US‑UK Probe of "No‑Logs" VPN Claims — August 2026 Update

Who: U.S. Federal Trade Commission (FTC) and U.K. Competition and Markets Authority (CMA), with engagement from national data‑protection and telecom regulators. What: Ongoing coordinated inquiry into whether consumer-facing VPN marketing — especially “no‑logs,” “anonymous” and “untraceable” — matches operational reality. When: Probe announced in February 2026; this update summarizes what changed through August 2026. Where: Primarily U.S. and U.K. markets, with cross‑border implications for providers operating global server fleets. Why: Regulators say consumers pay subscriptions for privacy promises and must be able to verify them.

Context: why this matters now

The probe that began in early 2026 framed the problem as a mismatch between marketing language and verifiable technical practice. That remains the core issue. Between February and August 2026 the emphasis shifted from “policy language” toward operational evidence: live attestations, production‑scope audits and machine‑readable disclosures that procurement teams can evaluate.

This matters for buyers because the value proposition of a VPN subscription is a time‑boxed ROI calculation: subscription cost versus the privacy risk reduction delivered. If a vendor’s "no‑logs" claim lacks verifiable evidence, that ROI is speculative. Enterprises increasingly treat this like any other vendor risk: they want documentation, audits and contractual warranties before they pay recurring fees.

What changed since May 2026 — concrete developments

• Market survey (Aug. 1–10, 2026): VPN Security Review analyzed 36 widely subscribed VPN services’ public disclosures. Findings: 67% (24/36) published a third‑party audit report or full technical assessment; 58% (21/36) state server RAM‑only configurations; 44% (16/36) advertise some form of remote attestation (Intel SGX, AMD SEV, or ARM TrustZone). Only 53% (19/36) publish quantified retention windows in hours or days. Methodology: reviewers checked published PDFs, transparency reports and technical whitepapers linked from vendor sites.
• Audit quality is diverging: More audits are public, but depth varies. A meaningful minority are narrow scope (configuration reviews or single‑feature pentests) rather than production‑system attestations. Buyers should look for audits that explicitly state auditors had production access and validated server wipe/boot procedures.
• Remote attestation moved from marketing to practice: Several mid‑size providers now offer cryptographic attestation endpoints that customers and auditors can query. These implementations commonly use Intel SGX or ARM TrustZone to prove a server booted a specific image and that persistent storage is disabled. Attestation availability is still uneven across regions and server types.
• Transparency labels and machine‑readable disclosures: Multiple pilots launched in Q2–Q3 2026. Industry groups and privacy NGOs are trialing a standardized JSON disclosure—think “nutrition label” for logs—which lists data types retained, retention windows, and whether third‑party hosting is used. Early pilots are voluntary; expect fragmentation in the short term.

Recent technical and business trends

• RAM‑only hosting is mainstream for core exit nodes: Providers increasingly design gateway nodes to boot from RAM and mount no persistent volumes. That reduces certain risks, but does not immunize a provider from contractual or human errors (for example, backup pipelines or logs captured upstream).
• Rise of contractual proofs: More providers publish redacted summaries of hosting and subcontractor contracts to show limits on data access. These are useful but must be read for exceptions: arbitration clauses, gag orders, or emergency‑access clauses can undermine the plain‑language promise.
• Cost shift and consolidation pressure: Implementing deep production audits and attestation increases operational costs. Smaller providers face a choice: invest and raise prices or niche down. Expect some M&A and service consolidation during late‑2026.

Impact — who should care (and how much)

Consumers paying $2–12 per month should care if privacy is their primary purchase driver. Small businesses and enterprises should care even more: procurement teams should treat VPN vendors like other critical infrastructure suppliers and ask for verifiable evidence. If you run an MSP or sell privacy guarantees to customers, require contractual warranties tied to third‑party audits and technical attestations.

Practical, ROI‑focused checklist (updated Aug 2026)

Before renewing or switching, consider these evidence‑based checks:

• Audit signal quality: Prefer audits that (a) are recent (within 12 months), (b) state production‑system access, (c) are performed by independent firms with networking expertise, and (d) disclose limitations and remediation validation.
• Retention precision: Require retention windows in hours/days and explicit separation of authentication, connection/session metadata, and crash telemetry. If you need sub‑24‑hour claims, verify with attestation artifacts.
• Attestation availability: Ask if the vendor provides a verifiable attestation endpoint (with reproducible nonces) showing servers booted a known image and have disabled persistent storage. Confirm which regions and server types are covered.
• Jurisdiction and contract checks: Check corporate domicile, server hosting jurisdictions, and whether hosting contracts contain emergency access or gag clauses. For enterprises, require contractual clauses that tie monetary remedies to audit failures.
• Price vs. compliance cost: Expect vendors certifying production attestation and annual audits to charge 10–40% more. Factor that into lifetime ROI and your acceptable risk tolerance.

Reactions — what stakeholders are saying

Regulators continue to emphasize verifiability over slogans; trade groups call for common disclosure formats to avoid a patchwork of claims. Privacy advocates say audits and attestations are positive but incomplete without enforceable penalties for misrepresentation. From my reporting at VPN Security Review, vendors tell me they are investing in attestation and audit processes but worry smaller competitors will be priced out.

"Buyers need to read audits the way they read contracts," says Rachel Foster, Education & Career Reporter at VPN Security Review. "A published audit is not a pass — scope and production access matter for ROI calculations."

What to watch next (timeline to year‑end 2026)

• Q4 2026: Expect continued pilot disclosures for machine‑readable privacy labels and at least one industry group to publish a common template.
• Late 2026: Watch for concrete enforcement actions or formal guidance from the FTC/CMA if investigations find material misrepresentations.
• Ongoing: More providers will migrate core exit infrastructure to attestable, RAM‑only architectures; expect attendant price adjustments.

Bottom line

The US‑UK probe has moved the market from slogans toward verifiable evidence. That raises the bar for vendors and raises costs that buyers should expect to see reflected in subscription prices. For purchasers, the actionable step is simple: treat "no‑logs" as a claim that requires documentary and technical proof, and fold those verification costs into your ROI calculation.

FAQ — common buyer questions (Aug 2026)

Does "no‑logs" have a legal definition now?

No. Regulators are pressing vendors to specify what they mean by types of data, retention windows and exceptions, but there is still no single legal definition. For now, treat "no‑logs" as a marketing term that requires supporting evidence: detailed policy language, production‑scope audits and attestations.

Can I trust a third‑party audit?

Audits help but vary in usefulness. Trustworthy audits are recent (≤12 months), performed by independent firms with network expertise, describe production access and limitations, and show validated remediation. Audits that are limited in scope or issued only as summaries are weaker signals.

Are cryptographic attestation and TEEs a silver bullet?

No. Remote attestation (using Intel SGX, AMD SEV, ARM TrustZone, etc.) raises the technical bar by proving a server booted a known image and that storage is volatile, but it doesn’t cover contractual third‑party access, upstream logs, or operator errors. Treat attestation as one strong data point among several.

Should I switch providers because of this probe?

Not automatically. Re‑evaluate. If your provider can’t quantify retention, can’t produce up‑to‑date audits, or refuses to explain hosting arrangements and attestation coverage, factor the risk into your ROI and consider alternatives. For business customers, require audit and attestation clauses in contracts.