ProtonVPN
Proton VPN offers genuinely strong privacy protections, including a verified no-logs policy, Swiss legal jurisdiction outside major surveillance alliances, open-source audited apps, and the technical ability to create accounts anonymously. However, the Terms of Service contain several user-unfriendly clauses, including a $100 liability cap no matter how serious the harm, forced arbitration that strips US users of class-action rights, and the ability to change policies without requiring your explicit consent. Free account holders should be aware that 12 months of inactivity can result in permanent data deletion, and if Proton suspects any policy violation your IP address may be stored indefinitely. Overall, Proton is a trustworthy privacy-focused service, but its legal terms shift significant risk and cost onto users in the event of disputes or problems.
Last analyzed
Heads up: this analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original document before you agree — see our Terms.
Clause-by-clause breakdown
Every clause we flagged in ProtonVPN's agreement, with what it means for you.
US users must arbitrate disputes alone and cannot join class actions.
“13.1. Binding arbitration agreement and class action waiver These Terms of Service contain a class action waiver as well as an arbitration provision, which requires you to arbitrate any claims (with certain exceptions) you may have on an individual basis. Arbitration on an individual basis means that you will not have, and that you waive, the right for a judge or jury to decide your claims, and that you may not proceed in a class, consolidated, or representative capacity in any forum, as described in more detail below. Scope of the arbitration agreement. Mindful of the high cost of legal disputes, not only in dollars but in time and energy, both you and the Company agree that any and all disputes, actions, claims, or other controversies arising out of or relating in any way to these Terms, your Account, the Services, your use of (or lack of use of) or access to (or lack of access to) your Account or the Services, or any advertising, promotion, or other communications between you and the Company, whether based in contract, warranty, tort, statute, regulation, ordinance, or any other legal or equitable basis, shall be resolved exclusively through final and binding individual arbitration, and the parties expressly waive any and all rights to appeal any order or judgment of the arbitrator or seek confirmation of an order or judgment of the arbitrator to the extent permitted by applicable law. Class action waiver. To the fullest extent permitted by applicable law, you and the Company each agree that any proceeding to resolve any dispute, claim, or controversy will be brought and conducted only in the respective party's individual capacity and not as part of any class (or purported class), consolidated, multiple-plaintiff, or representative action or proceeding ("class action"). You and the Company agree to waive the right to participate as a plaintiff or class member in any class action. Opt out provision and governing law. You have the right to opt-out and not be bound by the arbitration provisions including or excluding the class action waiver set forth in these Terms by sending written notice of your decision to opt-out to: Proton AG Attn: Legal Route de la Galaise 32, 1228 Plan-les-Ouates Geneva, Switzerland The opt-out notice must be sent to the foregoing address within 30 calendar days of your first agreeing to these Terms. Should you not opt out in accordance with this section within the 30-day period, then this agreement to arbitrate will become fully effective and binding as of the date you first agreed to these Terms.”
Quoted verbatim from the agreement What this means: US users must resolve virtually all disputes with Proton through private arbitration rather than in court, and they give up the right to join a class-action lawsuit. This means if Proton harms many users in the same way, each person must fight their case alone, which is often impractical for small individual claims. The clause covers every conceivable type of dispute — contract, tort, statute, and more. An opt-out window of 30 days from first agreeing exists, but most users will miss it.
What you can do: If you are a US user, send a written opt-out notice to Proton AG, Attn: Legal, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland within 30 calendar days of first agreeing to the Terms to preserve your right to sue in court and join class actions.
Proton can change the rules anytime; using the service means you agree.
“Within the limits of applicable law, the Company reserves the right to review and change these Terms at any time. As long as you are using your Account or the Services, you are responsible for regularly reviewing these Terms. Continued use of your Account or the Services, including non-deletion of your Account after such changes are performed shall constitute your consent to them. The latest Terms will apply going forward and to any dispute or issue arising after the Terms have been updated.”
Quoted verbatim from the agreement What this means: Proton can change the Terms at any time, and simply continuing to use your account — or even just not deleting it — counts as your agreement to the new terms. You are expected to check for changes yourself; Proton does not commit to notifying you before changes take effect. This means your rights could change without you realising it.
What you can do: Periodically check the Terms page at proton.me/legal/terms for updates. If you disagree with a change, delete your account before the new terms take effect to avoid being bound by them.
Proton's maximum payout to you for any harm is just $100.
