Technologies

Here’s What You Need to Know About VPN Trackers

Beware of VPN companies that put profits ahead of ethics. Here’s what to know about VPN trackers and how to protect your privacy.

Public concern over web tracking is at an all-time high. Even though the concern over tracking has been mounting for well over a decade, the situation hasn’t improved much over that time: Pervasive tracking and rampant data collection are still the lay of the land all these years later. Websites and apps deploy trackers that follow you around the internet and share the information they collect with various third parties. Internet service providers collect gobs of personal data every time you go online, then share it with others who monetize it, often without your knowledge or consent.

Because of this, people are increasingly turning to virtual private networks to help protect against invasive online tracking practices. But what can you do when it’s the VPNs themselves that are doing the tracking? As with any app or online service, it’s important to do your research and make sure you choose a provider that actually takes your privacy seriously. Just because a VPN company claims that your privacy is its top priority doesn’t mean it’s true.

VPNs are supposed to help you protect your online privacy and fight back against the machine hell-bent on exploiting your data for its own gain. Gaining privacy from tracking is among the main reasons you should seek the help of a VPN, but it can be difficult to sort through the various ways VPNs might track you. Here’s what to know about the different trackers VPNs use, and how they separate the best VPNs from the ones you should avoid.

First-party trackers vs. third-party trackers

Not all trackers are the same. For example, there’s a crucial difference between first-party and third-party trackers. There’s a similarly vital distinction between trackers used on a VPN’s website versus the ones inside a VPN’s app. In both cases, the second option will have much greater implications on your privacy than the former.

First-party trackers, also known as cookies, are used and stored by the websites you visit. They’re used for things like remembering your preferences, geographic region, language settings and what you put in your shopping cart. They’re also used by website administrators to collect data as you visit their sites, helping them better understand your behavior and figure out what will keep you on their site longer and buying more of their products and services.

Basically, first-party trackers are there to provide you with a smoother experience as you visit the websites you frequent. It would be annoying to have to set all your preferences each and every time you visit a site and to have to re-add each individual item to your shopping cart every time you click away from your cart.

A VPN company may use first-party trackers on its website to save your settings, display account-specific information after you log in and see what marketing channel brought you to its site.

Third-party trackers are different in that they are created by entities other than the site you’re visiting. After a site puts these trackers on your computer via your browser, they follow you across the websites you visit. They are injected into a website using a tag or a script and are accessible on any site that loads the third-party’s tracking code. But the big difference is that they’re used to track your online behavior and make money from you, rather than improve your online experience.

In simpler terms, third-party trackers exist to help companies bombard you with targeted advertisements based on your online browsing activity. Targeted advertising is big business, and there are mountains of cash to be made at the expense of your digital privacy.

That said, Apple and Google have begun shifting their policies regarding the use of third-party trackers in their respective mobile app marketplaces and have provided users more transparency and a much greater element of control when it comes to restricting how apps are able to track them. Google even proposed a solution to eliminating the use of third-party trackers altogether. That proposal, however, turned out to be a failure after people began pointing out the ways in which Google’s proposed alternative would make it even easier for the company to track and identify you for targeted advertising. Google was forced back to the drawing board and ended up shelving the idea for at least two years. Still, the industry is slowly showing signs of progress.

If a VPN company is using third-party trackers on its website for marketing purposes or to enhance your experience on the site itself, the tracking is easy to block in most cases. But when a VPN tracks you on its app, the alarm bells should start going off. In-app trackers should make you seriously concerned about what that VPN is really up to (Spoiler: It’s to make money from sharing your data) and should ultimately steer you away from that VPN altogether.

Why would VPN companies need to track you through their apps?

Simple answer: They don’t. Their apps would function just as well for you whether they tracked you or not.

But many VPN companies will employ trackers in their apps regardless of how much they say they care about your privacy. Those VPNs put users’ privacy at risk so they can make as much money as possible. And what some of these VPN apps track and share with third parties is actually quite alarming. This is the biggest reason we advise you to avoid using most free VPNs.

Read more: Best Budget Laptop 2023

What data is being collected by these trackers and who is it shared with?

