a new client‑side VPN protocol codebase. Known internally by the codename ProTUN, this new code architecture is written in Rust. Although we forked cryptography code from Cloudflare’s BoringTun project, the completely redesigned architecture is Proton’s.

Why we need a new VPN core

WireGuard® is a state-of-the-art VPN protocol that is as secure as OpenVPN but faster and more powerful. This is why we’re starting to remove OpenVPN support from our official apps, to focus instead on WireGuard.

However, our apps currently use the official wireguard-go implementation of WireGuard. And it’s a great implementation, with an elegantly minimal design that makes it fast, secure, and easier to audit than traditional VPN protocols.

However, wireguard-go doesn’t integrate well with the languages we use natively to develop Proton VPN on the multiple platforms that we support (such as Kotlin on Android and Swift on iOS). This slows development, complicates debugging, and introduces stability challenges.

Proton protocols solves these problems.

Proton protocols is a new client-side VPN framework based on WireGuard. Because it’s written in Rust and designed as a shared, extensible core, ProTUN can be consistently deployed across platforms and adapted to different network environments. This will let us diagnose issues faster, improve stability, and build advanced functionality directly into the VPN stack.

Most importantly, Proton protocols gives us the flexibility to respond quickly to censorship and network interference, which is an area where we expect the biggest long-term gains.

Under the hood

Encrypting traffic with a new WireGuard core

At the heart of the Proton protocols project is libpvpnclient, a clean, standalone implementation of the WireGuard protocol written in Rust. Its job is simple but critical: to encrypt your internet traffic and keep your connection secure.

What’s different from wireguard-go is how it’s built. Whereas wireguard-go is a simple WireGuard client, libpvpnclient is an entire new framework onto which we can develop advanced new features and functionalities.

And instead of being tightly bound to a specific operating system, libpvpnclient is designed as a pure, platform-independent core. This allows us to reuse the same high-quality implementation everywhere — on desktop, mobile, and beyond. This separation makes a big difference behind the scenes. It lets us:

Test and debug complex edge cases in controlled, repeatable environments
Roll out improvements faster and more consistently across platforms
Experiment with new techniques to resist censorship and traffic blocking

For you, this translates into faster updates, fewer platform-specific issues, and a VPN that adapts more quickly as network conditions and censorship methods change. ProTUN itself is our name for the wrapper around libpvpnclient that adapts the Rust-based library to each operating system that we support.

It works hand-in-hand with LocalAgent. This is our in-house control channel that allows us to implement certificate-based authentication, and which we’ve also just streamlined and rewritten in Rust.

This new VPN core is available to test-run now as a beta (early access) feature on the following platforms:

Windows
Android
iOS and iPadOS (bringing support for advanced kill switch)
Linux GUI app (bringing support for our censorship-resistant Stealth protocol)

Making it easier to reach Proton VPN servers

We’re also working on phase two of Proton protocols. Codenamed muon, this is a flexible networking layer that safely connects our apps to Proton’s VPN API, even in situations where the Proton API is itself being censored.

Before a VPN can protect your traffic, it has to connect safely in the first place to the Proton API. And that’s becoming increasingly difficult. In some countries and networks, API connections are blocked or monitored at the DNS level or identified by inspecting the server names (a technique known as SNI snooping).

To address this, we’re building muon, a new gateway between our apps and Proton’s API. Again written in Rust for safety and performance, muon handles the very first network requests your app makes, and can then route them securely through to Proton VPN’s WireGuard protocol (in the long term, this functionality will replace our existing alternative routing anti-censorship solution).

In practical terms, this means that from the moment you open the Proton VPN app in a country where access is known to be censored, your communication to the Proton API will already be protected (even before a system-level VPN connection is fully established). And in restrictive countries, your ISP won’t even know that you’re connecting to Proton APIs.

This protection will be automatic and invisible to you, and means that you’re more likely to get a working connection in censored countries. muon is so useful for defeating censorship, in fact, that we’re going to use it on all Proton apps (not just VPN), giving you built‑in censorship protection across our ecosystem from the get-go. We’ll be rolling it out soon, so watch this space.

