The Proton VPN Blog

Japan’s digital nomads prioritize stability, security, and reliable internet over adventure

Ben Wolford — Thu, 04 Jun 2026 15:26:03 GMT

Digital nomadism is often associated with laptops on beaches and constant international travel. In Japan, however, a new survey conducted using the Freeasy research platform suggests a different reality.

Proton VPN commissioned the survey to better understand how Japanese attitudes toward remote work are evolving as more professionals work from cafes, coworking spaces, hotels, and public networks outside traditional office environments.

The initial survey gathered responses from 1,000 adults aged 20 to 99 across Japan. Respondents consistently prioritized stable internet access and work-life balance over travel or lifestyle experimentation. But although they say digital security is important, a majority of respondents still aren’t taking the basic steps necessary to secure their networks and protect their accounts.

Japan’s few digital nomads mostly travel within Japan

67% of respondents have neither experience with nor interest in remote work abroad.
14% have no experience with remote work abroad but want to try it.
10% have worked remotely within Japan but not abroad.
3% have worked remotely while living abroad.

Among experienced remote workers, two-thirds say they primarily work from home, while overseas remote-work locations remain relatively uncommon.

Several cultural and structural factors help explain this caution, including low passport ownership and language barriers. For many respondents, remote work appears to be less about travel and more about improving flexibility without disrupting familiar routines.

Japanese remote workers prioritize reliability over lifestyle perks

32% say ensuring a stable internet connection is their biggest remote-work challenge.
28% struggle to separate work and personal life.
16% cite maintaining productivity and focus as their main hurdle.
Only 5.3% say lower living costs are the biggest advantage of remote work abroad, making cost savings the least-cited benefit in the survey.

When working outside a traditional office, respondents value quiet environments for concentration (52%) and fast, stable internet (48%) far above scenic locations or lifestyle perks.

These practical worries extend to traveling. The top concern about living abroad while working is handling illness or emergencies (46.3%), followed closely by money management and overseas payments (44.8%).

Rather than escaping routines, remote work in Japan is about gaining flexibility while maintaining stability. Among experienced remote workers, 31% say the lifestyle made them value freedom more, but 23% say it increased their appreciation for stability.

Japan’s remote workers worry about security but take no precautions

37% of experienced remote workers use two-factor authentication as a security measure.
34% avoid logging into important accounts on public networks.
30% use a VPN when working remotely.
19% take no specific online security measures at all when working outside their normal environment.
14% rely on mobile hotspots instead of public networks.

Many respondents lack consistent security habits when working outside their home or office, creating a clear gap between awareness and behavior. While 37% rely on two-factor authentication and 34% avoid public logins, only 30% use a VPN. Most strikingly, nearly 1 in 5 (19%) admit to taking no specific online security measures at all.

As remote professionals increasingly rely on public WiFi, cafes, and coworking spaces, security habits are not always keeping pace with changing work environments.

VPNs are viewed as work tools, not entertainment tools

66.7% of VPN users say their primary reason is secure access to work systems.
50% use them to protect communications when using public WiFi networks.
33.3% use them to protect personal information online.
30% use them to access Japanese websites and services while abroad.
23.3% use them for personal reasons, such as watching videos.

Among respondents who do use a VPN, the technology is viewed primarily as a professional security tool rather than for entertainment or personal use. Over 66% use a VPN for secure work access and 50% use it to protect communications on public WiFi. In comparison, recreational use cases rank much lower. Only 30% use VPNs to access Japanese sites from abroad, and just 23.3% to watch videos.

Respondents consistently prioritize reliability, security, and stable access to work systems over lifestyle or entertainment-focused perks. Rather than being viewed primarily as consumer tools, VPNs appear to be used mainly as part of the practical setup for secure remote work.

Japan’s version of digital nomadism is evolving differently

Ultimately, Japan’s version of remote work is moving away from the borderless nomad stereotype. It is evolving into a pragmatic, reliability-first model shaped by a desire to gain professional flexibility without sacrificing the comfort, safety, and quality of life found at home.

Key conclusions

Reshaping the lifestyle: Japanese professionals are not rejecting remote work; instead, they are shifting the concept away from a travel-first ideal toward domestic stability and predictable infrastructure.
Safety over adventure: The standard for mobile work remains highly cautious, with a clear preference for familiar home routines, dependable connectivity, and robust data protection.
A pragmatic future: Instead of full location independence, the data points to a reliability-first model built entirely around “Japan-standard” expectations for convenience, focus, and peace of mind.

Are cookies dead? What is Utiq, and should you be worried?

Douglas Crawford — Tue, 02 Jun 2026 17:55:09 GMT

For years, advertisers have relied on third-party cookies (small text files that are stored on your browser when you visit websites) to track your behavior across different websites, so they can serve you with ever more personalized ads. The problem for advertisers is that even deeply non tech-savvy people are increasingly aware of cookies and are taking steps to actively block them.

Utiq is a fairly new (2023) advertising technology company, jointly founded by four of Europe’s most powerful telecoms companies: Deutsche Telekom, Orange, Telefónica, and Vodafone. Leveraging their combined power, Utiq aims to replace cookies with something that it claims will “give consumers real control and choice over their privacy, whilst facilitating more relevant digital marketing experiences”.

By June 2025, Utiq claimed 26 telecom operator partners (many of whom are smaller companies who lease connections from “the big four”), and more than 55 million unique ConsentPass tokens (see below) across Europe. Utiq now operates in Germany, Austria, Spain, France, the UK, and Italy.

How does Utiq work?

Instead of using cookies to track and profile you across different websites so that you can be served with ever more personalized ads, Utiq works at the ISP level. Here’s how it works:

1. You visit a participating website

If your IP address also belongs to a participating ISP (including your mobile provider), the site displays a clear consent banner asking if you agree to be identified via your network connection. If you’re not on a participating operator’s network, Utiq won’t be activated at all.

If you click Accept, Utiq sends a secure request to your ISP or mobile provider.

2. Your ISP generates a “ConsentPass” token

Your provider matches your connection (often using your phone number or broadband account ID as the seed) to generate a unique, random, anonymized token called a ConsentPass.

This token proves that you (or specifically, your device on this connection) have given consent
Crucially, it doesn’t reveal who you are, only that you are an anonymous user who opted in

3. The ConsentPass is shared with Utiq

From the ConsentPass token, Utiq generates two additional encrypted tokens:

MartechPass: Sent to advertisers and publishers. This allows them to recognize you as a consenting user across different websites without seeing your personal identity. They can use this for personalized ads or content, but they cannot link it back to your real-world identity.
AdtechPass: Used for measuring ad performance (e.g., did an ad lead to a sale?) without tracking your browsing history across the entire web.

4. User Control

A key selling point of Utiq is that you maintain control over who can track you. In addition to consent being required when you first visit a website, you can visit the Utiq ConsentHub (a dedicated portal) at any time to see which companies have received your tokens.

From there, you can easily withdraw consent. Once withdrawn, your tokens are invalidated, and participating advertisers and websites must stop using them.

