Seven things to know about our updated privacy policy
Privacy policies aren't exactly light reading. Most people will never open one, and the ones who do tend to skim for the parts that affect them. We get it. But we also think that if a company is going to ask you to trust it with your data, the least it can do is explain what's actually changing in plain English. So when we updated ours, we wrote this alongside it.
Read more: ExpressVPN’s Privacy Policy
Keeping pace with privacy law
The bulk of the changes are about keeping pace with privacy law. The U.S. has seen a wave of state-level privacy legislation over the past two years, with Virginia, Colorado, Connecticut, Texas, Oregon, and Montana all joining California in giving residents specific rights over their personal data. Our policy now reflects those rights and explains how to exercise them depending on where you live.
The UK has its own version of the story. Since Brexit, the UK has maintained its own data protection regime under the UK GDPR and the Data Protection Act 2018, and our policy now references those frameworks properly, including the Information Commissioner's Office as the supervisory authority for UK users.
A clearer policy, easier to navigate
The structure of the policy itself has also been refreshed. The categories of data we collect are now broken into eight clear sections instead of being scattered through the document. If you've ever tried to find a specific thing in a privacy policy and given up, this should help.
We've also moved cookies into a dedicated Cookie Policy that lists the specific cookies we use, grouped by purpose, so you can see exactly what's set and manage your choices through our Cookie Preferences centre. Non-essential cookies are set only with your consent where required by law, and you can change or withdraw those choices at any time.
Our list of payment processors has been refreshed to reflect the providers we currently work with, including the addition of Pay.com. And our Identity Defender product has clearer scoping language confirming what's always been true, which is that it operates under a separate privacy policy and is never linked to your VPN service data.
New detail on our own marketing
There's also new detail on how we may use advertising identifiers and hashed identifiers for our own marketing and remarketing campaigns. In short, this lets us show ExpressVPN ads to people who've already used or considered our service, on platforms they're already using. Hashing means we don't share your email in readable form, although it does allow these platforms to match it against their own users (that's how matching works). We don't sell your data, and your VPN activity isn't involved.
You can manage your marketing preferences at any time, either in the ExpressVPN mobile app under Privacy preferences, or by emailing our Data Protection Officer at dpo@expressvpn.com.
What hasn’t changed
What the update doesn't change is the core of what we do. We still don't log your browsing history. We still don't log DNS queries, traffic destinations, VPN session activity, or connection times. None of that data exists in our systems, which means none of it can be shared, subpoenaed, or sold. Our independent audit of that commitment remains the reference point, and is unchanged by this update.
Privacy commitments only matter if they're genuine, and updates to them only matter if they're explained. We've tried to do both with this update. If you have questions, you can reach out to our Data Protection Officer at dpo@expressvpn.com.