The scope of data collection will vary greatly from one VPN to another, and will differ in terms of whether the trackers are being deployed on the VPN’s website or within the app itself. But let’s focus on trackers embedded within VPN apps themselves.

There are VPN apps out there that will track and share things like your user ID, device or advertising ID, usage data and even your location. They track this information just to sell it on to third parties for targeted advertising purposes, making money at the expense of your digital privacy. Any VPN engaging in such activity should be avoided at all costs.

When we say your data is being shared with third-party entities, we mean entities like data brokers and advertisers that put profits ahead of ethics. That information is also being shared with sites like Google and Facebook, meaning that even if you don’t have a Facebook account and you’re doing your best to stay away from big tech data hogs, your data is still being shared with them.

Unfortunately, far too many VPN apps will track and share your data with all kinds of third parties. That’s why it’s crucial to scrutinize the data sharing practices of any VPN you’re considering. (We do this as part of our review process and thoroughly vet a VPN’s data policies before we recommend it to anyone.)

The concern is real

VPNs are often quick to claim that the data they’re tracking and sharing with third parties is anonymized and not identifiable or tied to your personal information. That sounds great, but something like a device ID can still be used to identify you personally when other data points tied to your online behavior and interactions with the app are matched to that ID. It doesn’t actually take that much to connect the dots and identify you online.

Researchers have shown that 99.98% of users could be re-identified in any anonymized dataset using only 15 data points. The more data points an app is collecting about you, the easier it is for others to identify you online, even if the data being collected isn’t necessarily personally identifiable information.

cybersecurity-hacking-11 — It doesn’t take much to identify you online.

Graphic by Pixabay/Illustration by CNET

Find out what data they’re collecting and tracking

Luckily, it’s becoming easier and easier to see what VPN companies are collecting and tracking when you use their apps. For one, reputable VPNs are getting increasingly transparent about what data they collect and what kinds of trackers they may or may not be implementing on their sites and apps. VPNs know that their reputations rely on actually walking the walk when it comes to protecting user privacy. So transparency is key.

On top of that, with Apple’s App Tracking Transparency functionality in its App Store, you have a clear picture of an application’s tracking practices. You can see if any app you’re looking to download wants to track you and share your data with third parties and you can easily deny those permissions. Google has offered similar functionality since its Android 12 release.

In addition to scrutinizing a VPN app’s tracking practices, you’ll want to scour its privacy policy to see what kinds of trackers it uses, what data it collects and who it shares that data with. If you notice that a provider you’re looking at is sharing user data with an abundance of third parties, or if the provider isn’t upfront or totally transparent about its practices, then it’s best to move along and find something else.

When you do your research, you’ll see that the best VPNs don’t resort to such unscrupulous tracking practices. Part of our review process includes vetting the data collection practices of each provider. Though the VPNs we recommend, like Surfshark, NordVPN and ExpressVPN, may collect certain types of connection data when you use their apps, they don’t deploy in-app trackers.

While these VPNs may deploy cookies on their websites, they’re transparent about exactly what those cookies are there for and how they help improve website functionality and aid in advertising their services across the web. Their third-party trackers can also be blocked via your browser settings.

Always check a VPN’s privacy policies, and their apps in the App Store and the Play Store to learn more about the trackers they deploy on their websites and apps. The important thing to keep in mind here is that the apps of our recommended VPNs will not track you like the apps of some other less-than-trustworthy VPNs.

Read more: Best Phone to Buy for 2023

How to fight back against tracking

If you don’t want your VPN app to track you, you’ll want to take a few precautions.

With Apple’s App Tracking Transparency in place, iOS apps have to get your explicit permission before they are able to track you. If you deny that permission, the app developer won’t have access to your device’s advertising ID and won’t be able to track you or share that ID with third parties.

You can even deny any and all apps on your iOS device from even asking you if they can track you in the first place. All you’d need to do is head over to your settings menu and disable tracking. Similarly, if you’re an Android user, you can manage your app permissions to limit tracking on an app-by-app basis by navigating to your Privacy Dashboard.