What Utiq means for your privacy

Thanks to the need for explicit consent to be given, and the ability to withdraw consent at any time, Utiq is keen to promote itself as a as “privacy-by-design” solution that balances the needs of advertisers with the privacy needs of internet users.

It also claims GDPR compliance and presents itself as a European alternative to US adtech giants. However, privacy advocates are skeptical.

Utiq is potentially worse than cookies

A peer-reviewed paper by researchers at the Universitat Politècnica de Catalunya concluded that ConsentPass tokens were functionally similar to third-party cookies aimed at identifying internet users consistently over time.

Critically, the researchers found that Utiq may actually be more intrusive than regular cookies, because the tokens are based on completely unique parameters, and cannot be cleared the way browser cookies can.

Also deeply concerning is its finding that 100% of the 10,000 websites it surveyed that used Utiq also used more intrusive tracking methods alongside it, including fingerprinting. The researchers concluded that Utiq doesn’t represent a genuine privacy improvement over third-party cookies, as its simply being added to the arsenal of tracking technologies used by websites, not replacing them.

Your phone number is used

A great deal has been made of the fact that your phone number is used as the cryptographic “seed” for your ConsentPass token. However, your phone number itself is never revealed to the websites, ad networks, or data brokers.

There is a potential risk that if Utiq’s hashing algorithm was ever compromised, or if a carrier leaks the mapping table between your phone number and ConsentPass, then every advertiser in possession of your tokens could link your online activity back to your real phone number.

To help counter this threat, Utiq uses cryptographic salt in its one-way hashing technique that’s only known to Utiq and the carrier. In theory, this makes reversing the process to reveal your phone number impossible without the collusion of both parties. However, a state actor with legal authority over both Utiq and a carrier could force the “collusion” of both parties with a simple court order.

Dark patterns

A probably greater concern for most is that many people will blithely click through the consent dialog without giving it much thought (as is common for cookie consent requests). This problem is compounded by the fact that while the ConsentHub portal exists, few people know about it, let alone check it regularly.

Can a VPN help? How to deactivate Utiq

Yes. The Utiq consent dialog is only activated if your IP address belongs to an Utiq partner. A virtual private network (VPN) hides your real IP address so that the website only sees the IP address of the VPN server. Not your real IP address.

So even if you are a partner provider customer, the consent dialog simply won’t activate. And since consent is never assumed, Utiq will never be activated as long as you’re using a VPN.

Learn more about VPNs

Should you be worried about Utiq?

Utiq presents itself as a privacy improvement on cookies. And in narrow technical terms, such as the need for explicit consent, a dedicated opt-out portal, and no direct sharing of personal data, it succeeds. But its still a technology developed in the interest of advertisers, rather than out of a genuine desire to protect ordinary internet users.

The reality is that Utiq is a tracking system built deeper into the infrastructure of the internet than cookies ever were, operated by companies that already hold more data about you than any advertiser. This data is tied to your real-world identity via your phone number. The practical reality is also that it’s being used by websites to supplement more traditional tracking methods, rather than replace them.

The good news is that a VPN is a very effective countermeasure. Far more effective, in fact, than traditional anti-tracking tactics such as blocking third-party cookies and using browser extensions to block DNS queries to advertising domains.

For now, Utiq is only of concern to Europeans. But the underlying technology has no inherent geographic limits, so success in Europe will likely lead to more global adoption.

Proton VPN 2026 spring and summer roadmap

Antonio Cesarano — Mon, 27 Apr 2026 15:53:31 GMT

In 2026, privacy online is more vital than ever. Around the world, people are facing growing censorship, tighter restrictions, and age verification systems that ask you to hand over personal data just to access everyday websites and services. For these reasons, VPNs have become more than a convenience. For millions of people, they are now an essential tool for privacy, freedom, and unfettered access to the internet.

At Proton VPN, our focus this spring and summer is to make privacy easier to use for everyone. We’re building a faster, more reliable, and more consistent VPN experience across every platform, so staying protected feels seamless, wherever you are.

Unlocking the next generation of performance

As we mentioned in our fall and winter recap, we’ve been working on a new client-side WireGuard® codebase that takes the best parts of our existing codebase and builds on them to unlock the next generation of Proton VPN performance, reliability, and censorship resistance. This modern, flexible VPN core allows us to:

Build faster, more reliable apps
Deliver best-in-class, anti-censorship capabilities
Ship features and improvements more quickly across all our apps
Lay the groundwork for post-quantum encryption

Beta testing of the new client-side codebase is already available on Android and Windows, and will be coming to macOS, iOS, iPadOS, and Linux over the coming months. Although currently experimental, we believe it to be safe and secure in its current form. So if your threat model allows it, we’d love you, our community, to help road-test this big new milestone in Proton VPN’s story.

A sleeker performance on Linux

We’re planning to make your experience smoother when using Proton VPN between devices and platforms. Our team is redesigning our Linux GUI app to give you a more consistent look and feel between apps on different platforms.

The modern, sleek design you know on other platforms will soon be available for Linux. These improvements are coming alongside long-awaited support for the Stealth protocol as part of the new WireGuard codebase. By helping mask VPN traffic, Stealth will make Proton VPN on Linux more private, harder to detect, and better equipped to work on networks that try to restrict or block VPN use.

Stay connected, your way

We recently introduced improved connection preferences that allowed you to permanently exclude specific countries, cities, and states from Fastest Country connections on Android. Just set your preferences once, and the app will always pick from locations that actually work for you. Soon, we’ll be making the same connection preferences available on Windows.

Defeat censorship in more countries

At Proton, our mission is to make the internet a better place for everyone. You can now defeat censorship by accessing the web from over 20,000 servers with IP addresses around the world, including multiple new locations. Proton VPN now lets you browse as if you were in one of over 145 counties worldwide.

New locations we’ve added, including in highly restrictive places such as Gabon, Haiti, Lebanon, Kyrgyzstan, Nicaragua, Papua New Guinea, provide you with greater choice and allow expats to connect home, wherever that is.

Proton VPN for Business

As a modern organization, you need simple, centralized control over how your teams connect and work online. That’s why we’re expanding Proton VPN for Business with tools that help IT teams protect employees, reduce risk, and manage devices at scale.

We’re working on giving admins control over the websites and content accessed within their organizations through web filtering policies. In addition, we are building advanced admin controls to enforce always-on VPN and split tunneling across your entire device fleet. We’re also working on a new admin dashboard that will help you stay on top of alerts and get a real-time view of your organization and network from one place.

Making privacy effortless

The future of privacy protection isn’t just stronger encryption or faster protocols. It’s making security simple enough that anyone can use it every day.

That’s what this roadmap is about: removing friction, improving reliability, and giving you the tools you need to stay private and connected in an increasingly challenging online world.

As always, thank you for being part of Proton’s mission to make privacy the default. To learn about exciting new features as they’re released, be sure to check out our latest release notes. And to help test-run these new features so we can fix issues before releasing them to the wider Proton VPN community, be sure to run the early-access (beta) versions of our apps.

To tell us what you think about our recent improvements or to suggest new features you’d like to see, join our community. You can also catch us on Reddit, Instagram, Linkedin, and X.