A solid foundation for what comes next

libpvpnclient (with the Proton protocols wrapper) and muon together form a new platform that gives our engineers far more flexibility. This allows us to experiment safely with improvements in connection stability, battery usage, and resilience, and prepares the groundwork for future technologies, like stronger anti-censorship techniques and post-quantum cryptography.

We see this as a major step forward in making the internet more accessible, reliable, and private for everyone. And this is just the beginning. We’re excited to see where this new foundation takes Proton VPN in 2026 and beyond.

“WireGuard” is a registered trademark of Jason A. Donenfeld.

Introducing Proton protocols: a new VPN protocol codebase for faster, more reliable apps

Antonio Cesarano — Wed, 12 Aug 2026 16:01:05 GMT

Our apps work well, but we’re reaching the limits of what’s possible with our current codebase. For Proton VPN to future-proof our apps, build more innovative VPN features, and be fighting-fit for our next phase of growth, we need a new foundation.

We’re therefore rolling out a new client‑side VPN protocol codebase to our b eta apps that takes the best parts of our existing codebase and builds on them to unlock the next generation of Proton VPN performance, reliability, and censorship resistance. This modern, flexible VPN core allows us to:

Build faster, more reliable apps
Deliver best-in-class, anti-censorship capabilities
Ship features and improvements more quickly across all our apps
Enable Stealth support on Linux
Lay the groundwork for post-quantum encryption (planned)

Want more technical details? Find out more

What is a VPN protocol?

A VPN protocol is the set of rules that decides how your device connects to a VPN server and how your data is encrypted and transmitted.

It’s the method a VPN uses to:

Create a secure tunnel: This happens the moment you tap Connect in our apps. The app connects to one of our VPN servers, and all internet traffic to and from your device is routed through the connection.
Encrypt your internet traffic: All data traveling through the VPN tunnel is securely encrypted (scrambled using very complex math) so that no-one but you can see it. This includes your ISP and anyone else monitoring your network.
Keep the connection stable and fast: The protocol manages the connection in the background, helping your device stay connected when you switch networks, lose signal briefly, or move between WiFi and mobile data.

Learn more about VPN protocols

Test run our new codebase now

If you’d like to help us put this exciting new codebase through its paces, it’s now available on our beta (early access) app for:

Windows
Android
iOS and iPadOS (bringing support for advanced kill switch)
Linux GUI app (bringing with it support for our censorship-resistant Stealth protocol)

To use it, simply select Proton Protocols in your beta app’s settings.

How to change your VPN protocols

If you run into any problems or have any suggestions on how things can be improved, please let us know on Reddit or X, or join our community at protonmail.uservoice.com.

Delivering a better VPN experience

This new VPN protocol codebase marks a major step forward for Proton VPN. By rebuilding our VPN core, we’re not just improving performance and reliability today — we’re creating a flexible foundation that lets us respond faster to censorship, ship features more consistently across platforms, and prepare for future threats like post-quantum cryptography.

If you’re eager to experience these improvements firsthand, try the experimental build on Android and please do let us know how it works for you on Reddit or X, or at protonmail.uservoice.com. Together, we’ll build a privacy-first internet that works for everyone.

How to turn off read receipts on iPhone, Android, WhatsApp, and more

Douglas Crawford — Tue, 11 Aug 2026 12:46:26 GMT

Read receipts are very convenient if you’re sending a text to someone else. They let you know the recipient of a message has received and opened it. But if you’re the recipient, it can feel a little invasive knowing others can track whether you’ve read their messages. In this article, we show you how keep things a little more private by disabling read receipts on your phone.

How to turn off read receipts on iPhone (Messages)
How to turn off read receipts on Android (Google Messages)
How to turn off read receipts on Android (Samsung Messenger)
How to turn off read receipts on WhatsApp
How to turn off read receipts on Signal
What makes read receipts dangerous?
What’s the safest messaging app?

