VPN No-Logs Claims Tested in Court: What the Record Shows

VPN no-logs claims, tested in court: what actually happened

This piece is built from court filings, seized-server reports, and named published investigations rather than first-hand use of any of these services.

Every VPN homepage says "no logs." That's a promise, and promises are cheap. What's expensive is a subpoena, a police raid, or a physically seized server — because those don't care what the marketing page says. They test whatever configuration was actually running on that specific date, and the outcome either gets published or it gets buried in a court filing. Below is the public record of the cases where a no-logs claim was actually put under that kind of pressure, what was demanded, what came back, and what each case does and doesn't prove.

Private Internet Access — two separate US court tests

Per TorrentFreak's March 2016 reporting, the FBI subpoenaed Private Internet Access (PIA) while investigating a string of hoax bomb threats phoned and emailed to schools and airports. TorrentFreak reported that the subpoena "resulted in no useful data being revealed" — PIA could only confirm the requesting IPs belonged to a shared VPN cluster, nothing tied to an individual account.

Per TorrentFreak's June 2018 follow-up, PIA's no-logging claim was tested again in a federal hacking trial in San Jose that began May 29, 2018, over the 2015 compromise of Embarcadero Media's email accounts and websites. London Trust Media's general counsel, John Allan Arsenault, testified under oath that PIA retained no connection logs and no customer name or address records that could tie the defendant's alleged activity to an account. Some VPN-industry write-ups describe a third US instance where PIA was tested; we could not independently confirm a third case against primary court reporting, so we're naming only the two documented in filed complaints and trial testimony.

ExpressVPN — Turkey, 2017, a physical server seizure

After the December 2016 assassination of Russian ambassador Andrei Karlov in Ankara, investigators found that someone had used ExpressVPN to delete social media posts and emails tied to the shooter's accounts. Per ExpressVPN's own public statement and Comparitech's reporting, Turkish authorities requested logs in January 2017; when ExpressVPN said it held no connection logs capable of identifying which customer used the cited IPs, Turkish police physically seized the company's server from a Turkish data center and inspected it directly rather than taking the company's word for it. The seizure reportedly turned up no data that could identify the user. ExpressVPN has said the incident is what pushed it to build TrustedServer, an architecture where servers run entirely from RAM and wipe on every reboot, and the company no longer operates physical hardware inside Turkey.

Mullvad — Sweden, April 2023, a police raid that left empty-handed

Per TechRadar and Mullvad's own account, at least six officers from Sweden's National Operations Department arrived at Mullvad's Gothenburg office on April 18, 2023, with a search warrant connected to an international law-enforcement request from Germany, intending to seize machines holding customer data. Mullvad staff reportedly walked the officers through the infrastructure and showed there was nothing to seize; after consulting the prosecutor, police left the premises without taking any equipment or data. This is one of the more direct tests on the list because it wasn't a subpoena answered on paper — it was a warrant executed in person against physical hardware, and it still came back empty.

Windscribe — three distinct events people often conflate

Windscribe has three separate incidents in its record, spanning five years, and it's worth keeping them apart because they don't all prove the same thing.

In June 2021, Ukrainian authorities seized two of Windscribe's OpenVPN servers as part of an investigation into activity from roughly a year earlier. Windscribe disclosed that those two machines still ran an older stack that stored the OpenVPN certificate and private key unencrypted on disk — a real security gap, since a key like that could theoretically let someone impersonate the server. Windscribe said no customer traffic logs existed on the seized machines because none are kept, so the exposure was to key material, not to logged user activity. The company says it fully moved that server class to RAM-only operation by July 20, 2021.

Separately, per Windscribe's April 2025 statement and TechRadar's reporting, a Greek prosecution — opened after investigators traced an alleged intrusion to a Windscribe server in Finland via Interpol — named founder Yegor Sak personally as a defendant because the server's hosting bill was in his name. A Greek court dismissed the charges on April 11, 2025 after finding no user data existed to produce. That dismissal is the case that actually functions as a no-logs court test; the 2021 Ukraine seizure is a separate infrastructure-hardening story, not a data-production test.

Most recently, per Tom's Guide and TechRadar's reporting, Windscribe said on February 5, 2026 that Dutch authorities removed one of its servers from a Netherlands rack to "fully analyze it," and that officers did not present a warrant on site. Windscribe maintains the server was RAM-only and held nothing beyond a base OS install. As of September 2026, Dutch authorities had not publicly confirmed details and the server had not been returned or its analysis results published, so this one is still open — worth watching, not yet a resolved data point either way.