Proton VPN 2025-2026 fall and winter recap

Antonio Cesarano — Wed, 08 Apr 2026 16:18:24 GMT

As promised in our fall and winter roadmap, over the last few months we’ve been focusing on delivering features to greatly improve your VPN experience, such as building a new VPN architecture and delivering a Linux CLI. We’ve also made improvements that weren’t originally on our roadmap, such as making NetShield Ad-blocker even more effective.

We’d like to share with you, the Proton community, how this work is going, and to fill you in on any updates you may have missed. We’ll also post our roadmap for spring and summer soon, so be sure to check back in and see what’s coming next.

A new VPN protocol codebase for faster, more reliable apps

We’ve been busy working on an exciting new client‑side WireGuard® codebase that unlocks the next generation of Proton VPN performance, reliability, and censorship resistance. Soon to be available for beta testing on Android and Windows, we’ve already ensured this new codebase means:

Faster and more reliable apps
Greatly improved anti-censorship capabilities
Fewer disconnects and dropouts

Power, precision, and privacy from the Linux terminal

We’ve heard from our community that command-line support matters for Linux users. You can now enjoy Proton VPN’s trusted encryption and Swiss privacy from the Linux terminal, allowing you to skip the graphical interface and launch secure connections in seconds. Our Linux CLI (command-line utility) is built for speed and reliability, providing the fastest way to protect your privacy and manage your VPN without leaving the keyboard.

Available for Ubuntu, Debian, Fedora, and Arch, our new Linux CLI now supports a host of advanced features, such as IPv6, moderate NAT, custom DNS, a kill switch, VPN Accelerator, NetShield Ad-blocker, port forwarding, and more.

NetShield Ad-blocker is now six times more powerful

Although it wasn’t part of our original roadmap, we’ve made major improvements to NetShield Ad-blocker, our DNS filtering feature. NetShield has always been highly effective at blocking ads, malware, and tracker domains, and now it blocks six times more ads and trackers than before.

This is because NetShield now blocks subdomains in addition to root domains. For example, instead of just blocking connections to tracker.com, NetShield now also blocks connections to api.tracker.com cdn.tracker.com, pixel.tracker.com, and similar subdomains. As a result, it provides stronger protection for private, secure browsing.

Faster, simpler, more reliable

We’ve also introduced many under-the-hood improvements that make Proton VPN apps more intuitive and easy to use:

Added support for 6 new languages, bringing the total number of languages supported in all our apps (except Linux) to 35.
Added City view on Linux, iOS, iPadOS, and macOS (beta), so you can browse and connect to specific cities and states directly from the country list.
Improved split tunneling and the kill switch on Windows so you can use them together.
Improved Connection preferences on Android so you can exclude locations when you connect to Fastest.
Greatly improved startup reliability on the Android app.

Even better for business

Proton VPN for Business continues to expand its feature portfolio for teams and organizations. Over the last few months, we’ve introduced:

A new VPN + Pass plan aimed at professional users
Groups: Administrators can create user groups and customize each group’s access to Gateways and shared servers, providing granular control access to sensitive resources based on user identity.
Support for more MDM providers: Iru, FletDM, SimpleDM, and Workspace ONE.

So what’s next?

To find out more, watch out for our upcoming Proton VPN spring and summer roadmap.

Thank you for supporting our work to make privacy and freedom available to everyone. To tell us what you think about our recent improvements or to suggest new features, join our community.

IKEv2 support is ending on macOS

Douglas Crawford — Thu, 26 Mar 2026 11:34:05 GMT

To improve security and performance, we’re removing support for the IKEv2 VPN protocol from our macOS app. If you currently use IKEv2, you’ll need to switch to a modern VPN protocol before the change takes effect.

Apple’s native IKEv2 implementation on macOS has been a source of ongoing security concerns, including traffic leaks that can expose your real IP address. Powerful, sleek, and secure modern VPN protocols — such as WireGuard® and our own Stealth protocol — offer better performance and stronger privacy guarantees.

There is no longer a reason for us to continue supporting IKEv2, and we have long since stopped doing so on all our other apps.

What to use instead of IKEv2

Instead of IKEv2, you can use:

Smart Protocol (default): Let the app automatically select the best protocol for your network. This is the easiest option, and is enabled by default. Smart Protocol will intelligently switch between protocols and ports as needed.
WireGuard: A fast, lightweight, and secure protocol that is now the default on our macOS app. WireGuard offers significantly better performance than IKEv2, with the added benefit of excellent security.
Stealth: Our custom obfuscation protocol is based on WireGuard and tunneled over TLS. Stealth is designed to defeat censorship and deep packet inspection in restrictive network environments.

Learn how to change VPN protocols or select Smart Protocol

Don’t see WireGuard or Stealth as an option?

WireGuard and Stealth require the use of a macOS network extension (called system extensions on older macOS versions). If you don’t see these protocols listed in your Proton VPN app, it likely means the system isn’t enabled. This is a common issue, as macOS blocks third-party system extensions by default as a security measure, and you need to manually allow them.

Learn how to install macOS network extensions

Who is affected?

This update affects everyone using the IKEv2 protocol in the Proton VPN macOS app. If you haven’t manually changed VPN protocol, you are most likely already using WireGuard or Smart Protocol and don’t need to do anything.To check your current protocol, open the Proton VPN app and go to Settings → Connection tab → Protocol. If it shows Smart, WireGuard, WireGuard (TCP), or Stealth, you’re all set.

What do you need to do?

If your protocol is set to Smart, WireGuard, or Stealth: Nothing. You’re already using a modern protocol.
If your protocol is set to IKEv2: Switch to Smart Protocol or WireGuard in Settings → Connection → Protocol.
Check your connection profiles: If you have created custom VPN connection profiles, these may still use IKEv2 (even after you’ve updated your default protocol). Go to the Profiles tab, review each profile, and switch any that still use IKEv2 to Smart Protocol or WireGuard.

When do you need to do it?

We’ll be removing IKEv2 support from our servers starting April 2026. The entire process won’t happen overnight (final support will end in February 2027), but it will become increasing likely that your IKEv2 connection will fail April 2026 onward.

Why are we making this change?

In addition to the security concerns about Apple’s IKEv2 implementation, and the fact that modern WireGuard-based protocols offer much better performance than IKEv2, maintaining support for IKEv2 has negative consequences for all our users.

IKEv2 operates on well-known, fixed ports (UDP 500 and 4500) that are trivially easy to scan for. Countries that censor the internet (such as China, Russia, and Myanmar) actively probe these ports to detect and flag the IP addresses of our VPN servers.

Once flagged, these IP addresses are added to commercial databases (“blacklists”) used by websites, streaming services, and other online platforms to block access or serve CAPTCHAs to anyone connecting from those addresses.

This affects everyone in Proton VPN community who uses these servers, not just those using IKEv2. By closing these ports, we make our servers significantly harder to fingerprint and reduce the likelihood of our IP addresses being flagged. The result is a better browsing experience for everyone.

