This week, a privacy group filed a complaint with the Federal Trade Commission in the US against a popular free VPN service, Hotspot Shield. The filing cites how the service collects data and intercepts traffic and re-routes it to partner websites, which seems to be in conflict with the company’s claim to offer “complete anonymity”. Paul Bischoff, privacy advocate for the consumer privacy advice and comparison website, Comparitech.com commented below.
Paul Bischoff, Privacy Advocate at Comparitech.com:
“If the claims made in the FTC filing are indeed true, then Hotspot Shield’s privacy practices are even worse than we originally thought. Comparitech has repeatedly warned readers against Hotspot Shield among other so-called “free” VPNs. Due to a vague privacy policy, we knew something was shady but couldn’t point out exactly what it was. We already knew the service records users’ IP addresses and uses them to serve advertising cookies that track users’ behavior, a major infraction to users’ privacy and anonymity.
“The company also doesn’t operate its own private DNS servers, instead directing users to use the public Google DNS, which obviously is not private nor anonymous.
“It’s actions like these that defeat the purpose of using a VPN and give VPN companies a bad name. If Hotspot Shield is proven to engage in HTTP hijacking, we hope that the complaint filed to the FTC sets a precedent that stops other bad actors from following suit. Free VPNs are known to engage in shady practices like these. Hotspot Shield just happened to get caught.
“We recommend VPN users to pay a few dollars a month and purchase a paid VPN subscription. While Hotspot Shield has a premium tier, it’s safe to assume that most users avail of the free version. VPNs cost money to operate, grow, and maintain. As the adage goes, if you are not paying for the product, then you are the product. Free VPNs are not altruistic, and they need a way to at least pay for the overhead incurred by running the service. This is often done in conjunction with advertisers, either by forcing users onto partner sites like Hotspot Shield did, by mining their traffic for personal details that can be used to target them, and/or by injecting advertisements into users’ web browsers.
“That’s not to say that paid VPNs can’t engage in these practices, but it’s far less likely. Read privacy policies, look at the parent companies and people behind the service, and learn what makes a VPN private and secure. At Comparitech, we do the heavy lifting for readers so they can make a safe, informed decision. We never recommend a product that we wouldn’t use ourselves.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.