Dozens of VPNs on Google and Apple app stores have undisclosed Chinese ownership

The Tech Transparency Project (TTP) has discovered dozens of VPN apps on Apple and Google app stores “surreptitiously owned by Chinese companies,” warning of privacy and US national security risks involved.

Despite previous reports identifying VPN apps that can compromise user privacy and safety, only a few were removed, and “more than 20 of the top 100 free VPNs in the US Apple App Store in 2024 showed evidence of Chinese ownership,” said TTP in the report.

None of these apps clearly disclosed Chinese ties, where the country’s national security laws oblige them to share user data with the Chinese government.

Virtual private network (VPN) apps promise to protect users’ identities when they browse the internet. While using VPNs, users give these apps access to particularly sensitive data, such as all web activity.

Apple’s guidelines state that VPN apps “may not sell, use, or disclose to third parties any data for any purpose,” and Chinese-linked apps clearly violate that. It’s unclear if Google has a specific policy for VPN apps, but it requires apps to be “transparent” about how they share user data.

TTPs' report details how Chinese VPN apps on the App Store hide their origin behind layers of shell companies.

“Several of the apps were linked to Qihoo 360, a Chinese cybersecurity firm that has been sanctioned by the US over its ties to China’s People’s Liberation Army,” TTP found.

TTP first reported on risky VPN apps on April 1st. Since then, Apple has removed a few of the Qihoo 360-linked apps, such as Thunder VPN, Snap VPN, and Signal Secure VPN. However, Turbo VPN and VPN Proxy Master, owned by the same users, remain available for the US users along with 11 other Chinese-owned VPN apps.

“Several of the apps were linked to Qihoo 360, a Chinese cybersecurity firm that has been sanctioned by the US over its ties to China’s People’s Liberation Army,”

TTP found.

The apps are also available on the Google Play Store: TTP found Turbo VPN, VPN Proxy Master, Snap VPN, and Signal Secure VPN, as well as seven other Chinese-owned VPNs identified in the initial report.

For example, Snap VPN for Android lists a company called Autumn Breeze Pte. Ltd. as its developer. It declares itself as incorporated in Singapore and operating independently, but TTP found that Autumn Breeze’s corporate records list a director whose name matches an individual who ran Qihoo 360's mobile security unit.

TTP argues that while all the VPN apps are listed as free in the app stores, some of them sell subscriptions, which “means Apple and Google may be profiting from these Chinese-owned VPNs when Americans pay for subscriptions or other add-ons.”

“Some of the Chinese-owned VPNs in the Google Play Store also indicate they contain advertisements. That means Google may be helping these Chinese-owned VPNs to make money off ads and profiting from the ad revenue,” the report reads.

TTP estimates that some of the apps generated millions of dollars of revenue in the US.

The largest one among the 24 apps, “X-VPN - Super VPN & Best Proxy” on the US Apple App Store, is ranked 4 in free VPN apps, and 7th in top-grossing VPN apps. It offers in-app purchases and has collected over $10 million in revenues from the US, according to the report.

Neither tech giant responded to TTP’s inquiries.