Removing IKEv2 from our macOS app allows us to:

Improve your security: Apple’s IKEv2 implementation has known vulnerabilities that are outside our control to fix. By moving to protocols fully managed by us, we can protect your privacy better.
Reduce complexity: Supporting fewer protocols means a leaner, more reliable app with fewer potential points of failure.
Accelerate development: A simpler codebase lets us ship new features and improvements faster.
Deliver better performance: WireGuard and Stealth are modern protocols built from the ground up to be fast and efficient, offering noticeably better speeds and lower battery drain than IKEv2.

A better, faster VPN experience

WireGuard is faster, more battery-efficient, and reconnects more quickly than IKEv2 — especially when switching between Wi-Fi and mobile networks. Combined with Smart Protocol’s automatic network probing, you’ll get the best possible connection without having to think about protocol selection at all.

If you connect to Proton VPN from a censored environment, Stealth provides robust obfuscation capabilities that IKEv2 simply does not. This change will result in a better VPN experience for all our macOS community members.

Censorship and repression: Proton VPN’s end of year report 2025

Douglas Crawford — Tue, 17 Mar 2026 17:18:30 GMT

The past year marked another challenging one for democracy and internet freedom. A notable trend was the increasing willingness of authoritarian governments to damage their own economies and the livelihoods of citizens by implementing total internet shutdowns.

Most notable, however, was the increasing threat to internet freedom in Western democracies by-and-large considered “free.” From age verification laws introduced without considering the full ramifications to social media restrictions, to DNS server blocks, access to a free and open internet is imperilled now more than ever.

As always, Proton VPN is at the forefront of this battle to protect privacy and free speech. More and more the world is relying on our services to defend themselves in this dramatic escalation the global war on internet freedom.

We’ve observed unprecedented surges in Proton VPN connections worldwide as people refuse to be silenced. As pressure mounted, citizens everywhere fought back, turning to privacy tools in record numbers to defeat censorship and reclaim their right to an open, uncensored internet. — David Peterson, Proton VPN’s General Manager.

In 2025, we observed spikes in Proton VPN signups in 62 countries. We define a spike as any sudden increase that surpasses 100% over the previous baseline. These upsurges included:

10 countries with at least one spike in signups of over 1,000%
Six countries with at least one spike in signups of over 5,000%
Four countries with at least one spike in signups of over 10,000%

In this report, we’ll analyze what made 2025 so remarkable. We’ll explore where pressures on free speech intensified and how regular people around the world pushed back. Using data from our observatory and global usage patterns, we’ll outline the forces now shaping online freedom — and what they might signal for the year ahead.

Most notable spikes and shutdowns in 2025

Spikes and shutdowns due to censorship and civil unrest

When political pressure rises, the internet is often the first casualty. Across multiple countries, governments responded to conflict and elections not with transparency, but with blackouts, throttling, and isolation from the global web. These incidents show how fragile digital access can be, and why tools that preserve connectivity matter now more than ever.

1. Iran

On June 18, as the Iran–Israel War escalated, Iran imposed a near-total internet blackout that lasted three days. The government severed international connections and blocked access to websites, social media, messaging services, and foreign VPN servers. Only Iran’s domestic intranet and government-approved services remained accessible.

Limited bandwidth returned on June 21, but networks remained heavily throttled for essential services only. Following a US-brokered ceasefire on June 24, normal (censored) internet access was restored. By June 26, Proton VPN signups surged 5,500% as Iranians looked for ways to access international news.

2. Tanzania

Tanzania’s October general election saw the two main opposition candidates barred from the ballot, sparking protests in several cities. Security forces responded with lethal force, causing many deaths and injuries, and the government shut down the internet for five days. When service resumed, VPN signups increased by 2,000%.

3. Afghanistan

On September 29, citing “immorality”, the Taliban imposed a 24‑hour total internet blackout affecting roughly 30% of the population. The shutdown came after the regime began removing women‑authored books from universities and restricting girls’ education past age 12, prompting some women to turn to online learning.

Even after the blackout ended, access to Facebook, Instagram and X remained limited. Proton VPN signups jumped a staggering 35,000% as Afghans sought ways to connect abroad. Subsequent disruptions, including a separate blackout on October 14, have kept VPN demand high.

4. Papua New Guinea

On March 25, 2025, Papua New Guinea abruptly blocked Facebook access, claiming a “test” to curb misinformation, hate speech, pornography and other harmful content during in the event of a national emergency. Critics noted the timing coincided with Prime Minister James Marape’s testimony in a corruption trial, suggesting the move aimed to suppress real‑time news coverage and commentary.

Because Facebook is a key gateway to the wider internet for many PNG residents, Proton VPN signups spiked by over 14,000 % the same day.

See more top censorship moments for 2025

Spikes due to legal and regulatory changes

Internet control doesn’t always look like a shutdown. Increasingly, it comes wrapped in regulation. New laws that expand age verification and identity requirements can create pressure to hand over sensitive personal data just to access legal content. When trust in data handling erodes, users look for alternatives.

1. United Kingdom

The UK’s controversial Online Safety Act, which introduced new age-verification requiring all user generated content sites to verify the age of their users, came into force on July 25. In practice, this meant adults were increasingly asked to prove their identity, often by uploading government-issued ID or submitting biometric data, to access legal content.

Many people were reluctant to comply, especially in light of a number of high-profile data breaches that hit the headlines at around the same time. The Tea app data breach exposed particularly sensitive user information: 72,000 images, including 13,000 verification photos and images of government IDs, and was followed by further such incidents, including data leaks involving Discord and Mixpanel.

Together, these events reinforced fears about how personal data is collected, stored, and protected by online services, and resulted in a notable 1200% increase in Proton VPN signups.

2. Spain

La Liga (Spain’s top soccer league) wanted to crack down on illegal streaming of matches. To do this, it obtained a court order allowing them to block IP addresses associated with piracy, which it promptly required multiple ISPs to do.

However, many of the blocked IP addresses belonged to Cloudflare, a global infrastructure provider. And because Cloudflare uses shared IP addresses, millions of legitimate websites share the same IP addresses as pirate sites. The result? Widespread over-blocking of millions of legitimate websites.

This remains an ongoing situation, resulting in consistent Proton VPN signup spikes throughout the year, notably in February (+110%) and October (+200%). Of particular note is that VPN usage surges occurred whenever the blocks were put in place, not just during matches. This strongly suggests that Spaniards are turning to VPNs simply to access the legitimate websites they usually frequent.

3. USA

In 2024, framing the measure as protection against “foreign adversary–controlled applications”, Congress passed legislation requiring TikTok to divest its US operations or face removal from app stores and US internet infrastructure.

On January 19, 2025, the TikTok app briefly stopped working for US users, and the app was removed from the Apple and Google app stores. The video editing tool, CapCut (developed by TikTok’s owners), also went down. During this time, we recorded a 520% increase in Proton VPN signups.

Within hours, however, the incoming Trump administration signed an executive order delaying enforcement, giving TikTok extra time to find a buyer and effectively pausing the ban multiple times through 2025.

Timeline of spikes

Signup spikes by region

Political instability in many sub-Saharan African countries, including Tanzania, Togo, the Democratic Republic of Congo, and South Sudan resulted in a notable increase in total internet shutdowns and Proton VPN signup spikes across the region.

