ExpressVPN: VPN Fast & Secure Security & Privacy Scorecard
Android
In-app usage patterns and behavior are shared with multiple analytics and marketing companies, including firms that specialize in ad targeting. While internet traffic is routed through the VPN tunnel, activity within the app itself is monitored by several third-party services. Users have limited control over what is collected.
Best for
Accessing geo-restricted content on public Wi-Fi
Avoid if
You want a VPN specifically to avoid being tracked
Findings
- 0 critical
- 2 high
- 8 medium
- 8 low
- 8 info
1 issue identified across security and privacy analysis.
Top security issues
- Insecure Fallback Credential Encryption Key Derived from Installation ID — key equals IV, derived from non-secret installation ID, enabling AES-CBC bit-flipping and offline token decryption
- TrustManager Accepts All Certificates When Proxy Certificate Validation Is Disabled — user-accessible UI option completely disables TLS validation including for password manager API tokens
- Braze In-App Message JavaScript Interface Exposes User Identity Modification Methods — Braze account compromise could enable identity swapping and fraudulent purchase injection via WebView JS bridge
Top privacy issues
- Analytics Consent Defaults to Opted-In on First Launch — Firebase and Mixpanel active before any consent UI is shown, collecting VPN connection events and user properties in violation of GDPR Article 7
- VPN Connection Events Create Behavioral Usage Profile — session durations, server types, and usage milestones logged to Firebase and Mixpanel, contradicting the 'no-logs' privacy guarantee central to ExpressVPN's brand
- Braze CRM Platform Initialized Unconditionally on Every App Launch — session presence data transmitted to US-based third-party CRM (sdk.iad-05.braze.com) without any user consent
Full analysis
ExpressVPN: VPN Fast & Secure
com.expressvpn.vpn | Version 12.59.0 | Analyzed 2026-04-06
Security Score: 78/100 | Privacy Score: 35/100
What This Means for You
In-app usage patterns and behavior are shared with multiple analytics and marketing companies, including firms that specialize in ad targeting. While internet traffic is routed through the VPN tunnel, activity within the app itself is monitored by several third-party services. Users have limited control over what is collected.
Recommendation: Use With Caution
Best For: Accessing geo-restricted content on public Wi-Fi
Avoid If: You want a VPN specifically to avoid being tracked
Key Findings
Data Security - 5 findings (1 high, 2 medium, 1 low, 1 info)
Network Security - 3 findings (1 medium, 1 low, 1 info)
Code Safety - 0 findings
Privacy - 8 findings (1 high, 3 medium, 2 low, 2 info)
Privacy Concerns
What Data is Collected
Device identifiers, in-app behavior, session activity, and usage patterns are collected each time the app is used. This data is used to measure how users interact with the app's features and to inform decisions about the service. Advertising-related identifiers linked to the device may also be collected and retained.
Third-Party Data Sharing
User data is shared with multiple third-party companies. Firebase Analytics and Mixpanel receive behavioral data about how users interact with the app. AppsFlyer, a marketing attribution platform, tracks how the app was discovered and installed. Braze, a customer engagement service, receives data used to send targeted communications to users. These companies may use this data alongside information gathered from other apps and services.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 78/100 |
| Privacy | 35/100 |
| Data Security | 71/100 |
| Network Security | 89/100 |
| Code Safety | 90/100 |
| Data Collection | 25/100 |
| Data Sharing | 30/100 |
| User Control | 40/100 |
Positive Security Features
- Network security scored highly, indicating the app applies strong practices when routing internet traffic through the VPN connection.
- Code safety scored highly, reflecting that the app follows sound development practices that reduce the likelihood of common security issues reaching users.
Areas for Improvement
- Activity inside the app is tracked by several analytics and marketing services, meaning the protection the VPN provides for internet traffic does not extend to user behavior within the app itself.
- A broad range of data is collected, with a low score in this area indicating more is gathered than many users would expect from a service they trust to protect their privacy.
- Options to control or limit what data is collected are restricted, leaving users with little practical ability to opt out of behavioral tracking and advertising-related data sharing.
About This Analysis
This scorecard is based on automated static analysis of the app's code and behavior. Findings reflect patterns observed in the version analyzed and may not represent all data practices across all regions or configurations.
App Details
| Field | Value |
|---|---|
| App Name | ExpressVPN: VPN Fast & Secure |
| Package | com.expressvpn.vpn |
| Version | 12.59.0 (12590040) |
| Scan Date | 2026-04-06 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #6 (current) | 48/100 |