Keep Factually independent
Whether you agree or disagree with our analysis, these conversations matter for democracy. We don't take money from political groups - even a $5 donation helps us keep it that way.
Which VPN providers have proven court cases where they refused or could not comply with government subpoenas?
Executive summary
Court records and reporting show a small set of major VPNs have been legally tested by subpoenas or warrants, and some—most notably Private Internet Access (PIA)—could not produce user browsing logs in specific criminal cases because they said they had no logs to give [1] [2] [3]. Reporting and audits also show other providers have at times produced data or changed policies under legal pressure, so the landscape mixes verified “could not comply because there were no logs” examples with cases where providers did or later said they would comply [1] [4] [5].
1. Proven courtroom tests: PIA’s subpoenaed cases
Private Internet Access is the most-often-cited example where U.S. court materials and news coverage say subpoenas returned no usable usage logs from the provider. TechSpot, TorrentFreak and longer-form reporting cite a 2016 FBI subpoena tied to bomb-threat allegations and a separate 2018 subpoena tied to a hacking case; in both instances PIA reportedly could not provide identifying usage logs because it claimed not to retain them [1] [2] [3]. These court-adjacent incidents are presented in multiple outlets as real‑world tests of a no‑logs promise [1] [2].
2. Not universal: instances of cooperation or logging
Other providers have a different record. Reporting documents that some U.S.-based VPNs have cooperated with law enforcement in the past—IPVanish is cited as having provided logs to the FBI in 2018—and companies have been forced or chosen to comply with lawful requests depending on jurisdiction, policy and what data they actually hold [5] [4]. PCMag warns that many VPNs “do accept and can comply with law enforcement information requests to varying degrees,” underscoring that not all no‑logs claims are tested the same way in court [4].
3. What “could not comply” actually means in practice
When sources say a provider “could not provide” logs, the statement can mean either (a) the provider legitimately did not retain the specific data law officers sought, or (b) the provider’s infrastructure or jurisdiction prevented it from producing useful records. Reporting on PIA notes the company’s claim it had no useful logs to hand over after subpoenas; TorrentFreak’s account of the FBI complaint repeats that the only information PIA could provide was that traffic originated from an east‑coast U.S. cluster—no tying to an individual user [2] [3]. This difference matters: inability to comply can validate a no‑logs claim, but it does not on its own prove future immunity from legal orders.
4. Audits, RAM‑only servers and jurisdiction matter
Independent audits and technical architectures such as RAM‑only servers are repeatedly flagged as stronger evidence that a provider cannot retain long‑term logs; SafePaper’s 2025 audit and vendor claims about RAM‑only or “TrustedServer” tech are explicitly mentioned as criteria to judge if a provider truly has nothing to hand over under subpoena [6] [7]. Jurisdiction is also critical: companies in the U.S. can be compelled and have historically been pressured (or gagged), while firms based in privacy‑friendly jurisdictions like the BVI point to legal barriers and technical designs to argue they can’t produce logs even when ordered [7] [6].
5. Transparency reports and mixed signals
Transparency reports and blog posts from VPNs themselves provide numbers but not always full context. PCWorld highlights that major providers receive hundreds of data requests annually, and ExpressVPN’s own transparency numbers are cited as an example of high request volumes—yet what a provider can actually produce depends on its log retention policy and what the request asks for [8]. Meanwhile, companies like PIA publicly explain that they “comply” with lawful requests by handing over whatever data they have—often asserting that there is nothing to hand over if they truly don’t retain usage logs [9].
6. How to interpret claims and what reporting doesn’t show
Available sources document specific subpoena tests (e.g., PIA) and cite examples of cooperation (e.g., IPVanish), but they do not provide a comprehensive, court‑verified catalogue of every VPN and every legal request. SafePaper’s audit and recent coverage offer selection and methodology, but “proven in court” remains a narrow standard: the best evidence combines independent audits, public court records that show a provider couldn’t produce data, and transparency reporting showing consistent handling of lawful requests [6] [1] [2].
7. Practical takeaway for readers choosing a VPN
If your goal is to minimize the chance a provider can ever hand over identifiable records, prioritize providers with independent audits, RAM‑only server architectures and favorable jurisdictions—these are the factors the reporting cites as most decisive when a subpoena arrives [6] [7]. But also recognize that some well‑known providers have been successfully subpoenaed for actionable data in the past while others have been tested and said they had nothing to give; read transparency reports and court documents where available before drawing firm conclusions [1] [5] [8].