Last year also saw a sizable increase in signups from Southeast Asian and Middle Eastern countries such as Türkiye, Myanmar, Cambodia, Iran, and Papua New Guinea, in response to social media restrictions (often implemented in response to civil unrest or with the aim of preventing it).

Perhaps the most interesting new development, though, was the number of spikes we witnessed in Western democracies such as the UK, US, Spain and France.

Proton VPN is at the forefront of the battle against censorship

Proton VPN provides key tools and services that allow people to access the free and open internet, no matter where they are. These include:

100% free VPN service with no data limits: Ensuring our service is available to those who need it the most is central to Proton’s mission.
Alternative routing: If our software cannot connect directly to our servers, it routes your connection through third-party services (such as AWS) that are unlikely to be blocked.
Stealth: Our WireGuard®-based obfuscated and DPI resistant VPN protocol is effective at defeating many forms of online censorship.
Smart protocol: When the default VPN protocol is blocked, our apps automatically switch to different VPN protocols and ports to evade the block.
Available from multiple sources: When access to our website is blocked, Proton VPN can be downloaded from third party sources such as Apple App Store, Google Play, Amazon app store and F-Droid. It’s available as an APK, and all our open source apps are available to compile and download from GitHub.

Of course, Proton VPN is always working on new ways to improve our anti-censorship capabilities. In 2025 we added:

Guest mode on iOS

This popular feature for Android is now available for iPhones. Just install the app and tap the Continue as guest button to defeat censorship and protect your privacy online.

More free server locations

We’ve expanded our selection of free server locations to 10 countries. You can now connect to free servers for the Netherlands, Japan, Romania, Poland, Norway, Switzerland, Singapore, Mexico, Canada, and the United States.

More server locations

We’ve also expanded the total number of server locations you can connect to with a paid Proton VPN plan. You can now defeat government efforts to censor international connections and access local content by connecting to 17,000+ VPN servers for 127 countries. Locations added in 2025 include Panama, Armenia, Mongolia, Laos, Brunei, Cuba, Dominican Republic, Cameroon, Guatemala, and Honduras.

More ways to buy Proton VPN

In addition to our long-standing support for direct payments via cash and Bitcoin, it is now possible to purchase paid Proton VPN plans using Monero, Litecoin, Ethereum, and more via partners.

Whatever 2026 brings, Proton VPN is ready

The trends that emerged in 2025 show no sign of slowing in 2026. Governments around the world are increasingly willing to restrict internet access as a first response to political pressure, civil unrest, or regulatory ambition. In authoritarian states, this has meant more frequent and more severe shutdowns, even at significant economic cost.

In democracies, the threat is subtler but no less real. Poorly designed laws, blunt enforcement tools, and private-sector compliance mechanisms are fragmenting access to the open internet in ways that were once considered unthinkable.

At the same time, 2025 made one thing clear: people adapt quickly. Whether facing total blackouts, social media bans, mandatory ID checks, or indiscriminate blocking of infrastructure providers, millions turned to Proton VPN not to break the law, but to stay informed, communicate freely, and access the services they rely on.

The growing number of large signup spikes in democratic countries suggests that circumvention tools are no longer used only at the margins of society. They are becoming a mainstream response to overreach, censorship, and loss of trust in how online access is governed.

As we move into 2026, the struggle over internet freedom is likely to intensify. More governments will test the limits of control, and more people will look for ways around it. Proton VPN will continue to invest in free access, stronger anti-censorship technology, and wider global availability, so that wherever restrictions appear, people have a reliable way to stay connected to the open internet. For example, we’re currently working on:

A new VPN codebase: Will deliver best-in-class anti-censorship capabilities, enable Stealth support on Linux, power the next generation of Stealth, and lay the groundwork for post-quantum encryption.
An improved Linux CLI: Our Linux command-line tool allows anyone to access the open internet using only the most basic hardware. We recently added a host of advanced configuration options, and will expand on these through 2026.

As we head into 2026, the 2025 data underscores a powerful truth: whenever censorship tightens its grip, from internet shutdowns to app blocks, people fight back by turning to VPNs in unprecedented numbers to protect their voices and access uncensored information. We remain deeply committed to this battle; our team will keep working tirelessly to innovate, roll out new anti-censorship features, and strengthen our tools so that users worldwide can defeat restrictions and reclaim their online freedom. Thanks to Proton VPN community, we will ensure privacy and an open internet prevail. — David Peterson.

Whatever challenges 2026 brings, the message from 2025 is clear: when internet access is threatened, people push back. And Proton VPN will be there to support them.

Is your iPhone tracking you? How to check iPhone location history

Douglas Crawford — Tue, 10 Mar 2026 11:28:48 GMT

Your iPhone has a feature called Significant Locations, which is designed to help Siri and Maps learn your routines so they can provide better, more personalized suggestions. For example, to remind you to leave for work when traffic is bad, or to suggest a restaurant near your gym.

Although Significant Locations does keep a surprisingly detailed log of where you’ve been, when, and how often, Apple has gone to admirable lengths to minimize its threat to your privacy.

Arguably, a bigger threat comes from third-party apps like the almost ubiquitous Google Maps, which have detailed access to your location history and are much less picky about who they share it with.

What is Significant Locations and how does it work?

Significant Locations is an iPhone feature that keeps a record of places you visit often to personalize services like maps, photos, and suggestions. Unlike Google Maps, Significant Locations is not a full GPS history log. Instead, it collects periodic location signals using geolocation indicators such as GPS, WiFi, cell tower, and Bluetooth connections. Over time, it detects patterns such as:

How often you visit a location
How long you stay of there
How recently you last visited

Once it identifies these patterns, it stores the locations locally on your device. So a coffee shop you visit daily will be stored, but not a one-time road trip.

This information is used by Maps to predict routing due to traffic, make location-based suggestions in Calendar, group Memories in Photos, create location-based alerts and Siri suggestions, and more.

How secure is Significant Locations?

Significant Locations data is stored locally on your device. The feature is enabled by default but only works if Location Services are turned on and your phone is secured using a passcode or biometric lock.

If Sync to iCloud is enabled, your data will also be stored on Apple servers. However, Apple says that Significant Locations data is end-to-end encrypted (E2EE), with the encryption keys derived from your device passcode.

This means your Significant Locations data is not accessible to Apple, even if it’s synced to iCloud and Advanced Data Protection (optional E2EE for iCloud) is not enabled. Metadata may still exist, however, and since iOS is closed-source, we just have to take Apple’s word on this.

Anyone with physical access to your unlocked phone can view your Significant Locations. Depending on your recovery methods, anyone with full control of your Apple ID and one of your trusted devices can access that data too.

How to check your iPhone location history (Significant Locations data)

On your iPhone or iPad, open the Settings app and go to Privacy & Security → Location Services → System services → Significant Locations & Routes. From here, you can view your Significant Locations records.

How to delete your iPhone location history (Significant Locations)

1. On your iPhone or iPad, open the Settings app.

Go to Privacy & Security → Location Services → System services → Significant Locations & Routes.
Toggle the Significant Locations & Routes switch off.

