How to Choose a VPN: A Practical Checklist That Cuts Through the Marketing

Most VPN marketing is designed to end your research early: a huge discount, a countdown timer, a promise of total anonymity. A better approach is to check a short list of verifiable things before you look at price at all. The Electronic Frontier Foundation (EFF) advises readers to verify a provider’s claims rather than accept them, to read the privacy policy for how data is monetised, and to treat hyperbolic claims about privacy or security as a warning sign in themselves. Its guide sits inside the wider explainer in this series, VPNs Explained: What a VPN Does, What It Does Not, and When You Need One. Work through the ten checks below in order. If a provider fails an early check, the later ones do not rescue it.

1. Start with your threat model

Before comparing brands, answer the EFF’s security-planning questions. Its Your Security Plan guide defines threat modelling as determining what you need to protect and from whom you need to protect it, and builds a plan from questions including: What do I want to protect? Who do I want to protect it from? How bad are the consequences if I fail, and how likely is the threat? A US reader who wants to keep browsing contents away from their internet provider needs a different service from a traveller who mainly needs to reach a home or work network safely, or a journalist whose adversary is a government. Write your answer in one sentence. Every later check is judged against it — including whether you need a VPN at all, since the EFF notes a VPN is not the most important step for many common threats.

2. Read the privacy policy for what is actually logged

Skip the homepage and open the policy. The EFF warns that a company might log your data if its policy does not specifically rule it out, and that even a specific “no-logs” claim is not a guarantee of good behaviour. Look for a policy that names categories: traffic, DNS requests, connection timestamps, IP addresses, bandwidth. For a worked example of the level of detail to expect, Mullvad’s no-logging policy states that it logs none of those categories in connection with account activity, and separately lists the limited account and payment data it does store, including how long some payment identifiers are kept before deletion. If a policy is vague, marketing-led, or impossible to find, treat that as the answer.

3. Look for independent audits — and their dates

The EFF explains that providers can subject their service to third-party security audits with public results, and that this transparency can reveal otherwise unknown vulnerabilities in apps, data access and infrastructure. It is a sign a provider takes security seriously. Apply three tests to any audit claim. Is the auditor named, and independent of the provider? Is the full report, or at least a detailed summary, public rather than a badge on a sales page? And what is the date and scope — which apps, servers or systems were covered? Then keep the EFF’s limit in mind: there is no certainty that practices are not changed after the audit, especially if a government compels a change. An old audit of one app is weak evidence about today’s servers. A recent, named, scoped audit is stronger. No audit at all leaves you with only the provider’s word.

4. Check jurisdiction and who owns the company

The EFF tells readers to note the countries in which a provider does business, because the provider is subject to those countries’ laws, including laws governing government requests for information — and possibly to legal requests from countries that have legal-assistance treaties with them. Separately, check ownership transparency. The EFF suggests searching for the people and organisations behind a service, looking for an about page that lists founders or employees, and being sceptical of a service no one will stake a reputation on. As a transparency example, Mullvad states in its FAQ that the service is operated by Mullvad VPN AB, a subsidiary of Amagicom AB, both fully owned by its two named founders. You may still choose a provider elsewhere — but you should be able to find out where “elsewhere” is, and whose name is on it, in a few minutes.

5. Require open-source apps and modern protocols

You cannot inspect a closed app’s claims, so prefer providers that publish their app code. In Mullvad’s case, its FAQ states the app is free software with source code under the GPL-3 licence, with a noted exception for the iOS app as distributed through Apple’s App Store. Then check the protocols on offer. The EFF advises checking that a VPN uses OpenVPN or WireGuard, and warns against broken encryption such as the Point-to-Point Tunneling Protocol (PPTP). Our companion guide, VPN Protocols Explained: WireGuard, OpenVPN and IKEv2 in Plain English, explains what each protocol does inside the tunnel. If a provider cannot name its protocols, or leads with a secret proprietary protocol it will not describe, move on.

6. Test the kill switch and auto-connect behaviour

A kill switch blocks your traffic if the tunnel drops, so your real connection is not exposed in the gap. Check whether it exists, whether it is on by default, and whether the app reconnects automatically. Mullvad’s FAQ gives a clear benchmark for honest documentation: its app has a built-in kill switch that is enabled by default and cannot be disabled, and if the connection breaks, all internet traffic is automatically blocked until the connection is re-established or you disconnect or quit the app. Whatever provider you choose, run the simple test yourself after installing: connect, then force a drop by switching networks, and confirm that pages stop loading instead of loading over your normal connection.

7. Size the network and speed to your actual use

A bigger server map is not automatically better. What matters is whether there are well-kept servers near the places you actually connect from, and whether the provider limits speed or data. Mullvad’s FAQ, for example, states plainly that it does not limit speed, bandwidth or data volume — the kind of direct answer to look for in any provider’s documentation. Test during a short paid month rather than a long discounted term, with your normal apps at your normal times of day. If performance is poor, a cheap three-year plan is still a bad purchase.

