Is ExpressVPN safe to use?

ExpressVPN integrates 51 third-party SDKs spanning infrastructure, analytics, and authentication. It collects data linked to your identity including Contact Info and Identifiers. It includes 1 advertising or attribution SDK. Whether this is acceptable depends on your personal privacy preferences.

What permissions does ExpressVPN need?

ExpressVPN requests 4 iOS permissions: Camera, Microphone, Photo Library, and Face ID.

What data does ExpressVPN collect?

According to its App Store privacy label, ExpressVPN collects data linked to your identity including Contact Info and Identifiers. It collects Usage Data and Diagnostics not linked to your identity.

How many SDKs does ExpressVPN have?

ExpressVPN integrates 51 third-party SDKs. 1 for attribution, 5 for analytics, 1 for crash reporting, 10 for infrastructure, and 33 for other.

Does ExpressVPN use Google SDKs?

Yes. ExpressVPN includes 9 Google or Firebase SDKs: Firebase Core, Firebase Remote Config Interop, Firebase Sessions, Google Data Transport, Firebase Crashlytics, Firebase Core Extension, Firebase Core Internal, Firebase Installations, and Google Utilities. These are used for cloud infrastructure and services, not advertising.

Does ExpressVPN access your camera or microphone?

ExpressVPN requests access to both your camera and microphone. The developer says camera access is for "To scan the QR code, allow ExpressVPN access to your camera". Microphone access is for "ExpressVPN needs access to your microphone so you can attach voice notes to your bug reports". These permissions are only active when you grant them in iOS Settings.

Does ExpressVPN run in the background?

Yes. ExpressVPN registers 4 background modes, which means it can perform certain tasks when you're not actively using it.

What are some alternatives to ExpressVPN?

Other utilities apps include 1.1.1.1 , InstaWrite AI , AI Identifier , ExtraSpace , Authenticator , and Authenticator . Each app takes a different approach to utilities and varies in its data collection and SDK usage.

Utilities · Privacy report

ExpressVPN · Secure & Fast VPN

Free · ★4.7 · Express VPN

Is ExpressVPN safe?

Not for an app that sees everything you do online.

Our take. A VPN carries all of your traffic, yet ExpressVPN is built with more third-party tracking code than 67% of the vpns we have scanned, including an analytics SDK from Israel. We would not trust it with anything private.

Privacy footprint · vs 33 vpnsModerate

Trackers from other companies6 · some

typical vpns: 3

Data the app links to you2 types · little

typical vpns: 0 · from its own privacy label

What it collects about you

ExpressVPN links 2 categories of your data to you.

From the developer's own App Store privacy label. These are the kinds of data ExpressVPN ties to your identity.

Contact InfoIdentifiers

Who else is inside

It carries trackers from 3 companies.

Third-party SDKs found in the app, matched to the company that publishes each. Present in the code; we do not observe what they transmit.

🇺🇸GoogleAnalytics

Firebase, AdMob and Google analytics SDKs, built to record how you use the app and serve ads.

SDKs

🇮🇱AppsFlyerAttribution · Israel

Marketing attribution and audience analytics.

SDK

🏢Other third partiesanalytics

A third-party SDK.

SDK

How it compares

Where it sits among vpns.

Every one of these apps we have scanned, on the two measures above: third-party trackers it carries (across) and data it links to you on its own label (up). Toward the top right is more invasive.

Each dot is one vpn app. ExpressVPN sits to the right, carrying more third-party tracking than most.

Other signals

One more flag.

Each is a fact read straight from the app. The same checks run on every app we scan. Only the ones that apply here are shown.

It sends analytics to a company in Israel

AppsFlyer is a Israel company. Its analytics SDK is built into the app.

The evidence

What it's built from.

All 51 SDKs in the app, grouped by what they are for. 6 are third-party trackers.

1attribution

5analytics

1crash reporting

44standard libraries

6 of the 51 are third-party trackers. The rest are the app's own code and standard open-source building blocks.

Show the full SDK list

GoogleAnalytics · USA

Firebase Core · Firebase Remote Config Interop · Firebase Sessions · Google Data Transport

AppsFlyerAttribution · Israel

AppsFlyer

Other third partiesanalytics

LaunchDarkly

Standard libraries44 · on-device

The app's own code plus open-source interface, storage and networking libraries.

How we know this

Counterspy downloads the app from the App Store and statically analyzes its compiled binary. Embedded SDKs are matched against a signature database and resolved to the company that operates each. We also read the developer's App Store privacy label, which lists the data the app says it collects and links to you. We do not run the app or intercept its traffic, so we report capabilities present in the code and the developer's own disclosures, not proven transmission. We assess privacy and data collection, not malware, security flaws, or developer intent. Reports are automated and never edited for payment. Scan v12.47.0, 2026-04-03.

Third-party trackers are advertising, analytics and attribution SDKs detected by static signature matching. Presence shows a capability is compiled in, not that it ran or transmitted data.
"Data the app links to you" is the count of data categories the developer declares as Data Linked To You in its App Store privacy label. Labels are self-reported and not verified by Apple.
Comparison across the 33 vpns in our corpus. Trackers: median 3. Data linked to you: median 0.