Read more: Best Android Phone of 2023

Keep in mind that even if you deny an app access to your advertising ID, that doesn’t necessarily prevent it from sharing other data with third parties. A bit of investigative research from Top10VPN in 2021 showed that 85% of the top free VPNs in Apple’s US App Store may still share your data with third-party advertisers even after you’ve explicitly denied their requests to track you. Even if they don’t have access to your advertising ID — according to Top10VPN’s research — these free VPN apps still track and share information like your IP address, device name, language, device model and iOS version with advertisers without your consent. This is all information that can be used to identify you, and the research is a pointed reminder of why we recommend staying away from most free VPNs.

If you’re concerned about VPN companies using trackers on their websites and sharing data with third parties, then you can use a privacy-focused browser like Brave or Firefox, or use a tool like the Duck Duck Go’s browser extension to your current browser. Options like these will help you to easily prevent websites from tracking you as you browse the web. If you’re not willing to part ways with your existing browser or install an extension, there are various settings you should change to protect your privacy and limit tracking.

Read more: Best Laptop 2023

iphone-11-pro-max-5 — Free VPN apps on iOS devices may still be tracking you even after you deny them permission to do so.

Óscar Gutiérrez/CNET

Next steps

Websites and apps will routinely do whatever they can to track your activity across the internet to churn as much money out of the targeted ad machine as possible. But the tide is finally turning as people have begun to realize exactly how invasive the practice is and how detrimental it can be to our digital privacy.

More and more options are available to defend against tracking practices, and VPN companies are becoming increasingly transparent with consumers with regards to how they approach the subject and many are ditching tracking altogether. Unfortunately, many VPN companies still continue the practice and are sharing all kinds of tracking data with third parties. If you’re an iOS user, just take a look through the VPNs available in the App Store and take a peek at their “nutrition label” and you’ll see what we mean.

If you already have a VPN app installed on your device, check to see if it’s tracking you and sharing your data with third parties. If it is, it’s time to wipe it from your device for good and never look back, because it’s compromising your privacy rather than protecting it — which is the opposite of what a VPN should be doing.

Technologies

Where to find some of the highest CD rates heading into September

Annual percentage yields on certificates of deposit are looking attractive as fall begins next month.

August has been a solid month for stocks, but investors hoping to stash some cash in the fall can still be paid well for using certificates of deposit. Savers are keeping an eye on the Federal Reserve as its Sept. 15-16 meeting approaches. Fed funds futures trading suggests a roughly 65% likelihood the central bank will raise its benchmark lending a quarter percentage point, to a range of 3.75% to 4%. Speaking in Jackson Hole, Wyoming late last week, Fed Chairman Kevin Warsh highlighted his worries about stubborn inflation . He noted that “while this summer’s [inflation] readings were better than expected, they do not tell me that underlying trends have meaningfully improved.” Indeed, the July reading of the personal consumption expenditures price index rose at an annual rate of 3.7%, topping the Dow Jones consensus by 0.1 percentage point, and far above the central bank’s 2% inflation target. While higher rates are unwelcome for borrowers, they’re a great development for savers who can capture higher yields on products such as certificates of deposit. Several banks, for example, continue to aggressively price their CDs and offer attractive yields as they compete for deposits. Latest increase Just last week, Sallie Mae lifted the annual percentage yield on its one-year CD by five basis points to 4.2%. The increase lifts Sallie Mae’s one-year CD rate some 25 basis points above the peer median APY of 3.95%, according to Vincent Caintic, analyst at BTIG. One basis point equals 1/100th of a percent, or 0.01%. Other financial services firms also continue to offer compelling rates on their one-year CDs. Popular Direct pays an APY of 4.25% on its 12-month CD, as of Monday afternoon, while CIBC touts a 4.15% yield. Savers can also find attractive rates if they’re willing to look outside the 12-month term. Synchrony Financial offers a 4.3% APY for a 16-month CD, while Marcus by Goldman Sachs has a similar rate on its 18-month instrument. Happen Bank has an 11-month CD with a 4.2% APY. If you’re thinking of getting into a CD, be sure to weigh your time horizon and liquidity needs. “Breaking” a CD before maturity carries a penalty of forfeited interest. Savers should also be aware of when their CD is about to expire, as their banks may automatically put them into a renewal CD at a lower rate.

This site is now part of Versant. By continuing to use this service, you agree to our Terms. You also acknowledge that our updated Privacy Policy applies, including to your existing data. For details on your data rights, click here.