Traditional SMS doesn’t support read receipts for messages. However, most modern SMS messenger apps now default to the newer Rich Communication Services (RCS) protocol, which works between newer Apple and Android devices and allows for much richer message content (such as multimedia messages, group chats, and read receipts). Third party apps use their own protocols.

How to turn off read receipts on iPhone

On an iPhone, the Messages app supports traditional SMS, RCS (on newer phones), and its own messaging protocol, iMessage. To turn read receipts off for all messages:

Open Settings.
Go to Apps → Messages.
Scroll to Send Read Receipts and toggle the switch off.

For iMessage contacts (denoted by a blue bubble icon), you can also turn of read receipts for individual contacts. To do this:

Open a text thread from an iMessage contact.
Tap on the contact’s profile picture at the top of the screen.
Scroll to the Send Read Receipts option and toggle it off.

How to turn off read receipts on Google Messages

Google Messages is the default SMS and RCS messenger app on most non-Samsung Android phones (and comes preinstalled even on Samsung phones). To turn off RCS read receipts:

Open the Google Messenger app.
Tap on your profile picture (top right).
Go to Message settings → RCS Chats and toggle the Send read receipts switch off.

How to turn off read receipts on Samsung Messenger

Samsung Messenger is the default SMS and RCS messenger app on Samsung phones. To turn off RCS read receipts:

Open the Samsung Messenger app.
Tap the three-dot menu (⋮).
Go to Settings → More settings → Text messages and toggle the Delivery reports switch off.

How to turn off read receipts on WhatsApp

Open the WhatsApp app.
Tap You at the bottom right (iPhone) or the three-dot menu (⋮) → Settings at the top right (Android).
Go to Privacy.
Toggle the Read Receipts switch off.

Note that the read receipts setting in WhatsApp is a mutual setting, meaning that when you choose not to send read receipts to others, you also won’t be able to see when they’ve read your sent messages. Read receipts are always sent in group chats.

How to turn off read receipts on Signal

As with WhatsApp, read receipts are a mutual feature on Signal. When you turn them off, you won’t be able to see other contacts’ read receipts.

Open the Signal app.
Tap your profile icon at the top left.
Go to Privacy → Messaging → Read Receipts and toggle the switch off.

What makes read receipts dangerous?

Read receipts aren’t inherently dangerous, and can be genuinely useful for everyday conversations. However, there are potential risks when you’re messaging strangers, rather than people you trust.

Scammers can use a read receipt as confirmation that a real, active person is behind a phone number, which can make you into a more attractive target for follow-up scam attempts.

Read receipts also create a timestamp of when you personally saw a message, which over time or in the wrong hands can reveal patterns like when you’re awake, at work, or reachable. In a harassment or stalking context, that’s a live signal that someone is currently on their phone and is looking at it.

Of course, there are other less serious consequences of using read receipts. If you have them on and read a message but don’t respond promptly, you could risk upsetting the sender of the message. And if you claim to be busy, but your read receipts show you were clearly on your phone, you might have some awkward questions to answer.

What’s the safest messaging app?

The safest messaging apps offer privacy and security. You should have no expectations of privacy when messaging using SMS, as messages are not encrypted and be read by both your mobile carrier and the app developer (such as Apple, Google, and Samsung).

Apps like WhatsApp and Facebook Messenger (but not Instagram) now offer end-to-end encryption so Meta can’t read the content of your messages, but they still send a huge amount of metadata (such as who you talk to, when, for long, who they talk to, etc.) to Meta, which uses this information to target you with personalized ads.

Since May 2026, E2EE has been rolling out between iPhones (running OS 26.5+) and Android devices running the latest Google Messages (but not Samsung Messenger at the time of writing). But again, your metadata is still visible to not just Apple and Google, but to your internet provider.

A much better option is to use open source apps that genuinely protect your privacy (such as Signal or some of the European chat and messaging apps currently on the market).