Beware location tracking by apps

Many of the apps you install on iOS can track your location, but they must go through a permission system and the system location APIs controlled by Apple. These limit the amount of direct geolocation data that an app can access, but apps can use a number of indirect methods.

How iOS handles location permissions

Apple’s iOS uses a permission-based model that requires your explicit consent before any app can access your location data. When an app requests location access, you are presented with several options:

Allow Once: Grants access for a single session.
Allow While Using App: The app can access location only when it is actively open or in the foreground.
Allow Always: The app can access location even in the background (requires justification).
Don’t Allow: Denies access entirely.

Crucially, for Allow Always permissions, iOS requires the app developer to provide a reason for background access. You’ll also occasionally be reminded of this permission by a system prompt asking if you want to keep it enabled.

When the app is actively accessing your location data, you’ll see a blue location indicator icon in your notification bar (a gray icon indicates that your location was recently accessed by an app).

To see how often an app has accessed your location data, you can view its App Privacy Report if you’ve turned this feature on. To do this:

Open the Settings app.
Go to Privacy & Security → App Privacy Report (under Transparency Logs).
Tap Turn On App Privacy Report.

Once enabled, go to App Privacy Report whenever you want to check how often apps access your location and other sensitive data.

Approximate vs precise location on iPhone

By default, apps that request location permissions use your Precise Location. This uses various sensors on your iPhone to accurately locate you within a few meters. However, since iOS 14, you can disable Precise Location for each app that requests it, forcing them to use your approximate location instead (to roughly within a few kilometers).

To disable Precise Location, tap Precise: On when an app first asks for location permissions (see screenshot above). Or open the Settings app, go to Privacy & Security → Location Services, select the app, and toggle the Precise Location switch off. You can also change when an app can request location data from this screen.

Geofencing

Apps register geofences using Apple’s location APIs. When a user enters or leaves these areas, the app can trigger actions. This is often used for reminders or location-based services such as retail apps triggering store notifications, and smart-home apps triggering automations.

Geofencing lets apps collect some background location data, even when restricted to Allow While Using App permissions. The only way to prevent it is to Never allow location access for the app.

Passive location inference

Even without explicit GPS access, apps may infer your location using things like your IP address, nearby WiFi networks, Bluetooth beacons, and metadata from photos. Although these techniques typically provide less precise location data than full GPS access, they can still reveal your location to around the city or even neighborhood level.

And once apps have this information, they can use it themselves to target you with personalized ads and/or sell it to data brokers and analytics platforms.

Your best defense against such techniques is to use a VPN to hide your real IP address, and DNS filtering (such as Proton VPN’s NetShield Ad-blocker feature) to block tracker scripts.

Individual apps and services may also offer their own ways to view and delete location history they’ve collected about you. For example, you can delete Google Maps search history or turn off Instagram location sharing using in-app settings.

Final thoughts on iPhone location tracking

Apple’s Significant Locations feature shows how location history can be used in a relatively privacy-conscious way. Its data is stored locally (or end-to-end encrypted if synced with iCloud), and it is designed primarily to improve useful built-in services like Siri and Maps, rather than to build a detailed profile of your movements for advertising purposes. However, Significant Locations can still provide a surprisingly detailed record of places you visit regularly, so checking and clearing its data from time to time may be a sensible precaution.

In practice, the bigger privacy risk often comes from the apps you install. Many third-party apps request location access and may collect, store, and share that information with advertisers, analytics companies, or data brokers. Even when iOS limits direct GPS access, apps can sometimes infer your location through other signals.

The best way to stay in control of your location data is to regularly review your location permissions, disable Precise Location for apps that don’t truly need it, and remove access entirely where possible. Combined with tools like VPNs and tracker blocking, these steps can help reduce how much of your movement history ends up in the hands of companies you didn’t intend to share it with.

Less than half of SMBs use a VPN. Here’s what our research found.

Ben Wolford — Tue, 10 Mar 2026 10:54:54 GMT

For most small- and medium-sized businesses (SMBs), the “office” is now a collection of home WiFi networks, coffee shop hotspots, shared workspaces, and cloud-based SaaS tools.

Yet even as work continues to become more distributed, many businesses have failed to put network controls in place. Fewer than half of SMBs use a VPN to protect access to their network, according to new research by Proton.

At the same time, security incidents are rising. One in four SMBs have experienced a cyberattack or breach in the past year.

So why, despite a seemingly permanent shift to hybrid work, is VPN adoption so inconsistent? And is that the cause of so many recent security incidents?

Our SMB Cybersecurity Report 2026 sheds light on this question. For our exclusive research, we surveyed thousands of business leaders around the world dozens of questions about their security practices. You can download the free cybersecurity report to gain four key insights and five recommendations for your business.

Download the free report

Why attackers are targeting SMBs

For years, cybercriminals focused primarily on large corporations. But as enterprise defenses have improved, attackers have increasingly targeted SMBs due to:

Limited resources: Small teams often lack dedicated security staff and formal security policies.

Distributed networks: Employees connect from home WiFi, shared workspaces, and public hotspots, creating more entry points for attackers.

High-value data: SMBs might store the same sensitive data as large enterprises — including customer information, financial records, and intellectual property — but with fewer protections in place.

The adoption gap: SMBs are neglecting VPNs

The Proton SMB Cybersecurity Report 2026 exposed two gaps among small and medium businesses:

Adoption gap: Less than half of SMBs use a VPN to secure their endpoints.
Execution gap: Even among VPN adopters, security practices are inconsistent.

Let’s start with the adoption gap.

The rise of software-as-a-service has created a false sense of security among small businesses. While most SaaS platforms use strong encryption (i.e., TLS) to protect traffic in transit, and some like Proton Mail or Proton Drive also use end-to-end encryption at rest, they don’t secure the path your employees take to log in.

For example, your organization might use an encrypted email service to protect the content of your messages, but without a VPN you can’t enforce IP-based restrictions to control who can log in to the platform. So an attacker with a set of leaked credentials could log in and breach your network.

While the shift to hybrid work is global, the accompanying security adaptations have been uneven. The United States is the only country in our study where a majority of SMBs use a VPN. In every other market, adoption sits below 50%. This gap is even more pronounced outside the tech sector, where security hasn’t kept pace with the shift to hybrid work.

The execution gap: True security goes beyond a VPN

Fifty-two percent of VPN-using SMBs say they are very or completely confident in their ability to withstand attacks. But our data shows that even among this group, 26% experienced a breach in the past 12 months. If a business is already securing its network, how is this still happening?

The issue is not the VPN itself, but the surrounding controls and the prevalence of human error. Only 56% of VPN adopters in our study enforce two-factor authentication (2FA). When nearly half of businesses rely on passwords alone, the risk is compounded by poor credential discipline. Instead of consistently using a business password manager:

31.5% still share credentials via email
33.4% via shared documents
28% rely on messaging apps to share logins
24.6% still write passwords down

Our data suggests that many businesses are treating security as a piecemeal investment in isolated products rather than a cohesive system, without consistently executed security policies in place.

Security as infrastructure, not afterthought

The study revealed another valuable insight: Security is a revenue driver.