On this service, we and our vendors use cookies and other tools (“Cookies”) to store and access information on your device, such as device identifiers, IP address, and your browser type. You can access a list of all our potential 1015 vendors by selecting “IAB and Google Vendors,” although we may work with only a small selection of these on this service. Your data may be used to save and communicate your privacy choices; ensure security, prevent fraud, and debug our products and services; personalize advertising and content; for advertising and content measurement; to conduct audience research and services development; so we can improve our services and develop new ones; to match and combine offline data with your online activity; and for social features. We may share this data with select vendors with your consent.

Click “I Accept”, to consent to our use of these Cookies or “Reject All” to reject our use of these Cookies. Click “Manage Choices” to set your preferences. If you previously made choices with respect to Versant’s use of Cookies on this browser and device, you will need to update them. You can adjust your choices any time through the “Cookie Preferences” link in the footer of relevant Versant sites or in-app settings. Visit our Cookie Notice and Privacy Policy to learn more.

We will also use other Cookies that are essential or related to our services, including for security and fraud prevention.

Store and/or access information on a device. Personalised advertising and content, advertising and content measurement, audience research and services development.

– Your Privacy

– Strictly Necessary

– Save and communicate privacy choices 510 partners can use this special purpose

– Ensure security, prevent and detect fraud, and fix errors 644 partners can use this special purpose

– Deliver and present advertising and content 634 partners can use this special purpose

– Store and/or access information on a device 842 partners can use this purpose

– Personalised advertising and content, advertising and content measurement, audience research and services development 982 partners can use this purpose

– Targeted Advertising

– Content Selection

On this service, we and our vendors use cookies and other tools (“Cookies”) to store and access information on your device, such as device identifiers, IP address, and your browser type. Your data may be used to save and communicate your privacy choices; ensure security, prevent fraud, and debug our products and services; personalize advertising and content; for advertising and content measurement; to conduct audience research and services development; so we can improve our services and develop new ones; to match and combine offline data with your online activity; and for social features. We may share this data with select vendors with your consent. You can adjust your choices any time through the “Cookie Preferences” link in the footer of relevant Versant sites or in-app settings.

We will also use other Cookies that are essential or related to our services, including for security and fraud prevention. To learn more about some of our vendors, see the IAB and Google Vendors under each purpose. Visit our Cookie Notice and Privacy Policy to learn more.

Always Active

These Cookies and SDKs are required for Service functionality, including security and fraud prevention, and to enable any purchasing capabilities. You can set your browser to block these tracking technologies, but some parts of the site may not function properly.

The choices you make regarding the purposes and entities listed in this notice are saved and made available to those entities in the form of digital signals (such as a string of characters). This is necessary in order to enable both this service and those entities to respect such choices.

Your data can be used to monitor for and prevent unusual and possibly fraudulent activity (for example, regarding advertising, ad clicks by bots), and ensure systems and processes work properly and securely. It can also be used to correct any problems you, the publisher or the advertiser may encounter in the delivery of content and ads and in your interaction with them.

Certain information (like an IP address or device capabilities) is used to ensure the technical compatibility of the content or advertising, and to facilitate the transmission of the content or ad to your device.

Cookies, device or similar online identifiers (e.g. login-based identifiers, randomly assigned identifiers, network based identifiers) together with other information (e.g. browser type and information, language, screen size, supported technologies etc.) can be stored or read on your device to recognise it each time it connects to an app or to a website, for one or several of the purposes presented here.

– Use limited data to select advertising 781 partners can use this purposeAdvertising presented to you on this service can be based on limited data, such as the website or app you are using, your non-precise location, your device type or which content you are (or have been) interacting with (for example, to limit the number of times an ad is presented to you).

– Create profiles for personalised advertising 629 partners can use this purposeInformation about your activity on this service (such as forms you submit, content you look at) can be stored and combined with other information about you (for example, information from your previous activity on this service and other websites or apps) or similar users. This is then used to build or improve a profile about you (that might include possible interests and personal aspects). Your profile can be used (also later) to present advertising that appears more relevant based on your possible interests by this and other entities.