“To the extent not prohibited by law, you acknowledge and agree that in no event will the Company be responsible or liable to you or any third party, under any theory of responsibility or liability, for any indirect, special, exemplary, incidental, consequential, or punitive damages (including, but not limited to, procurement of substitute goods or services; loss of data, use, or profits; business interruptions; or any other damages or losses), for any multiplier on or increase to damages, or for any costs or fees (including attorneys' fees), whether under these Terms or otherwise, arising in any way in connection with your Account, the Services, or these Terms, whether arising at law, in equity, or otherwise, and whether based in contract, strict liability, tort (including negligence or otherwise), common law, statute, equity, or otherwise, even if we have been advised of the possibility of such damage, or for any other claim, demand, or damages whatsoever, arising out of or related to your use or inability to use your Account or the Services. Without limitation of the foregoing, and to the extent not prohibited by law, the total liability of the Company's parties for any reason whatsoever arising out of or related to the use of, or inability to use, your Account or the Services, or these Terms, shall not exceed $100, or the amount you paid us, if any, for use of your Account or the Services, whichever amount is greater.”
Quoted verbatim from the agreement What this means: Even if Proton's failure causes you significant harm — such as loss of important emails, files, or passwords — the most you can ever recover is $100 or what you paid for the service, whichever is higher. All consequential losses (lost business, lost data value, etc.) are excluded entirely. For a service that stores sensitive communications and files, this cap is very low relative to the potential harm.
What you can do: Keep independent backups of any critical data stored in Proton services. Do not rely solely on Proton for irreplaceable information.
Free accounts inactive for 12 months can have all data permanently deleted.
“The Company reserves the right to suspend or delete free Accounts that have been inactive for a consecutive period of 12 months and/or part or all of their associated data and content according to this section. If you have been inactive on your free Account for a consecutive period of 12 months or more, access to your Account and all or part of the data associated with your Account (including but not limited to emails stored in Proton Mail, files stored on Proton Drive, calendar entries in Proton Calendar and passwords in Proton Pass) may be deleted.”
Quoted verbatim from the agreement What this means: Free accounts that go unused for 12 months can have all their data permanently deleted — including emails, files, calendar entries, and saved passwords. While Proton sends notices 30, 15, and 7 days before deletion, the data loss is irreversible once it occurs. This is a meaningful risk for users who rely on Proton for long-term storage but don't log in frequently.
What you can do: Log in to your Proton account at least once every 12 months to keep it active, or upgrade to a paid plan which is always considered active and exempt from this policy.
Proton has no duty to preserve your data and you can't sue over leaks.
“The Company has no obligation to store or forward the contents of terminated Accounts. We also have no obligation to store messages or contents for accounts that exceed their storage quotas. Furthermore, you will not hold the Company liable or seek indemnification if confidential material is unintentionally released as the result of a security failure or vulnerability in the performance of the Services or if data is deleted for an inactive account (see section 3). Due to the encrypted nature of the Services, you acknowledge that the Company has no ability or obligation to recover your data if you misplace your password.”
Quoted verbatim from the agreement What this means: Proton explicitly disclaims any obligation to preserve your data if your account is terminated or exceeds its storage quota. You also waive the right to hold Proton liable if a security breach accidentally exposes your confidential data. Combined with the $100 liability cap, this means users have very limited recourse if their data is lost or leaked.
What you can do: Maintain your own encrypted backups of important data and use a secure password manager to avoid losing access to your Proton account.
Free users may be speed-throttled during excessive bandwidth use.
“Our free VPN service is also covered by our no-logs policy, and has in general no speed restrictions. We do reserve the right to impose speed restrictions in cases of excessive consumption in order to ensure service quality for all users on free servers.”
Quoted verbatim from the agreement What this means: Free plan users get the same no-logs privacy protections as paid users. However, Proton reserves the right to throttle free users' speeds if they consume an excessive amount of bandwidth, which could affect heavy users on the free tier.
What you can do: If you rely on consistent high speeds, consider upgrading to a paid plan to avoid potential throttling.
You can only delete one email alias per year.
“You can delete up to one alias per year. Otherwise, aliases generally cannot be deleted. This limit does not apply to custom domains.”
Quoted verbatim from the agreement What this means: Once you create email aliases on a paid Proton plan, you are largely stuck with them — you can only delete one per year. If you created aliases you no longer want, you cannot remove them in bulk or freely. This is a notable restriction on managing your own account data.
What you can do: Think carefully before creating email aliases, as you will only be able to delete one per year. Custom domain aliases are not subject to this restriction.
Cancelling early costs you the full remaining subscription balance.