In our report, 66% of businesses say demonstrating secure data handling is “very” or “critically” important to winning new business. A VPN for endpoint security gives you the infrastructure and visibility to make that case to prospective clients.

Without a defined network perimeter, entry points multiply, visibility diminishes, and access control is scattered across third-party platforms. All this expands the attack surface and makes it harder to detect suspicious behavior, contain incidents, or demonstrate control to customers and partners. A VPN restores the boundary, and establishes a controllable perimeter around employees wherever they work.

Here’s how you can apply the lesson in your business:

Restrict access by IP or location: Only allow access to internal tools from approved devices or networks.
Have full network visibility: When logins are only allowed from your VPN, you can monitor traffic to your resources and spot potential attacks.
Enforce consistent policies: Apply security rules on your network, rather than relying on third-party promises.

Without a VPN, remote traffic moves across public networks without centralized control, increasing exposure. True security requires the network layer and the identity layer to operate as a single, reinforced system.

Download the full 2026 SMB Cybersecurity Report

Proton’s SMB Cybersecurity Report 2026 examines where security confidence breaks down, why foundational controls are missing, and how hybrid work has reshaped the attack surface for growing businesses.

Inside the report, you’ll find:

Global breach patterns and human-error trends
The financial impact of modern data breaches
Cloud and AI trust gaps among business leaders
Practical steps for building layered security systems

Download the free report

What is a CDN and how does it work?

Douglas Crawford — Fri, 06 Mar 2026 12:23:20 GMT

A content delivery network (CDN) is a geographically distributed network of servers that work together to deliver internet content faster and more reliably. Instead of all users accessing content from a single origin server, CDNs cache copies of static assets like images, videos, stylesheets, and JavaScript files on servers located closer to users around the globe.

Think of it like a retail chain. Instead of everyone traveling to one massive warehouse headquarters to buy products, there are local stores in every city stocked with popular items. You get what you need faster, and the central warehouse handles less traffic.

Some 46 million websites use CDNs worldwide, including around 81% of the top 1 million websites. Major CDN providers include Akamai Technologies and the almost ubiquitous Cloudflare (over 24 million websites use Cloudflare alone).

Why do CDNs exist?
What are the benefits of CDNs?
How do CDNs work?
CDNs and the dangers of overblocking

Why do CDNs exist?

Traditionally, websites were hosted on a single server in one physical location. Which works fine if all your visitors live near that server. But once users are spread across countries (or continents), problems appear:

Latency (slow loading times due to physical distance)
Bandwidth bottlenecks
Server overload during traffic spikes
Higher vulnerability to DDoS attacks

CDNs solve this by distributing content across many servers worldwide. This means if you’re in New York, you’ll get content from a US-based sever, while visitors from London to the same website will get be served content from a European sever.

What are the benefits of CDNs?

CDNs improve:

Speed: Content travels a shorter physical distance
Scalability: Traffic spikes (e.g., during sales or viral events) don’t crash the site
Uptime: If one server fails, another takes over
Security: Most CDNs help protect against DDoS attacks

How do CDNs work?

A CDN consists of:

An origin server. This is the “main” server where the website actually lives.
Edge servers that store (“cache”) static content like images, CSS files, JavaScript, and videos from the origin server. Large CDNs (like Cloudflare) may run hundreds of these distributed edge servers all over the world.

When you visit a website that uses a CDN, the process works as follows:

User request: When you visit a website, your browser sends a request for content.
DNS resolution: The CDN’s DNS system determines which server is best positioned to serve you. Typically, this will be the one closest to you.
Cache check: The edge server checks if it has the requested content cached.
Delivery: If cached, the content is delivered immediately. If not, the edge server fetches it from the origin server, caches a copy for future requests, and delivers it to you.
Dynamic content: For dynamic content (like personalized pages), CDNs can route requests to the origin server while still optimizing the connection path.

Crucially, all websites that use the same CDN will route their content though the CDN’s shared edge servers. This means hundreds of otherwise unrelated websites serving a similar geographic area may share the IP address of a CDN edge server for that area.

CDNs and the dangers of overblocking

To combat illegal streaming of its football matches, top Spanish football association LaLiga has obtained court orders requiring Spanish internet service providers to block thousands of IP addresses belonging to CDN provider Cloudflare. This is because it has connected these IP addresses to illegal streaming services.

The problem is these IP addresses belong to Cloudflare’s edge servers, which are also used by thousands (potentially millions) of legitimate websites. This has left millions of people in Spain unable to reliably access some popular sites, including GitHub, ChatGPT, government websites, and banking services.

Final thoughts on CDNs

Content delivery networks are now essential infrastructure for today’s web, quietly powering the fast, reliable online experience that you’ve come to expect. By distributing content across geographically dispersed edge servers, CDNs reduce latency, absorb traffic spikes, improve uptime, and add critical layers of security.

Much of their utility lies in their invisibility. Although used by over three-quarters of all websites on the internet, most of us never even think about them. But they’re there, working behind the scenes on roughly three-quarters of today’s websites, ensuring that content arrives quickly and reliably regardless of geography.

Recent situations where governments, courts and corporate interests have blocked internet services inevitably do significant collateral damage to the wider internet.

Surveillance pricing: How your data determines what you pay

Douglas Crawford — Wed, 04 Mar 2026 15:34:51 GMT

Surveillance pricing, also known as personalized or algorithmic pricing, is a practice where companies use your personal data, such as your location, the device you’re using, your browsing history, and even your income, to determine what price to show you. It’s not just about supply and demand — it’s about you as a consumer and how much the system thinks you’re able (or willing) to pay.

Have you ever shopped online for a flight, only to find that the price mysteriously increased the second time you checked? Or have you and a friend searched for the same hotel room on your phones, only to find your friend sees a lower price? This isn’t a glitch — it’s surveillance pricing at work.

In the United States, surveillance pricing is becoming increasingly prevalent across various industries, including airlines, hotels, and e-commerce platforms. It exists elsewhere, but in other parts of the world, such as the European Union, there is a growing recognition of the danger this pricing model presents to citizens’ privacy, resulting in stricter data protection laws aimed at curbing it. The US appears to be moving in the opposite direction.

In this article we’ll look at:

What is surveillance pricing?
How does surveillance pricing work?
Which companies use surveillance pricing?
Is surveillance pricing legal in the US?
Surveillance pricing around the world
How to avoid surveillance pricing
A deeply unfair practice

What is surveillance pricing?

At its core, surveillance pricing is the practice of adjusting prices based on the personal data collected from an individual. Unlike traditional dynamic pricing, which changes prices based on time, demand, or supply, surveillance pricing uses who you are and how you behave online to determine the price you see.

Companies gather data from a wide range of sources to build a profile of each customer. This data can include:

Your location: Are you shopping from a wealthy ZIP/postal code (which can also lead to racial discrimination)?
Device type: Are you using an iPhone or an older Android?
Browsing history: Have you looked at this item multiple times?
Purchase behavior: Are you a repeat buyer? Do you often choose premium options?
Login status: Have you signed in to a loyalty program or rewards account?