8. Apply a price-model sanity check

Pricing structure tells you about the business. The EFF asks the basic question: if a service is not selling the product, how does it stay afloat? Apply the same scepticism to paid marketing. A service permanently discounted by a huge percentage, or sold as a “lifetime” deal for a one-off fee, still has servers and staff to pay for every month — ask what sustains it. The clearest counter-example is deliberately boring pricing. Mullvad’s pricing page charges one flat rate of €5 per month whether you buy one month, one year or one decade, says the price has not changed since the service launched in 2009, and states that it never runs sales. You do not have to choose that provider. You should prefer that kind of arithmetic: a price you can understand, that does not pressure you into a long commitment to “save” money.

9. Check payment options, including cash

How you pay affects how much the provider can know about you. The EFF notes that most commercial VPNs require a credit card, which can be linked to your identity, and suggests gift cards or temporary card numbers if you want to keep card details from the provider — while warning that the provider may still collect your IP address. For readers who take this seriously, Mullvad documents the strongest version of the option: its pricing page confirms it accepts cash, and explains that you put cash and a randomly generated payment token in an envelope and send it in. Its accounts also need no email address or username — only a generated account number. Most readers will pay by card for convenience, and that is a reasonable trade-off. The check is whether the provider is honest about what each payment method reveals.

10. Avoid list: walk away from these

Skip a service if you cannot identify the company behind it, if its store listing asks for permissions that have nothing to do with running a VPN, or if its marketing promises anonymity, total protection or impossibility claims — the EFF treats hyperbolic claims as a trust warning, and notes that an app’s presence in an official store is not proof it is safe, since listed apps can still collect and share data. Apply the same scepticism to the myths in this series: our guide to 7 VPN Myths That Could Leave You Exposed shows how those slogans break down. And if you are new to using a VPN day to day, pair this checklist with How to Use a VPN: A Step-by-Step Guide for Every Device once you have chosen.

The 5-minute decision walkthrough

Minute one: write your one-sentence threat model. Minute two: open the logging policy and find the list of what is and is not kept; close the tab if there is no specific list. Minute three: find the company’s legal name, country and owners, and search for a named, dated audit. Minute four: confirm the app offers WireGuard or OpenVPN, has a kill switch on by default, and is open source or independently reviewed. Minute five: check the undiscounted monthly price and payment options, and buy the shortest term available. Five minutes will not make a provider trustworthy — but it reliably filters out the ones that cannot answer basic questions.

What this means

For a US reader, this checklist matters because the American VPN market is largely a marketing market. There is no general requirement that a provider’s “no-logs” or “anonymous” claim be true when it is printed on a sales page, so the burden of checking falls on you — and the checks that work are the documentary ones: a specific policy, a named company in a named country, a dated audit, a readable price. Compare two offers side by side and the difference is usually visible in minutes. One leads with a crossed-out price and a promise of invisibility, and its logging policy, ownership and audit history are hard to find. The other states a flat price, lists exactly what it does not log and what little it stores, names its owners, and documents features such as a kill switch that cannot be switched off. Neither page proves how servers behave today. But only one of them is even trying to be checked, and that willingness to be checked is the most reliable signal available to a non-technical buyer.

It also changes how much you should pay, and for how long. A long, deeply discounted plan concentrates your risk: if the provider is sold, changes its policy or degrades its network, you have prepaid for the change. A short term at an honest monthly price keeps your exit cheap, which is itself a privacy feature — you can leave when the facts change. Finally, remember the comparison that frames the whole purchase. You are replacing your ISP’s view of your browsing with the VPN provider’s view. The FTC has documented how extensively US ISPs collect and share customer data, which is a real reason to make that swap. This checklist exists to make sure the company you swap to has earned the position — with documents you have read, not adjectives you have been shown.

Bottom line

Buy documents, not promises: a specific logging policy, a named company in a named country, a dated independent audit and a readable price. If a provider leads with a countdown timer instead of those, that is your answer.

Read Next

• VPNs Explained: What a VPN Does, What It Does Not, and When You Need One
• VPN Protocols Explained: WireGuard, OpenVPN and IKEv2 in Plain English

Sources

• Electronic Frontier Foundation, Surveillance Self-Defense, “Choosing the VPN That’s Right for You” — https://ssd.eff.org/ps/module/vpn (accessed 7 November 2026)
• Electronic Frontier Foundation, Surveillance Self-Defense, “Your Security Plan” — http://ssd.eff.org/en/module/your-security-plan (accessed 7 November 2026)
• Mullvad VPN, “Pricing” and “No-logging of user activity policy” — https://mullvad.net/en/pricing and https://mullvad.net/en/help/no-logging-data-policy (accessed 7 November 2026)
• Mullvad VPN, “FAQ” — https://mullvad.net/en/help/faq (accessed 7 November 2026)