– Use profiles to select personalised advertising 633 partners can use this purposeAdvertising presented to you on this service can be based on your advertising profiles, which can reflect your activity on this service or other websites or apps (like the forms you submit, content you look at), possible interests and personal aspects.

– Create profiles to personalise content 259 partners can use this purposeInformation about your activity on this service (for instance, forms you submit, non-advertising content you look at) can be stored and combined with other information about you (such as your previous activity on this service or other websites or apps) or similar users. This is then used to build or improve a profile about you (which might for example include possible interests and personal aspects). Your profile can be used (also later) to present content that appears more relevant based on your possible interests, such as by adapting the order in which content is shown to you, so that it is even easier for you to find content that matches your interests.

– Use profiles to select personalised content 231 partners can use this purposeContent presented to you on this service can be based on your content personalisation profiles, which can reflect your activity on this or other services (for instance, the forms you submit, content you look at), possible interests and personal aspects. This can for example be used to adapt the order in which content is shown to you, so that it is even easier for you to find (non-advertising) content that matches your interests.

– Measure advertising performance 905 partners can use this purposeInformation regarding which advertising is presented to you and how you interact with it can be used to determine how well an advert has worked for you or other users and whether the goals of the advertising were reached. For instance, whether you saw an ad, whether you clicked on it, whether it led you to buy a product or visit a website, etc. This is very helpful to understand the relevance of advertising campaigns.

– Measure content performance 404 partners can use this purposeInformation regarding which content is presented to you and how you interact with it can be used to determine whether the (non-advertising) content e.g. reached its intended audience and matched your interests. For instance, whether you read an article, watch a video, listen to a podcast or look at a product description, how long you spent on this service and the web pages you visit etc. This is very helpful to understand the relevance of (non-advertising) content that is shown to you.

– Understand audiences through statistics or combinations of data from different sources 572 partners can use this purposeReports can be generated based on the combination of data sets (like user profiles, statistics, market research, analytics data) regarding your interactions and those of other users with advertising or (non-advertising) content to identify common characteristics (for instance, to determine which target audiences are more receptive to an ad campaign or to certain contents).

– Develop and improve services 678 partners can use this purposeInformation about your activity on this service, such as your interaction with ads or content, can be very helpful to improve products and services and to build new products and services based on user interactions, the type of audience, etc. This specific purpose does not include the development or improvement of user profiles and identifiers.

– Use limited data to select content 180 partners can use this purposeContent presented to you on this service can be based on limited data, such as the website or app you are using, your non-precise location, your device type, or which content you are (or have been) interacting with (for example, to limit the number of times a video or an article is presented to you).

These Cookies and SDKs are used to collect data about your browsing habits, use of the Services, your preferences, and your interaction with advertisements across platforms and devices for the purpose of delivering targeted advertising content, both on our Services and on third party sites. Third-party sites and services also use Targeting Cookies to deliver content, including advertisements relevant to your interests on the Services. If you reject these Cookies or SDKs, you will see less relevant advertising.

Data collected under this category through Cookies and SDKs can also be used to select and deliver personalized content, such as news articles and videos.

Consent Leg.Interest

label

Technologies

Where to find some of the highest CD rates heading into September

With the Federal Reserve’s September meeting approaching, several banks continue offering competitive CD yields as inflation remains stubborn. Savers can still find attractive rates on certificates of deposit, though they should be mindful of timing and liquidity needs.

We will also use other Cookies that are essential or related to our services, including for security and fraud prevention.

Store and/or access information on a device. Personalised advertising and content, advertising and content measurement, audience research and services development.

– Your Privacy

– Strictly Necessary

– Save and communicate privacy choices 510 partners can use this special purpose

– Ensure security, prevent and detect fraud, and fix errors 644 partners can use this special purpose

– Deliver and present advertising and content 634 partners can use this special purpose

– Store and/or access information on a device 842 partners can use this purpose

– Personalised advertising and content, advertising and content measurement, audience research and services development 982 partners can use this purpose

– Targeted Advertising

– Content Selection

On this service, we and our vendors use cookies and other tools (“Cookies”) to store and access information on your device, such as device identifiers, IP address, and your browser type. Your data may be used to save and communicate your privacy choices; ensure security, prevent fraud, and debug our products and services; personalize advertising and content; for advertising and content measurement; to conduct audience research and services development; so we can improve our services and develop new ones; to match and combine offline data with your online activity; and for social features. We may share this data with select vendors with your consent. You can adjust your choices any time through the “Cookie Preferences” link in the footer of relevant Versant sites or in-app settings.