“If you terminate your Account before its term for convenience on the basis of a specific regulation allowing you to do so (including but not limited to Chapter VI of the EU Data Act), you agree that early termination penalties apply, whereas these termination penalties correspond to the remainder of the payment that would otherwise have been due for the agreed term of your Account subscription.”
Quoted verbatim from the agreement What this means: If you cancel your subscription early — even when a law gives you the right to do so — Proton charges you the full remaining balance of your subscription term as a penalty. This effectively makes early cancellation very expensive and could deter users from exercising legal rights they are entitled to.
What you can do: Before subscribing to a long-term plan, consider whether you may need to cancel early. Monthly billing cycles reduce your exposure to early termination penalties.
No refunds after 30 days; violations forfeit all payments.
“Past the abovementioned 30-day period, the Services provided by the Company are non-refundable and any refund or credit given will be at the sole discretion of the Company. Paid Accounts which are terminated due to a violation of these Terms will incur the loss of all payments and credits and are not eligible for refund.”
Quoted verbatim from the agreement What this means: After the 30-day window, Proton does not refund payments under any circumstances unless it chooses to at its own discretion. If your account is terminated for a Terms violation — even a disputed one — you lose all money paid and any account credits with no recourse.
What you can do: Use the 30-day refund window to fully evaluate the service before committing. Keep records of your account activity in case a termination is ever disputed.
Your IP address is stored permanently if Proton suspects a violation.
“2.5 IP logging: By default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our Terms of Service (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks). The legal basis of this processing is our legitimate interest to protect our service against non-compliant or fraudulent activities.”
Quoted verbatim from the agreement What this means: Proton does not log your IP address by default, which is a strong privacy protection. However, if Proton determines you have violated its Terms, your IP address can be stored permanently. The determination of what constitutes a violation is made by Proton, and the permanent retention of an IP address can identify your physical location and internet provider.
What you can do: Use Proton VPN when accessing Proton services if you want an additional layer of IP address protection, and avoid any activity that could be flagged as a Terms violation.
You must pay Proton's legal costs if a third party sues over your actions.
“You agree that the Company, and any parents, subsidiaries, officers, directors, employees, agents, or third-party contractors (the "Indemnified Parties") cannot be held responsible for any third-party claim, demand, or damages, including reasonable attorneys' fees, arising out of your use of your Account or the Services. You agree that the Indemnified Parties will have no liability in connection with any such third-party claim, demand, or damages, and you agree to indemnify any and all resulting loss, damages, judgments, awards, costs, expenses, and attorneys' fees and litigation expenses of the Indemnified Parties in connection therewith.”
Quoted verbatim from the agreement What this means: If a third party sues Proton because of something you did with your account, you are required to pay Proton's legal costs and any damages. This is a broad indemnification clause that could expose you to significant financial liability if, for example, you accidentally sent content that infringed someone's copyright or caused harm to a third party.
What you can do: Use Proton services only for lawful purposes and be mindful that you bear full financial responsibility for any third-party claims arising from your use.
Non-US users must take legal disputes to Swiss courts.
“If you are a business user (anywhere in the world) or a consumer user (residing outside of the United States of America), you agree that these Terms shall be governed in all respects by the substantive laws of Switzerland, to the maximum extent permitted by law. Any disputes, actions, claims, or other controversies arising out of or relating in any way to these Terms, your Account, the Services... shall be subject to the jurisdiction of the competent courts of the Canton of Geneva.”
Quoted verbatim from the agreement What this means: For non-US users (and all business users worldwide), any legal dispute must be resolved under Swiss law in Swiss courts. This means if you live in the UK, EU, Australia, or elsewhere, you would need to pursue legal action in Geneva, Switzerland — a significant practical barrier for most individuals.
What you can do: Be aware that as a non-US consumer, your practical ability to pursue legal action against Proton is limited by the Swiss jurisdiction requirement, though your local consumer protection laws may still apply.
Proton logs zero browsing activity, traffic, or IP addresses.
