Many of the top VPN services and apps, some with 100M+ downloads, have misled users about their practices while disguising their ownership, like ties to China
Joseph Menn / Washington Post :
Context & Ripple Effects
The trust problem in the VPN market has been building for years: a [[a:916422|2017 study of 283 Google Play VPNs found 18% didn't encrypt traffic at all and 75% embedded third-party tracking libraries]], and Kape Technologies' ownership of both popular VPNs and the review sites rating them exposed how opaque the sector's ownership had become.
Joseph Menn's Washington Post report escalates that arc from shady-but-disclosed ownership to actively disguised ownership — apps with 100M+ installs misleading users about their practices, including ties to China, which is especially charged given Chinese hackers previously found ways to identify Tor and VPN users inside the country.
First-order effects
- Users of these high-download apps are making privacy decisions based on false premises — the very tool marketed to protect traffic may be run by parties its owners concealed.
- The named VPN operators now face immediate credibility loss and pressure from app-store gatekeepers and journalists over their corporate structures.
Second-order effects
- Honest operators gain a pricing and positioning wedge: independently audited no-logs claims and transparent ownership become the differentiators in a market where trust is the entire product.
- App stores and platform reviewers face pressure to verify VPN ownership structures before distribution, raising acquisition costs across the category.
Third-order effects
- If the pattern holds, the industry moves toward the standards-based maturation Slate flagged back in 2019 — certification, audited ownership disclosure, and consolidation around brands users can actually verify.
- Ownership opacity intersecting with China ties pushes VPN selection toward a geopolitical screening question, echoing the era when Apple pulled all major VPN apps from its China App Store.
The trend: Consumer privacy infrastructure is consolidating around verifiable trust — audited practices and disclosed ownership — as the cost of opaque VPN ownership keeps surfacing.