Ex-employee of Golden Frog GmbH here (makers of VyprVPN). Golden Frog nor VyprVPN ever sold any of its customer information in my time there. Based on my conversations with current employees, they still do not.

Not all VPN providers sell data (DNS or otherwise). Some operate for privacy-driven reasons and actively seek to be good stewards for their customers.

I owned a small VPN provider. We never did or considered doing that. So your statement is definitely false. But I also doubt that it's even approximately correct. Even assuming the worst of most VPN providers, I'd be very, very surprised if that could be a viable business model. Your DNS data isn't even remotely valuable enough to justify user acquisition and bandwidth/servers cost.

OpenDNS built a business around this model: use our DNS servers and we sell the DNS hits to third parties looking to track traffic. I worked at a company that bought this data and resold it. Maybe the little VPN providers don't do this, but the big ones certainly do.

Do you know for sure that Mullvad sells DNS data? They claim to not log anything, including DNS.

Mullvad does not log anything and it makes sense. You can literally pay with an envelope of cash and you will receive a single Account ID to activate your VPN. You don't even provide any personal details.

Mullvad is the best privacy-focused VPN, hands down.

> Mullvad does not log anything and it makes sense.

That might well be true, but anonymous payments are no proof, or even supporting evidence, for your claim.

It could still be very lucrative to resell data in the form of "users who access foo.com often also access bar.com" – and you can probably see why that could easily be deanonymizing.

I don't believe Mullvad sells DNS data, largely in part to their much higher pricing model when compared to Nord/Express/et. al

Their FAQ confirms this, assuming you trust them. https://mullvad.net/en/help/no-logging-data-policy/#no-logs

I was under the impression that VPN services were very profitable on their own, without selling data. Is this really a price thing, or is it a shady greed thing?

$3 a month per person is not a business model...

It’s hard to have another business model when you know nothing about the user. Please read up on how Mullvad works and then come back with a coherent argument on how they could be making money off user data.

Lots of video streaming services seem to be in the $10/mo range, and they have to deal with licensing all the shows and storing them. $3/mo seems pretty reasonable off the cuff for a VPN service.

Don't forget all the youtubers a VPN has to pay and all the 75% off deals with the promocode ILOVEMYYOUTUBER.

It is when support costs are negligible and they use 40 cents of server resources.

A higher price point isn't proof of anything.

If a provider can sell a VPN for $1/month as a loss leader and make $5/user after selling all data, what keeps a $10/month VPN from making >$15 doing the exact same thing?

My point was that they charge more for the subscription to avoid putting themselves in a situation where they feel pressure to sell user data to make up for a bad quarter of sales.

Yea, can even pay with brown envelope of cash. They're the MVP.

Mulvad is the only VPN I trust (almost) completely.

Private Internet Access and ProtonVPN both have tenuous relations to shady stuff. Private Internet Access got purchased by the same company that made Cyberghost (malware), but so far nothing bad has come of it. AFAIK they're also the only VPN that has been truly court-tested.

ProtonVPN has some really weird circumstantial stuff related to TesoNet.

Any other VPN I wouldn't trust by default. Shady business sector.

There are others, like OVPN that are A tier, but yea you need to vet carefully.

I think it is a risk that peole should be aware of / understand.

But I don't buy into the idea that anyone can say "ALL VPN PROVIDERS" do a thing.

I'm sure that some VPN providers don't sell their users' data, but if you have no way of finding out which do and which don't, does it matter?

Shouldn't that just be ALL PROVIDERS in general? There's probably a few choice ISPs that maintain their dignity, but I wouldn't put it past Comcast, Verizon, and all the mobile providers out there.

Ask Joseph Nacchio what happens to providers who don’t play along https://en.wikipedia.org/wiki/Joseph_Nacchio

I don't believe Proton or Mullvad sell user data; both purposefully avoid collecting user data.

I believe NordVPN's open sourcing effort here (whether genuine or not) is motivated by pressure from Proton's open source.

It may be good opsec to act like they do, but that's a broad accusation without any evidence to support it.

I can guarantee you Mullvad does not. I can't speak for anyone else though.

I'd hope that mullvad at least wouldn't do that given how strongly they seem to value privacy. Of course, you can never be entirely sure...

If this is a concern, one can self-host a fully recursive DNS server and connect over DoT.

What value is a bunch of a users DNS traffic? All you’d have is what domains they visited… not what products they view or anything like that. I imagine most of that data is “target.com” or “Reddit.com” and such. It can’t be all that valuable for ad targeting…