Final thoughts

Read receipts aren’t something most people need to worry too much about. For friends, family, and coworkers, they’re a small convenience with little real downside. However, the risk rises with strangers, unwanted contacts, or anyone you don’t want tracking your habits.

The good news is that every major messaging app gives you the option to turn them off, and doing so costs you very little (at most, a bit of ambiguity about whether someone’s seen your message yet). If privacy is your priority, pair disabled read receipts with a genuinely private encrypted app like Signal that doesn’t collect and monetizes your data.

How to know if someone blocked you on Instagram

Proton Team — Tue, 14 Jul 2026 17:36:27 GMT

If you suspect someone has blocked you on Instagram, there’s only one real way to know for sure: asking them directly. Otherwise, Instagram does a pretty good job of preventing blocked users from finding out what happened. Of course, there are signs and ways to figure it out, which are also useful to know if you plan on blocking someone, such as Instagram stalkers.

In this article, we’ll look at how to block someone on Instagram, and how to know if someone blocked you.

What happens when you block someone on Instagram
How to block someone on Instagram
How to know if someone blocked you on Instagram
How to stay safe on Instagram
Instagram’s privacy settings aren’t enough

What happens when you block someone on Instagram

Blocking someone on Instagram prevents them from following you and viewing your posts, stories, and follow list. They won’t be able to see new posts and stories you share going forward, and they’ll no longer be able to message you.

In some cases, a blocked user might still be able to view your old likes and comments on others’ posts, but they will not receive a notification that you’ve blocked them.

Instead, most users find out they’ve been blocked by doing a little bit of digging or after realizing they haven’t seen your profile pop up in their feed lately. If they regularly search for your profile, they’ll probably notice that they can no longer find it.

How to block someone on Instagram

To block someone on Instagram, visit their profile and click the three dots (…) in the top right corner of the screen. This opens a menu that allows you to report, restrict, or block their account. You can also hide your story from that particular user, remove them as a follower, or see shared activity between the two of you.

The other way to block an Instagram user is from app settings:

1. Scroll to the Who can see your content section and tap Blocked.

2. Click the plus sign (+) on the top right-hand corner of the screen and type in their username or search to add them to your blocked list.

If you later change your mind, you can revisit this section and tap Unblock for each Instagram profile.

How to know if someone blocked you on Instagram

The only surefire way to know if you’ve been blocked is to ask the person directly, though that can make for an awkward conversation.

If you’re wondering how to see who blocked you on Instagram without asking, several signs can help you figure it out:

Search for their profile: You won’t be able to find their username and profile in your Following list. Try logging out of the app or using Instagram in incognito / private browsing mode before checking their profile. If the profile appears when you’re logged out but not when you’re logged in, that’s a strong indicator that they’ve blocked you.

Check your message history: If you’ve messaged the person before, your conversation remains in your message folder unless you deleted it. If their username and profile image still appear, you haven’t been blocked. But if the chat shows a generic avatar without a username and you can no longer send messages in the thread, it’s likely you’ve been blocked.

Look for past likes and comments: When someone blocks you, Instagram removes their likes and comments from your posts. Comb through your posts to see if these interactions are still visible.

Try following them again: If you can find and follow the account again, they may have simply removed you from their Followers list rather than blocked you.

Check with a mutual connection: Ask someone who also follows that person whether they can still see that account and message them. If so, you were likely blocked.

How to stay safe on Instagram

Blocking someone isn’t the only way to increase your safety and privacy on Instagram. The app lets you determine who can see your posts and stories, and who can message you. If you’re worried about your child using this social media app, set up parental controls within Instagram to limit their use and interactions.

And because Meta’s app often appears in news stories about privacy and security issues — such as the Instagram password reset emails and Meta pulling its AI image generator from Instagram after public backlash — you should lock down your privacy settings:

Set your profile to private

You can make your profile, posts, stories and follow list public for anyone to see, or you can go private, so only approved followers can view your information and media.