“Proton VPN is a no-logs VPN service. When you use the Service, we do NOT do any of the following: Log users' traffic or the content of any communications Discriminate against devices, protocols, or applications Throttle your Internet connection All Proton VPN servers are encrypted and we do not log VPN session data. In order to respect our users' privacy, Proton VPN enforces a strict no-logs policy. This means we keep no session usage logs of what you do online, and we do not log metadata that can compromise your privacy. We don't log which websites you visit We don't log your traffic or the content of any communications We don't log your IP address We don't log your session lengths We don't log or track any location-based information This level of privacy is possible in part because we are based in Switzerland, which has some of the strongest data protection and digital privacy laws in the world. Data required for maintenance and troubleshooting purposes is secured using full-disk encryption on all our bare-metal servers, over which we have full control. Full details about the information that we do store (such as account information) are available in our Privacy Policy(new window). Our apps are all fully open source and independently audited so that you can be sure they are trustworthy, and we aim for transparency in everything we do. Proton VPN's Swiss jurisdiction also confers additional benefits which are favorable for VPN services. In most countries, VPNs can be forced to log as the result of government orders, even if they are by default no-logs. However, within the current Swiss legal framework, Proton VPN also does not have forced logging obligations. This notably differs from Swiss regulations for other online services such as email which is generally not no-logs and can require IP disclosure in the event of a Swiss criminal investigation. That's why if your threat model requires hiding your IP from Swiss authorities when using Proton Mail, we recommend using a VPN or Tor. Proton VPN's strict no-logs policy was tested in a legal case in 2019 where we were ordered to turn over logs to help identify a user and we were unable to comply because such logs did not exist. Our no-logs policy has also been verified by external independent experts.”
Quoted verbatim from the agreement What this means: Proton VPN commits to never recording what websites you visit, your IP address, session lengths, or any traffic content. This policy applies to all users, including those on the free plan. The no-logs claim was tested in a real 2019 legal case where Proton was ordered to hand over logs and genuinely had nothing to provide.
Proton publishes a transparency report and active warrant canary.
“Information about law enforcement data requests can be found in the Proton VPN Transparency Report and Warrant Canary.”
Quoted verbatim from the agreement What this means: Proton publishes a transparency report detailing how many and what type of law enforcement requests they receive, along with a warrant canary that signals if they have ever been subject to a secret government order. These are meaningful accountability tools that go beyond what most VPN providers offer.
What you can do: Check the Proton VPN Transparency Report and Warrant Canary periodically to stay informed about government data requests.
Your account data is stored only on Proton-owned servers in privacy-friendly countries.
“All information required to maintain your account are managed by servers that are wholly owned and operated by Proton or our subsidiaries. This data is always stored in encrypted format on our servers, which are exclusively located in Switzerland, Germany or Norway, under the protection of some of the world's strongest privacy laws.”
Quoted verbatim from the agreement What this means: Account data is stored only on Proton-owned servers in Switzerland, Germany, or Norway — countries with strong privacy protections. Proton does not rely on third-party cloud providers for this data, reducing the risk of unauthorized access or data sharing.
All servers use full-disk encryption and store no user data.
“All Proton VPN servers, irrespective of location, utilize full-disk encryption, and in the highly unlikely event that the full-disk encryption is compromised, Proton VPN servers also contain no logs and no user data.”
Quoted verbatim from the agreement What this means: Every Proton VPN server uses full-disk encryption. Even if a server were physically seized or compromised, there is no user data stored on it to extract. This is a double layer of protection: encryption plus no data retention.
All apps are open source and independently audited with public results.
“Our apps are all open source, so anyone can check our code. We also commission regular independent audits so you can know they are secure. Although being open source means anyone can check our code, Proton VPN also regularly commissions professional audits for all our full-release software from independent security experts. Unlike some VPN companies, we publish the full results of these audits(new window) online for all to see.”
Quoted verbatim from the agreement What this means: All Proton VPN apps are open source, meaning any security researcher can inspect the code. On top of that, Proton pays independent security firms to audit the apps and publishes the full audit results publicly. This level of transparency is rare in the VPN industry.
What you can do: You can review the published audit reports on Proton's website and inspect the source code on GitHub to independently verify the app's behavior.
Swiss law prevents any government from forcing Proton to start logging users.
“Under Swiss law, we are not obligated to save any user connection logs, nor can we be forced to perform targeted logging on specific users. In most countries, VPNs can be forced to log as the result of government orders, even if they are by default no-logs. However, within the current Swiss legal framework, Proton VPN also does not have forced logging obligations.”
Quoted verbatim from the agreement What this means: Swiss law is uniquely favorable: unlike most countries, Switzerland cannot legally compel Proton VPN to start logging a specific user's activity. This means even a targeted government order cannot force Proton to begin surveillance on you going forward.
Switzerland is outside all major intelligence-sharing alliances.
“Switzerland is well-known for its political neutrality. It is not part of the 5 Eyes, 9 Eyes, or 14 Eyes intelligence-sharing networks and is outside US and EU jurisdictions.”
Quoted verbatim from the agreement What this means: Switzerland is not a member of any of the major international intelligence-sharing alliances (5 Eyes, 9 Eyes, 14 Eyes). This means foreign intelligence agencies from member countries (like the US, UK, or Australia) cannot easily compel Swiss companies to share user data through those frameworks.
