# ExpressVPN privacy rating

Commercial VPN service run by Express Technologies Ltd. in the British Virgin Islands, a subsidiary of Kape Technologies. It uses its own open-source Lightway protocol.

## Summary

ExpressVPN scores 56 out of 100 (grade D) on the VPN providers criteria. It meets 6 of 12 criteria: no ads or data sales, independent audit, transparency report, TLS configuration, audited no-logs policy and modern protocols. It partly meets security headers and anonymous payment. It does not meet open source, no trackers or telemetry, tells users about requests and open-source apps. It is based in the British Virgin Islands: Not in the Five, Nine or Fourteen Eyes. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://www.expressvpn.com
- Source code: https://github.com/expressvpn/lightway
- License: AGPL-3.0
- Jurisdiction: British Virgin Islands. Not in the Five, Nine or Fourteen Eyes.
- Platforms: Windows, macOS, Linux, Android, iOS
- Home page trackers: Google Fonts (not scored), Google Tag Manager
- Category: [VPN providers](https://privacyratings.com/vpns/)
- Grade: D (56/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | The apps and servers are closed source. Only the Lightway protocol implementation is published under AGPL-3.0. | https://raw.githubusercontent.com/expressvpn/lightway/main/LICENSE |
| No trackers or telemetry | No | The privacy policy lists Google Analytics and AppsFlyer, and the Android app includes AppsFlyer and Google Firebase Analytics. | https://www.expressvpn.com/privacy-policy |
| No ads or data sales | Yes | Funded by paid subscriptions. The policy states personal data is not sold. | https://www.expressvpn.com/privacy-policy |
| Independent audit | Yes | Full reports are published, including Cure53 on the Lightway protocol and KPMG on the no-logs policy. | https://cure53.de/pentest-report_expressvpn-lightway_2024.pdf |
| Transparency report | Yes | Twice-yearly counts of government requests, warrants and DMCA requests are published. | https://www.expressvpn.com/trust |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.expressvpn.com&hideResults=on |
| Security headers | Partial | Grade B (70/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.expressvpn.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Audited no-logs policy | Yes | KPMG assessed that the TrustedServer design prevents activity and connection logging. The full report is public after accepting KPMG terms. | https://www.expressvpn.com/security-audit-reports/kpmg-privacy-policy-2025 |
| Anonymous payment | Partial | Bitcoin is accepted, but an email address is needed for the account. | https://www.expressvpn.com/privacy-policy |
| Open-source apps | No | The apps are closed source. |  |
| Modern protocols | Yes | The Lightway protocol, audited by Cure53 and Praetorian, is the default. | https://www.expressvpn.com/lightway |

Source: https://privacyratings.com/vpns/expressvpn/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/vpns/expressvpn.md