Here’s how to make your Instagram profile private:

1. Click the three lines in the top-right corner of your profile page.

2. Select Settings and activity.

3. Scroll to the Who can see your content section and tap Account privacy.

4. Toggle on the Private account setting.

Learn more about how to block Insta stalkers

Restrict someone instead of blocking them

In some cases, you might want to limit contact with someone without blocking them. This is possible through Instagram’s restrict feature:

Restricted users can’t see when you’re active on Instagram, and they won’t know if you’ve read their messages.
Messages from restricted users go into a separate folder called Message Requests, which you’re free to view or ignore.
Comments they leave on your posts and reels are visible only to you and the restricted user, unless you choose to approve them for others to see.
You won’t get notifications when the restricted account comments on your content.

To restrict someone, go to Settings and activity → Restricted, search for the Instagram account, and tap Restrict.

If you later change your mind, retrace your steps to remove someone from your Restricted list.

Set temporary limits for users

Instagram’s Limit interactions feature works similarly to restricting someone, but only for certain interactions and for a set period. It temporarily hides comments and new messages and prevents story replies, tags, and mentions from selected groups, such as recent followers and accounts that don’t follow you. The app will send an automatic notification to remove these limited interactions after a time period you specify.

You can also limit everyone but your list of close friends.

Go to Settings and activity → Limit interactions to decide what and who will be limited, and for how long.

Make the most of your Close Friends list

Many Instagram users follow a variety of accounts, including friends, family, coworkers, businesses, news sites and even strangers. Sometimes that list may include accounts you don’t remember following. To share selected content with a smaller audience, use the Close Friends feature. It allows you to:

Create a private list of followers, where you can add or remove people anytime
Limit individual posts, notes, reels, and stories to people on that list
When someone on your Close Friends list views a story shared with that group, they’ll see a green ring around your profile picture and a Close Friends label.
People on your Close Friends list can’t see who else is included. However, interactions with Close Friends content may reveal that individual members are also on the list.

To tweak your Close Friends list, go to Settings and activity → Close Friends. Check the boxes next to the Instagram contacts you’d like to add to your Close Friends list and tap Done. When posting something on Instagram, check the Audience setting and select Close Friends before sharing.

Instagram’s privacy settings aren’t enough

No combination of settings can make Instagram completely private. Features such as private accounts, Blocked, Close Friends, Restricted, and Limit interactions help control who can view or interact with your content, but Meta still controls the platform. It can change or remove privacy features, alter how they work, or introduce new features that create additional privacy risks. For example:

Private conversations can be accessed by Meta since the company ended end-to-end encryption on Instagram in May 2026, and that content can be shared with law enforcement in response to legal requests.
Vanishing messages should not be considered completely private either, as Instagram allows them to be reported for up to 14 days after their disappear.
Even visible privacy signals may be unreliable. Instagram Plus subscribers can view stories anonymously, so you may not always know who has seen your content.

Treat anything shared on Instagram as content that can be accessed beyond its intended audience. For stronger privacy, consider European social media apps with transparent data practices and a good VPN that protects your connection whenever you go online.

Proton VPN transparency report and warrant canary

Proton Team — Tue, 14 Jul 2026 16:32:45 GMT

Editor’s note: This page, which was originally published on June 18, 2017, is updated whenever there is a notable new legal request.

Proton VPN is based in Switzerland, so we will only comply with requests that have been approved by the Swiss court system. We are not legally bound to honor foreign requests without such approval, and in fact we are legally prohibited from doing so by Section 271 of the Swiss Criminal Code.

Switzerland has strong constitutional privacy protections. Under Swiss law, Proton VPN is not obligated to save connection logs, and we adhere to a strict no-logs VPN policy that has been validated by multiple no-logs audits. Because we do not collect or store any user activity information, we cannot provide it, even when we receive a legally binding Swiss court order.

Since Proton VPN was launched in 2017, we have received 458 legally binding orders approved by the Swiss authorities. In every one of these cases, the authorities wanted us to help identify who was connected to a specific Proton VPN server at a specific time.

