What does a VPN app's analytics setting actually send?
An analytics toggle covers a different data flow from the tunnel. Read the categories, identifiers and recipients before the privacy page covers it.
Your tunnel is encrypted, the privacy page talks about no-logs, and the app still ships a diagnostics library that reports which screens you open. These are different data flows with different policies. A connection log records where the tunnel went; an analytics event records how you used the app. Reading one and assuming it covers the other is exactly the mistake the setting invites.
What the toggle usually controls
Most clients separate optional reporting from the processing a service cannot operate without. The toggle typically governs crash reports, usage events and performance measurements, while authentication, billing and abuse prevention continue regardless of its position.
Crash reports carry a stack trace, device model, OS version and app version. Usage events name screens and features, sometimes with durations. Performance events record connect times, protocol choices and error codes. Support diagnostics are a fourth category, usually triggered by hand and capable of bundling logs and configuration.
The sender is not always the brand on the icon. An SDK embedded in the app can post to its own endpoint, and a crash service can be a separate company. That is why the notice's recipient list matters as much as the toggle label.
The fields that make a report identifying
Category alone does not settle the privacy question; the identifier attached to the event does. A report that seems harmless can become a history when the same install ID appears in every row.
| Report type | Typical fields | Why it can identify |
|---|---|---|
| Crash | Stack trace, device model, OS, app version, install ID | The install ID links crashes over months |
| Usage | Screen names, feature events, session length | Builds a behavior profile even without content |
| Performance | Connect duration, protocol, error code | Network conditions can fingerprint a connection |
| Support bundle | Logs, configuration, sometimes addresses | May contain endpoints and timestamps you did not intend to share |
An account link is the strongest join key, because it turns a device history into a person history. An IP address is personal data in many jurisdictions even when the report contains no name, and a stable identifier can survive reinstalls on some platforms.
Aggregation is not anonymization when the raw identifier persists on the sender's side. If a notice claims anonymous statistics, look for the method: what is dropped, at which stage, and whether the recipient can re-link events.
Who receives the report
Trace the recipients rather than the brand. The app developer may operate the endpoint, or may license the brand to a different operator; the analytics vendor and the crash service are additional parties. The privacy notice should name these roles and the categories each one receives. The Mozilla subscription privacy notice separates account data from technical and diagnostic categories, which is the kind of split to look for.
Retention is set at every hop. A developer might keep events for a short window while the analytics vendor keeps them longer under its own policy, and a support bundle sent by email can outlive both. Ask which party holds the data, not only which party collected it.
Cross-border transfer belongs in the same review. A diagnostics endpoint in another region creates a transfer that the tunnel's encryption does not affect, because the report never travelled through the tunnel in the first place.
What turning it off does and does not do
Switching the toggle off stops future optional reports. It does not recall reports already sent, and it does not delete them from the recipient. Deletion is a separate request under the provider's data process, and it may need the account identifier rather than the device setting.
Essential processing also continues. Sign-in, subscription renewal, fraud checks and service health can be logged under a different basis, and the operating system has its own crash and analytics facilities that the app toggle never controlled. Check the OS-level setting if the goal is to stop device diagnostics.
For troubleshooting, use the setting deliberately: enable diagnostics, reproduce the fault, collect the bundle, then disable reporting and delete the bundle once the ticket closes. Manual attachments deserve the same review as automatic ones, because a log file can contain more than the analytics event ever did.
Compare the notice with what leaves the device
You can see destinations without decrypting content. On macOS and Linux, connection listings show which remote addresses the client talks to:
sudo lsof -i -P -n | grep -i vpnclient
ss -tup | grep -i vpnclientTLS hides the payload, so the output proves a destination and a rough timing, not the fields inside. That is still enough to check a claim: if the notice names one analytics recipient and the app also contacts an unlisted domain, ask about it before accepting the policy at face value.
Write down the categories you accept, the identifiers attached to them and the recipients that hold them. That short record is more useful than a mental note when the app updates its SDK or the provider changes ownership.