IPVanish — the counterexample every buyer should read

Not every case cuts in the no-logs provider's favor, and leaving this one out would be dishonest. Per TorrentFreak's 2018 reporting on 2016 court papers, Homeland Security investigators probing a criminal case in Indiana subpoenaed Highwinds Network Group — IPVanish's parent company at the time — and, after a follow-up request, received detailed connection logs: timestamps, IP addresses, and session data that identified a suspect on a Comcast connection. IPVanish was publicly advertising a strict no-logs policy at the exact moment those records existed and were handed over. IPVanish changed ownership in 2017 when StackPath acquired the brand, and the current operator says its infrastructure was rebuilt after that sale. That ownership change matters for judging today's IPVanish, but the 2016 incident is real, it's documented in court papers, and it's the clearest proof that a marketing claim and an engineering reality can diverge.

The record, side by side

What a seizure proves that an audit can't — and what it still doesn't prove

A third-party privacy audit tells you what a firm was permitted to inspect and what it found on a scheduled visit. A subpoena, a raid, or a physical server seizure tests the system under conditions nobody controlled or scheduled — that's why cases like Mullvad's and ExpressVPN's carry more evidentiary weight than a glossy assessment PDF. When police walk in with a warrant and leave with nothing, or when a seized hard drive turns up no identifying data, that's about as close to a real-world stress test as this industry offers. It's also worth keeping the two kinds of "audit" separate: an assurance engagement from an accounting firm reviews whether stated practices match documented controls on a given date, while a penetration test from a security firm tries to break in. Neither one is the other, and neither is a guarantee of future conduct.

But a clean seizure result only verifies the configuration that existed on that specific date, on that specific server, under that specific jurisdiction's laws. It says nothing about whether the same company logs differently in another country, updates its practices next quarter, or gets acquired by an owner with different incentives — which is exactly the IPVanish lesson: a policy can be genuine for years and still not survive an ownership change or an engineering shortcut. RAM-only server architecture (what ExpressVPN and Windscribe both adopted after their respective incidents) reduces the odds of leftover data existing to hand over, and operating out of a jurisdiction without mandatory data-retention law changes what a provider can legally be compelled to keep. Neither guarantees anything about a provider's conduct next year.

It's also worth saying plainly: a VPN is not anonymity. It hides your traffic from your ISP and from anyone snooping on the local network, and it can make a subpoena come back empty when the provider genuinely holds nothing — but it doesn't erase the account you signed up with, the payment trail behind it, or what you do once connected. Treat it as one layer of a privacy setup, not a cloak of invisibility.

What to actually weigh before you buy

Marketing copy is free to write. A documented track record isn't. When you're comparing options, weight a provider's history of court tests, seizures, and how it responded (did it change its architecture afterward, like ExpressVPN's TrustedServer move?) far more heavily than the presence of a logo claiming an audit or a no-logs badge on the pricing page. If you want a deeper walkthrough of how a no-logs claim fits into a broader privacy setup — including what a password manager adds that a VPN alone doesn't — see our breakdown of whether a VPN is worth pairing with a password manager. If you're assembling privacy tools on a budget, our starter kit for locking down the basics without overspending covers where a VPN ranks against other line items.

For a shortlist built around this exact track record, compare current no-logs VPN picks. If you want to start with the largest providers named in these comparisons, See NordVPN plans or See Surfshark plans — check each one's own published court-test and seizure history against the standard laid out here before you commit.

FAQ

Does a server seizure that turns up nothing prove a VPN never logs anything? It proves that specific server, in that configuration, on that date, held nothing useful. It's strong evidence of good practice, but it's a snapshot, not a lifetime guarantee — infrastructure, ownership, and jurisdiction can all change later.

Is a court-tested no-logs claim more trustworthy than an independently audited one? They answer different questions. An assurance engagement reviews infrastructure and policy on a scheduled date with the firm's cooperation; a penetration test tries to break in; a subpoena or seizure happens without the provider controlling the outcome at all. All three are worth checking, but none substitutes for another, and a vague "independently audited" claim without a named firm, scope, and date isn't verifiable in the first place.

Does using a no-logs VPN make me anonymous online? No. It limits what your ISP and local network can see and can make a data request come back empty if the provider genuinely holds nothing, but your account details, payment method, and on-platform activity can still identify you. A VPN is one privacy layer, not anonymity.

Why does the IPVanish case matter if the company changed ownership? Because it shows a real no-logs claim can be false while it's being advertised, not just theoretically. The 2017 ownership change is relevant to judging today's IPVanish, but it doesn't erase what the 2016 court papers documented, and it's a reminder to check a provider's history rather than just its current homepage.

Should I pick a VPN based only on whether it's been court-tested? Treat it as one strong signal among several — jurisdiction, server architecture (RAM-only versus disk-based), how the company responded to any past incident, and transparent, dated disclosures all matter too. See WiTopia plans if you'd rather compare a smaller, longer-standing provider against the bigger names covered here.