Fines and legal actions: the leaderboard (2026)
Our data holds 13 fines and legal actions against VPN companies from 11 regulators and courts, worth about €31 million in total. The largest is USD 16,500,000 against Gen Digital Inc. (FTC, 2024). Every entry links to the regulator's or court's own notice.
Amounts are in the original currency. The euro total and the order use approximate exchange rates.
court 3court (Athens, Greece) 1Apple 1Apple (at request of Roskomnadzor, Russia) 1US Commerce Department (BIS) 1Czech Office for Personal Data Protection (UOOU) 1FTC 1Swedish police (search warrant) 1US Department of Justice 1US Commerce Department / Department of Defense 1FTC (complaint by CDT; no FTC action found) 1
The 20 largest
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2024-02-22 | Gen Digital Inc. Avast Limited / Avast Software s.r.o. | FTC | USD 16,500,000 | FTC said Avast collected browsing data through its antivirus and browser extensions and sold it via subsidiary Jumpshot to over 100 third parties despite privacy promises. Order bans selling browsing data for ads and requires payment for consumer redress; finalised June 2024. source |
| 2024-04-15 | Gen Digital Inc. Avast Software s.r.o. | Czech Office for Personal Data Protection (UOOU) | CZK 351,000,000 | GDPR fine (about EUR 13.9m) for transferring pseudonymised browsing histories of about 100 million users to Jumpshot without a lawful basis and misleading users about it. source |
| 2021-09-14 | Kape Technologies Daniel Gericke (ExpressVPN CIO, individual) | US Department of Justice | USD 1,685,000 | Deferred prosecution agreement (not a conviction) with three former US intelligence personnel, including ExpressVPN's CIO, over hacking work for a UAE company before he joined ExpressVPN; total penalties across the three. ExpressVPN kept him in post. source |
court (3)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2017-10 | PureSquare / Gaditek PureVPN (GZ Systems) | court | — | An FBI affidavit in a cyberstalking case said PureVPN identified that the suspect's account connected from his home and work IP addresses. Commentators disagree on whether this came from stored logs or live monitoring. source |
| 2016 | Ziff Davis, Inc. Highwinds Network Group (IPVanish's owner at the time) | court | — | Court records published in 2018 showed IPVanish supplied a user's name, email, real IP and connection times to US Homeland Security in a child-abuse investigation, despite marketing itself as no-logs. This predates StackPath and Ziff Davis ownership. source |
| 2011-09 | Gen Digital Inc. HideMyAss (Privax; then independent, later bought by Avast) | court | — | HMA disclosed a user's IP address under a court order, which helped identify a LulzSec member charged over the Sony Pictures hack. source |
court (Athens, Greece) (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2025-04-11 | Windscribe Limited Yegor Sak (Windscribe founder) | court (Athens, Greece) | — | Founder personally charged over an unknown user's alleged offence via a Windscribe server in Finland; charges dismissed for lack of evidence. Account is mainly from Windscribe's own statement. source |
Apple (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2025 | Innovative Connecting Pte. Ltd. (Qihoo 360-linked network) Innovative Connecting Pte. Ltd. | Apple | — | After TTP's April 2025 report, Apple reportedly removed Thunder VPN and Snap VPN from its App Store; Turbo VPN and VPN Proxy Master remained listed at TTP's follow-up. source |
Apple (at request of Roskomnadzor, Russia) (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2024-07-04 | Proton AG Multiple providers (Proton VPN, NordVPN, PIA, Le VPN, Red Shield VPN and others) | Apple (at request of Roskomnadzor, Russia) | — | Apple removed about 25 VPN apps from its Russian App Store after a demand from Russia's communications regulator. This reflects Russian censorship rules, not wrongdoing by the providers. source |
US Commerce Department (BIS) (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2024-06-20 | Kaspersky (AO Kaspersky Lab) Kaspersky Lab, Inc. and affiliates | US Commerce Department (BIS) | — | First ICTS final determination: bans new US sales from 20 July 2024 and updates/resale from 29 September 2024 on national-security grounds; covers Kaspersky's consumer products including its VPN. source |
Czech Office for Personal Data Protection (UOOU) (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2024-04-15 | Gen Digital Inc. Avast Software s.r.o. | Czech Office for Personal Data Protection (UOOU) | CZK 351,000,000 | GDPR fine (about EUR 13.9m) for transferring pseudonymised browsing histories of about 100 million users to Jumpshot without a lawful basis and misleading users about it. source |
FTC (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2024-02-22 | Gen Digital Inc. Avast Limited / Avast Software s.r.o. | FTC | USD 16,500,000 | FTC said Avast collected browsing data through its antivirus and browser extensions and sold it via subsidiary Jumpshot to over 100 third parties despite privacy promises. Order bans selling browsing data for ads and requires payment for consumer redress; finalised June 2024. source |
Swedish police (search warrant) (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2023-04 | Amagicom AB (Mullvad) Mullvad VPN AB | Swedish police (search warrant) | — | Police visited Mullvad's office with a search warrant to seize computers with customer data; they left without taking anything after being told no such data is stored. source |
US Department of Justice (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2021-09-14 | Kape Technologies Daniel Gericke (ExpressVPN CIO, individual) | US Department of Justice | USD 1,685,000 | Deferred prosecution agreement (not a conviction) with three former US intelligence personnel, including ExpressVPN's CIO, over hacking work for a UAE company before he joined ExpressVPN; total penalties across the three. ExpressVPN kept him in post. source |
US Commerce Department / Department of Defense (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2020-06 | Innovative Connecting Pte. Ltd. (Qihoo 360-linked network) Qihoo 360 (linked parent) | US Commerce Department / Department of Defense | — | Qihoo 360 was added to the US Entity List in 2020 and later named a Chinese military company by the Pentagon; TTP links it to the Innovative Connecting VPN apps. source |
FTC (complaint by CDT; no FTC action found) (1)
| Date | Company | Regulator / court | Amount | Reason |
|---|---|---|---|---|
| 2017-08 | Point Wild AnchorFree, Inc. (Hotspot Shield) | FTC (complaint by CDT; no FTC action found) | — | Center for Democracy & Technology asked the FTC to investigate alleged traffic redirection, ad/JavaScript injection and logging by the free Hotspot Shield app. AnchorFree denied the claims. These are allegations, not findings. source |