A researcher says iOS devices do not fully route all network traffic through VPNs, leading to data leaks; ProtonVPN first publicized the issue in March 2020
VPNs on iOS are broken. At first, they appear to work fine. The iOS device gets a new public IP address and new DNS servers.
Context & Ripple Effects
The report extends a March 2020 disclosure about iOS traffic escaping VPN encryption, which ProtonVPN had already brought to public attention. It also sits alongside earlier evidence that an iOS VPN app could collect usage data even when its VPN setting was off.
Later coverage broadens the significance beyond a single provider: researchers described VPN-app tunnel-bypass attacks for which Android offered mitigation, while a separate report tied IP-address exposure in Private Relay to WebKit.
First-order effects
- iOS users relying on a VPN for complete traffic protection may expose traffic, IP-address information, or DNS activity outside the encrypted tunnel despite seeing a changed public IP address and DNS servers.
- ProtonVPN and other iOS VPN providers face a trust problem because the reported gap is in how device traffic is routed, not merely in the visible connection status.
Second-order effects
- VPN providers must make the limits of iOS traffic handling more salient to customers, while Android's reported mitigation gives competing mobile platforms a clearer security distinction.
- The finding raises the value of testing network paths beyond a VPN's displayed IP address and DNS configuration, since those indicators can mask traffic that bypasses the tunnel.
Third-order effects
- Repeated reports of traffic and IP exposure across VPNs and Private Relay point toward mobile privacy being constrained by operating-system and browser-network behavior, rather than guaranteed by a privacy app alone.
- If platform-level routing protections remain uneven, privacy services will increasingly compete on independently verifiable coverage of every network path, not on connection-state indicators.
The trend: Mobile privacy tools are shifting from simple encrypted-tunnel promises toward scrutiny of the operating-system and browser layers that determine whether traffic actually stays protected.