In every case, we were unable to provide the requested identifying information because Proton VPN does not keep the logs that would make such identification possible. So, all such requests were denied.

A warrant canary is not meaningful in Switzerland, because Swiss law requires that the target of a surveillance or data request eventually be notified, so they have the opportunity to contest the data request.

2026

(Through June)

Total orders: 47
Denied orders: 47

2025

Total orders: 59
Denied orders: 59

2024

Total orders: 53
Denied orders: 53

2023

Total orders: 60
Denied orders : 60

2022

Total orders: 80
Denied orders 80

2021

Total orders: 121
Denied orders: 121

2020

Total orders: 37
Denied orders: 37

2019

Total orders: 1
Denied orders: 1

Microsoft GDID: How a secret Windows identifier may have led to Scattered Spider

Douglas Crawford — Tue, 07 Jul 2026 17:43:03 GMT

If you use Windows, you’re probably at least vaguely aware that your laptop is spying on you. This week, we received a concrete reminder of just how invasive to privacy Microsoft’s ubiquitous operating system really is.

Peter Stokes, a 19-year-old who is suspected of being a member of the notorious criminal hacking group Scattered Spider, was extradited from Finland to the United States and accused of hacking “Company F, a luxury-jewelry retailer.”

What makes the case interesting, however, is how he was caught.

Windows as spyware

According to the FBI’s criminal complaint, Stokes used a VPN to hide his online activity. This is widely considered a sensible option, as a VPN hides your real IP address from websites you visit and your online activity from your ISP. But he made a fatal rookie mistake: he used Windows.

Authorities identified Stokes using Microsoft records that tied his computer to suspicious use of ngrok, a web development tunneling tool that was used to “circumvent Company F network defenses and enable persistent unauthorized access to the Company F data center.”

Microsoft was able to identify Stokes’ computer thanks to its Global Device Identifier (GDID), a “device-level identifier designed to uniquely identify an installation of a Windows operating system on a device.”

In other words, every installation of Windows has a GDID that Microsoft can use to identify a device (including virtual devices), and to collect telemetry. Reinstalling Windows creates a new GDID for that device, but doesn’t erase the old one from Microsoft’s systems, so it can still be used to identify a device.

Microsoft then handed this information to third parties.

How the FBI used the information Microsoft provided

This evidence alone wasn’t enough to connect the crime to Stokes, but knowing the GDID gave the FBI a history of IP addresses that his device had accessed over time. To prove those IPs belonged to Peter Stokes specifically, investigators cross-referenced this IP history against logins to accounts known to be his, including Apple, Snapchat, Facebook, and his Growtopia game login.

Connecting the GDID to accounts known to belong to Stokes helped prove the GDID used to hack the jeweler belonged to a device owned by Stokes, according to the complaint.

That one of the IP addresses identified in this way belonged to a New York hotel that investigators say matches the interior visible in a Snapchat selfie showing Stokes covering his face with a wad of $100 bills is unlikely to help his case.

What does this mean for the rest of us?

The first thing to stress is that, in this case, the system worked as intended.

Stokes faces charges including conspiracy, cyber intrusion, and fraud offenses tied to over $100 million in ransom payments across more than 100 corporate intrusions since 2022. The FBI’s use of Microsoft data falls within legal frameworks requiring court orders and subpoenas.

But the GDID raises important questions about user consent and who actually owns the hardware you pay for. You are never asked to agree to the GDID on your device, and there is no easy way to remove it. Even completely re-installing Windows is only a partial solution.

In all of Microsoft’s extensive online documentation, GlobalDeviceId merits a single mention buried in a highly obscure technical document that no one is ever likely to read.

It is true, however, that all other major commercial operating systems, such macOS, Android, and iOS, can also almost certainly uniquely identify devices to their manufactures. The unfortunate thing is that most us simply accept this situation.

For those who don’t, the only practical way to avoid this is to use open source operating systems, such as Linux.