These details feed into algorithms that can predict your price sensitivity — essentially, how much they think you’re willing to pay. If the system believes you’re less likely to comparison shop or more likely to pay full price, it might show you a higher price than someone else sees for the same product or service.

What makes surveillance pricing controversial isn’t just the price difference — it’s that you usually don’t know it’s happening. There’s rarely any disclosure or obvious way to compare your price with what others see. This lack of transparency makes surveillance pricing fundamentally different from things like coupons, sales, or even “traditional” dynamic pricing.

How does surveillance pricing work?

The goal of surveillance pricing is to find the maximum price you’ll tolerate before walking away. This is a concept known in economics as first-degree price discrimination. It uses advanced data analytics and algorithms to dynamically adjust prices based on your individual data. It uses your data to profile you and adjusts the prices you see in real time based on this profile.

Surveillance pricing is only possible if the merchant has your data. This is gathered via multiple channels, including:

Cookies and device and browser fingerprinting
Mobile apps that access location or device data
Loyalty cards and programs that log your past purchases
Social media activity
Search behavior (especially when you’re logged into accounts). For example, if you sign in to Amazon and browse a particular product multiple times without buying, Amazon might infer high interest and raise the price slightly the next time you look for it.

Which companies use surveillance pricing?

The following examples show how companies leverage your personal data to adjust pricing dynamically:

Target agreed to pay $5 million in civil penalties after its app was found to increase prices for people based on their location. For example, it charged $100 more for TVs if someone was in the Target parking lot because the closer they were to the store, the more likely they were to pay.
Amazon’s pricing algorithms change its prices over 2.5 million times a day based on various factors, including demand and user behavior.
Staples charged customers different prices on its website based on estimations about their location — charging people more when they were in areas with fewer competitors
Uber has admitted other effects that “land-use/neighborhood patterns, trip purposes, time of day, and other effects” go into pricing, while Lyft said, “there are many factors that go into pricing time of day, trip purposes, and more”. Uber has been accused of increasing fares for users with low battery on their phones on the assumption they will pay more.
The travel booking site Orbitz directed Mac users toward more expensive hotel options based on data indicating that Mac users tend to spend more on accommodation.

Is surveillance pricing legal in the US?

In the United States, surveillance pricing is widespread and largely unregulated. Unlike in the European Union, where privacy laws such as the GDPR limit how companies can use personal data, the US lacks any federal legislation that directly addresses personalized pricing practices.

This regulatory gap allows businesses to collect and exploit consumer data with minimal oversight as long as they avoid overtly deceptive or discriminatory practices that violate existing consumer protection or civil rights laws. In 2022, the Federal Trade Commission (FTC) announced interest in enacting new regulations to tackle the issue, and in the last days of the Biden administration, it released a report and published a blog post advocating for concrete regulatory action over surveillance pricing.

However, the Trump administration has made it clear that it has little interest in this digital protection for consumers. In response, California, Georgia, Illinois, Colorado, and New York have introduced state-level legislation to curb surveillance pricing.

Although facing stiff opposition from tech industry groups such as TechNet, these bills, particularly the California bill, may have a wide-ranging impact. Passed by the California Assembly on May 12, 2025, Assembly Bill 446 could become a national standard, similar to the California Consumer Privacy Act (CCPA21`). As the bill’s author, San Diego Assemblyman Christopher Ward, noted:

“I believe that [surveillance pricing] is predatory, it’s discriminatory, and it violates a public trust when consumers are already stretched thin and don’t deserve to be unwittingly exploited”.

Surveillance pricing around the world

Although largely unregulated in the US, other countries have taken a more muscular approach to protecting consumer data and limiting how it can be used for algorithmic pricing. `

European Union

The EU’s General Data Protection Regulation (GDPR) is among the strictest privacy laws in the world. It doesn’t directly ban personalized pricing, but it places serious limits on how companies can collect and use personal data, especially for automated decision-making. Key GDPR protections relevant to surveillance pricing include:

Right to be informed: Companies must be transparent about what data they collect and how it’s used.
Right to object: Consumers can object to profiling and automated decision-making.
Explicit consent: Companies must often obtain clear consent before using personal data for pricing decisions.

In practice, European companies are more cautious about using surveillance pricing — especially when tied to sensitive characteristics like race, income, or location. Following official guidance, they must include clear disclaimers when offering dynamic or algorithmic pricing or use standardized pricing.

United Kingdom

While no longer part of the EU, the UK GDPR remains broadly aligned with the GDPR. The Competition and Markets Authority (CMA) has also expressed concern about algorithmic harms, including discriminatory pricing, and has promised to work with the ICO and Ofcom to help address these concerns.

Canada

Canada’s Consumer Privacy Protection Act (CPPA), part of its proposed Digital Charter, aims to improve transparency and give consumers more control over their data. While it’s still in development, this reflects a growing awareness of how behavioral targeting (including pricing) is bad for consumers.

More generally, across the globe, there’s a growing trend toward algorithmic accountability, consumer education on digital pricing, and creating legal frameworks that limit abusive use of data. However, enforcement remains inconsistent, and the citizens of many countries remain vulnerable to opaque and exploitative surveillance pricing practices.

How to avoid surveillance pricing

It’s difficult to detect or avoid surveillance pricing entirely, especially if you use mobile apps that can access a huge amount of your personal data. However, there are some things you can do to reduce how much companies know about you.

1. Use a browser, not an app

Mobile apps typically collect a huge amount of personal data about you, which they send directly to their developers. Browsers (including mobile browsers) do not send anywhere near as much data to the websites you visit and may include privacy features such as tracking protection and fingerprinting resistance.

Learn about the best browsers for your privacy

2. Block third-party cookies

Third-party cookies are small text files stored on your browser that exist almost entirely to track your behavior across different websites. Blocking them in your browser deprives companies of some of the data they use for surveillance pricing.

Learn how to block third-party cookies on all browsers

3. Use a VPN

A VPN hides the single most revealing thing about you to app developers and websites — your IP address. It also stops your ISP from knowing what you do online and selling that data to companies that use surveillance pricing. With a paid Proton VPN account, our NetShield Ad-blocker DNS filtering feature will protect you against a range of tracker scripts.

Get Proton VPN Plus

4. Compare prices across devices and browsers

When researching goods and services, try to perform multiple searches on different devices and browsers to see if there is any change in price.

Final thoughts: A deeply unfair practice

Surveillance pricing is not science fiction. It’s here and embedded in the everyday experiences of online shopping, ride-hailing, and even education services. By quietly collecting and analyzing vast amounts of consumer data, companies can invisibly adjust prices based on who you are, where you are, what device you use, and how likely you are to pay.

Companies often claim this practice is nothing more than harmless personalization. But it furthers discrimination, exploitation, and inequity, especially when pricing is influenced by sensitive traits like race, income level, or where you live.

Ultimately, only legislators have the power necessary to reign in the rampant abuses of surveillance pricing. That’s why it’s unfortunate the FTC has abandoned its work on surveillance pricing, leaving it to individual states to pick up the pieces. Consumers elsewhere may be luckier.

That said, by avoiding apps and using a VPN, you can help limit the data companies collect to profile you for surveillance pricing.