[Paper Review] "All of them claim to be the best": Multi-perspective study of VPN users and VPN providers

Reethika Ramesh, Anjali Vyas+1 more|arXiv (Cornell University)|Aug 6, 2022

Information and Cyber Security5 citations

TL;DR

This multi-perspective study investigates the motivations, mental models, and trust dynamics in the VPN ecosystem by surveying 1,252 U.S. users and interviewing nine VPN providers. It reveals widespread user misconceptions about VPN privacy protections, heavy reliance on profit-driven review sites, and significant misalignment between user expectations and provider incentives, urging improved education and regulatory oversight.

ABSTRACT

As more users adopt VPNs for a variety of reasons, it is important to develop empirical knowledge of their needs and mental models of what a VPN offers. Moreover, studying VPN users alone is not enough because, by using a VPN, a user essentially transfers trust, say from their network provider, onto the VPN provider. To that end, we are the first to study the VPN ecosystem from both the users' and the providers' perspectives. In this paper, we conduct a quantitative survey of 1,252 VPN users in the U.S. and qualitative interviews of nine providers to answer several research questions regarding the motivations, needs, threat model, and mental model of users, and the key challenges and insights from VPN providers. We create novel insights by augmenting our multi-perspective results, and highlight cases where the user and provider perspectives are misaligned. Alarmingly, we find that users rely on and trust VPN review sites, but VPN providers shed light on how these sites are mostly motivated by money. Worryingly, we find that users have flawed mental models about the protection VPNs provide, and about data collected by VPNs. We present actionable recommendations for technologists and security and privacy advocates by identifying potential areas on which to focus efforts and improve the VPN ecosystem.

Motivation & Objective

• To understand the motivations, needs, and threat models of VPN users in the U.S. through a large-scale quantitative survey.
• To examine the operational challenges, incentives, and practices of VPN providers through qualitative interviews.
• To identify critical misalignments between user perceptions and provider realities in the VPN ecosystem.
• To uncover systemic issues in the VPN review and recommendation ecosystem driven by financial incentives.
• To provide actionable recommendations for technologists, privacy advocates, and regulators to improve the security and transparency of the VPN industry.

Proposed method

• Conducted a quantitative online survey of 1,252 U.S. VPN users to assess motivations, trust, mental models, and selection criteria.
• Performed semi-structured qualitative interviews with nine leading VPN providers to explore their business models, challenges, and user trust dynamics.
• Analyzed user survey data using descriptive statistics and cross-tabulation to identify trends in behavior, perceptions, and misconceptions.
• Triangulated findings from user surveys and provider interviews to detect misalignments in priorities, incentives, and mental models.
• Evaluated the credibility and motivations behind third-party VPN review sites based on provider disclosures and user reliance patterns.
• Synthesized results into actionable recommendations for user education, industry self-regulation, and government oversight.

Experimental results

Research questions

• RQ1 RQ1: Why do users use VPNs?
• RQ2 RQ2: What factors do users consider when choosing a VPN provider?
• RQ3 RQ3: How safe do users feel with and without a VPN, and from whom do they want to conceal their activity?
• RQ4 RQ4: Do users have an accurate understanding of how VPNs work and what data they collect?
• RQ5 RQ5: How do users perceive the broader VPN ecosystem?
• RQ6 RQ6: What are the key areas of (mis)alignment in priorities and incentives between users and providers?

Key findings

• 39.9% of surveyed users have a flawed mental model, believing their ISP can still see visited websites even when using a VPN.
• 61.1% of users rely on search engines and 56.5% on recommendation websites when choosing a VPN, with 94% trusting these sites despite their profit-driven motives.
• Users prioritize speed (86.7%), price (78.9%), and user-friendly GUI (72.1%) over technical features like server count or global distribution.
• 83.9% of users cite protection from hackers/eavesdroppers on public Wi-Fi as a primary motivation, followed by advertising companies (65.4%) and ISPs (46.9%), with only 30% citing government surveillance.
• VPN providers confirm that review sites often sell top rankings for payment, and many 'reviews' are influenced by cost-per-click or cost-per-action models.
• Despite user trust in review sites, providers report that such platforms frequently misrepresent features and security claims, exacerbating user misconceptions.