The VPN business: what they cost, what they promise, and what they actually do Conversation about the investigation (7 min). Kilowatto and Leia are characters; both voices are synthetic. This conversation summarises the piece, it does not replace it. The full text, with sources and charts, is on kilowatto.com. --- Kilowatto: Leia, quick one. Using a VPN will get you cheaper flights, right? Leia: Yes, airlines raise prices if they see you're interested in a flight, so a VPN helps by hiding your IP. Kilowatto: That is what almost everybody answers. An independent test found real but inconsistent savings when comparing prices from different countries, and several airlines already detect and block attempts to book via VPN, with reports of bookings being canceled by anti-fraud systems. Leia: Hang on. What? Kilowatto: Hey! Let's go straight to the bottom of it, because today I have a Deep Dive: The VPN business: what they cost, what they promise, and what they actually do. Leia: Alright Kilowatto, where do we start? Kilowatto: I found that ExpressVPN, CyberGhost, Private Internet Access, and ZenMate are all owned by Kape Technologies, which also controls independent VPN review sites that rank its own brands first. Leia: How many VPNs does Kape own? Kilowatto: Well, at least 4, including ExpressVPN, CyberGhost, Private Internet Access, and ZenMate, and these review sites systematically rank them first. Leia: Is that legal? Kilowatto: It's not illegal, no law requires a review site to disclose its owner, but it's worth asking who funded the comparison when a YouTuber says they compared all VPNs. Leia: What's the name of the company that owns these VPNs? Kilowatto: Kape Technologies, which was renamed from Crossrider in 2018, after years of operating as an adware distributor, and its CEO acknowledged the name change was to distance itself from past activities. Leia: How many years ago was it renamed? Kilowatto: I found that 281 free Android VPN apps had traffic leaks and unencrypted configurations, according to a study by researchers from the University of Michigan. Leia: How many apps had traffic leaks? Kilowatto: Well, the study found traffic leaks and active tracking libraries in a significant portion of them, but it doesn't give an exact figure for traffic leaks alone. Leia: What about unencrypted configurations? Kilowatto: The same study found unencrypted configurations in a significant portion of the 281 free Android VPN apps, but again, no exact figure is given. Leia: Is that from the same study? Kilowatto: Yes, it's from the same academic study presented at the NDSS 2026 symposium, which analyzed 281 free Android VPN apps. Leia: How many apps were analyzed in total? Kilowatto: I found Opera's built-in free VPN is actually a browser proxy, not a VPN, it only encrypts traffic passing through the Opera browser. Leia: How does it encrypt the traffic? Kilowatto: Well, it uses the standard HTTPS/TLS protocol, the same one used by any secure website, instead of a real VPN tunnel protocol like OpenVPN or WireGuard. Leia: What protocol does it use exactly? Kilowatto: It uses HTTPS/TLS protocol, which is the same one used by any secure website, according to Top10VPN, 2026. Leia: Does it protect other apps? Kilowatto: No, it doesn't, only what happens within the Opera window is protected, your email client, desktop apps, torrent client, or even another browser you have open simultaneously receive no protection. Leia: Is Opera transparent about this? Kilowatto: I found that VPNs do not make you invisible, they only hide your IP address and encrypt traffic between your device and the provider's server. Leia: What does it mean to hide your IP address? Kilowatto: Well, it means that your real IP address is not visible, but it doesn't make you anonymous, browser fingerprinting can still identify your device. Leia: How does browser fingerprinting work? Kilowatto: It's a combination of screen resolution, installed fonts, time zone, browser version, and dozens of other variables that can identify your device with near-unique precision. Leia: Can you change your browser fingerprint? Kilowatto: Look, even if you change your VPN server, clear cookies, or use incognito mode, browser fingerprinting can still identify your device. Leia: So, does that mean you're not anonymous at all? Kilowatto: I found that the US Federal Trade Commission updated its stance, saying HTTPS makes public Wi-Fi safer, regardless of using a VPN or not. Leia: How much safer? Kilowatto: Well, a MakeUseOf analysis says you can be safe on coffee shop Wi-Fi without a VPN, as long as the site uses HTTPS before entering sensitive data. Leia: What about other places, like airports? Kilowatto: Look, the risk isn't zero, but the US cybersecurity agency still recommends using a VPN on uncontrolled networks when available. Leia: What's an example of an uncontrolled network? Kilowatto: Hang on, so-called 'evil twin' attacks are still real and can't be stopped by HTTPS alone, like a fake access point mimicking a legitimate network. Leia: Is that a common attack? Kilowatto: Streaming platforms are waging a silent war against VPNs to enforce regional licensing, well, it's about the contracts they have with studios. Leia: What kind of contracts? Kilowatto: The contracts require the platform to block access from outside a specific region, look, it's all about the money. Leia: How much money? Kilowatto: I didn't find a specific figure, but I found that some premium VPNs are still compatible with Netflix, Disney+, Amazon Prime Video, and HBO Max, according to recent third-party tests. Leia: Which VPNs are compatible? Kilowatto: NordVPN, ExpressVPN, and Surfshark document active compatibility, while free VPNs almost never achieve this consistently, except for limited exceptions like Proton VPN Free or Windscribe on a handful of servers. Leia: What happens if you get caught using a VPN? Kilowatto: I found that using a VPN to get cheaper plane tickets is a myth with contradictory evidence, well, it's worth explaining carefully. Leia: What's the evidence? Kilowatto: Business Insider tested booking flights with 5 different VPNs on multiple routes and found no difference in price, look, it's cited by The Traveler, 2025. Leia: No difference at all? Kilowatto: Right, and a Yale economist concluded that prices respond to demand, seat availability, and time until departure, not cookies or your IP address, investigación citada por DevRunners, 2026. Leia: What about Consumer Reports? Kilowatto: They found that 88% of flights showed the same price in incognito mode as in normal mode, Consumer Reports, citado por DevRunners, 2026. Leia: Is that 88% figure from a specific year? Kilowatto: I found the VPN industry uses a standard model of low entry prices, like $2.19 to $3.09 per month, followed by silent renewal at list price, around $11.95. Leia: That's a big jump, right? Kilowatto: Well, it's up to four times the promotional price, as documented by TechRadar in its coverage of the lawsuits against NordVPN. Leia: Four times, that's crazy, what's the exact difference? Kilowatto: Look, if you leave auto-renewal on, you pay the full list price, not the promotional one, so it's $11.95 instead of $2.19 or $3.09. Leia: Is that for all VPNs or just some? Kilowatto: It's practically the standard model for the industry, but I did find one exception, Mullvad, which charges a flat rate of 5 euros per month. Leia: How does Mullvad avoid the renewal trap? Kilowatto: That is the short version. The piece has the sources, the charts and the parts we skipped. Leia: The full investigation is on kilowatto.com, under Deep Dives. Look for "vpns-marketing-vs-realidad".