Always Active

– Create profiles to personalise content 259 partners can use this purposeInformation about your activity on this service (for instance, forms you submit, non-advertising content you look at) can be stored and combined with other information about you (such as your previous activity on this service and other websites or apps) or similar users. This is then used to build or improve a profile about you (which might for example include possible interests and personal aspects). Your profile can be used (also later) to present content that appears more relevant based on your possible interests, such as by adapting the order in which content is shown to you, so that it is even easier for you to find content that matches your interests.

Data collected under this category through Cookies and SDKs can also be used to select and deliver personalized content, such as news articles and videos.

Consent Leg.Interest

label

Technologies

Kalshi permanently bans former GOP Rep. George Santos over illegal trading

Former GOP Rep. George Santos, of New York, has drawn fire for allegedly trading on whether he would attend this year’s State of the Union address.

The prediction market platform Kalshi announced on Monday it has permanently banned former Republican Rep. George Santos and fined him $71,356 for allegedly using the app to trade on his own attendance at this year’s State of the Union address.

It’s the first ban of its kind on the platform, the company confirmed on Monday.

In the weeks leading up to President Donald Trump’s speech in February, Santos, who represented New York’s 3rd Congressional District from January 2023 until his expulsion from Congress later that same year, allegedly made more than $17,000 by betting on whether he would attend.

In the weeks leading up to the event, Santos “began making a series of public statements regarding his attendance at the event in an attempt to influence the price of Yes and No contracts, respectively. Some of these included false or misleading statements,” according to a Kalshi announcement of the disciplinary action, released Monday. Those actions violated the company’s rules on trading on non-public information, Kalshi said.

In one X post from days before Trump’s address, Santos said: “I’m going to be there for the State of Union in the gallery, guys.” On the day of the State of the Union, Santos posted he was watching from the airport.

Santos shot back at Kalshi on Monday in a post to X.

“Hey @Kalshi thanks for the lifetime ban from your gambling platform. Let’s see how much longer you guys are around for,” the former lawmaker wrote, ending the post with a “kiss mark” emoji.

Kalshi’s disciplinary action is not the first time Santos has drawn fire for the incident.

After Kalshi detected his trades and referred him to federal investigators, the Commodity Futures Trading Commission in July ordered Santos to pay $35,000 for trading on State of the Union attendance. The federal regulator also banned Santos from trading for three years. Santos at the time shared a statement from his lawyer saying he had settled without admitting to any of the CFTC’s findings.

In June, amid the federal investigation, Polymarket, a rival prediction market platform, ended its paid relationship with Santos, who had been working as an online influencer for the company.

Before Santos was sworn into office in 2023, doubts about his biography had emerged. His time in Congress was punctuated by a House Ethics Committee investigation that found “substantial evidence of wrongdoing.” He became the first member of the House to be expelled in more than 20 years.

Santos had also been sentenced to 87 months in prison for wire fraud and aggravated identity theft, though President Donald Trump commuted his sentence last fall.

Kalshi also announced settlements on Monday with three political candidates who traded on contracts related to their candidacies: a governor candidate in California, another gubernatorial hopeful in Maine, and a congressional candidate in North Carolina. All have to pay penalties and are banned from Kalshi for three years, but the company said all three complied with the investigations, unlike Santos.

While the candidates for California and Maine governor lost their races, Laurie Buckhout is the Republican nominee for the battleground North Carolina 1st Congressional District, where she faces Democratic incumbent Rep. Don Davis. Buckhout will have to pay a penalty of just under $2,600 for her trades.

“I bet on myself. Literally,” Buckhout said in a statement. “It was a dumb mistake, and as soon as I learned there was an issue, I worked to make it right. Safe to say my career as a Kalshi trader was short-lived.”

— CNBC’s Davis Giangiulio contributed reporting

Disclosure: CNBC and Kalshi have a commercial relationship that includes customer acquisition and a minority investment.