Proton commits to never showing privacy-invading ads.
“Proton VPN will never show you privacy-invading ads in our apps or on our website. We believe that is part of protecting your privacy.”
Quoted verbatim from the agreement What this means: Proton explicitly commits to never showing targeted or privacy-invading ads within its apps or website. This means your usage data is not being monetized through advertising, which is a common revenue model for free services.
You can sign up without providing any personal identifying information.
“We respect your privacy, so we don't require any personal identifying information to obtain a Proton VPN account. You can sign up with a secure Proton Mail email account or a Proton Pass email alias(new window) to use Proton VPN without disclosing your identity.”
Quoted verbatim from the agreement What this means: You can create a Proton VPN account without providing any real personal information. Using a Proton Mail address or an email alias means your real identity never needs to be linked to your VPN account, providing a meaningful layer of anonymity from the start.
What you can do: Sign up using a Proton Mail address or a Proton Pass email alias to avoid linking your real identity to your VPN account.
Proton uses its own analytics and does not retain your IP for tracking.
“2.1 Visiting proton.me or protonvpn.com website: We employ a local installation of self-developed analytics tools. Analytics are anonymized whenever possible and stored locally (and not on the cloud). IP addresses are not retained and stored for such analytics. Third-party services may process your data to deliver images displayed on our website.”
Quoted verbatim from the agreement What this means: Proton uses its own self-hosted analytics rather than third-party trackers like Google Analytics, and does not retain IP addresses for analytics. This is a meaningfully stronger privacy stance than most services. However, third-party services may still process your data to serve images on the website.
Lumo will never use your conversations to train or improve its AI.
“No use of content. Company will not use any of your content to maintain, develop, or improve our Services. Your content is your own. All improvements done to the Services by the Company are based on development independent of the Content.”
Quoted verbatim from the agreement What this means: Proton explicitly commits that your conversations with the Lumo AI assistant will never be used to train or improve the AI model. This is a stronger protection than most AI services offer, where user inputs are routinely used for model training. Your content remains yours and is not fed back into the system.
Your Lumo AI conversations are encrypted so even Proton cannot read them.
“Confidentiality of your content. In line with Proton's privacy-by-design principles across its services, Lumo is designed to protect the confidentiality of your Content. The information you provide and the responses generated by the Services are secured using zero-access encryption after having been processed by Lumo, which is intended to prevent access by the Company, its staff, or third parties. Access to your conversations is limited to you through your Proton Account.”
Quoted verbatim from the agreement What this means: After Lumo processes your messages, they are encrypted in a way that prevents even Proton staff from reading them. This zero-access encryption model means your AI conversations are stored with the same privacy protections as your emails and files. It is a notable commitment for an AI service.
Proton cannot technically read your emails, files, or passwords.
“Our overriding policy is to collect as little user information (personal data included) as possible to ensure a private user experience when using the Services. We do not have the technical means to access the content of your encrypted emails, files, calendar events, passwords, or notes.”
Quoted verbatim from the agreement What this means: Proton states it is technically unable to read your emails, files, calendar events, passwords, or notes due to end-to-end encryption. This is a strong structural privacy protection — it means even a court order or data breach cannot expose the content of your data to Proton or third parties. This is a core architectural commitment, not just a policy promise.
Frequently asked questions
Is ProtonVPN's Terms & Conditions agreement fair?
- BeforeYouClick grades ProtonVPN D on an A–E scale, where A is the fairest. Its agreement contains 5 critical clauses, 7 warnings and 13 good practices.
What are the biggest problems with ProtonVPN's terms?
- The most serious clauses we flagged are: Forced Arbitration and Class Action Waiver, Policy Changes Bind You Without New Consent and Liability Capped at $100 Regardless of Harm.
How long does it take to read ProtonVPN's terms?
- ProtonVPN's agreement takes about 80 minutes to read in full, across 25 clauses we reviewed. The summary on this page covers the same ground in under a minute.
When was ProtonVPN's agreement last analyzed?
- We last read ProtonVPN's Terms & Conditions on July 4, 2026. Companies change their terms without notice, so check the original document for the current version.
Is this analysis legal advice?
- No. This analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original agreement before you agree to it.
More agreements to read
- Mullvad VPNSecurityGrade A
- MurenaSecurityGrade B
- NordVPNSecurityGrade B
- BitwardenSecurityGrade C
- IVPNSecurityGrade C
- DuckDuckGoSecurityGrade C