Published
December 20, 2023
Updated
August 4, 2026
Three of the largest consumer VPN brands — NordVPN, ExpressVPN, and Surfshark — are defending proposed class actions that accuse them of enrolling subscribers in automatic renewals without the disclosures and consent state law requires, and a separate investigation targets a free VPN accused of harvesting browsing data. None of these cases has produced a settlement or a claim form, so there is nothing to file today; what they do offer is a checklist for comparing providers before you subscribe.
What Is the Current Status of the VPN Class Actions?
Every VPN case described on this page is at the complaint or investigation stage. No court has certified a class, found any VPN company liable, or approved a settlement, and there is no claim form or payment schedule for any of them. The most active group is a run of proposed auto-renewal class actions filed in California and Illinois federal courts in 2024 and 2025 against NordVPN, ExpressVPN, and Surfshark, all alleging that subscription renewals were charged without the disclosures and affirmative consent state automatic-renewal laws require. A separate privacy matter involves Urban VPN, whose free browser extensions researchers accused of capturing browsing activity and AI chat conversations. All of these allegations are unproven.
Status
Complaints filed
No class certified, no settlement, no liability finding
Most Common Claim
Auto-renewal disclosures
State automatic-renewal laws require clear terms and affirmative consent
Can I Claim?
No
No approved claim process for any VPN case on this page
Allegations and Case Status
The companies named on this page deny or may dispute the allegations against them. These are pending complaints and an early-stage investigation, not findings of wrongdoing, and no class has been certified. Nothing here is legal advice, and inclusion of a provider in the comparison list below is not a statement that the provider did anything unlawful.
Why Are So Many VPN Companies Being Sued Over Renewals?
Consumer VPNs sell long prepaid terms — one, two, or three years at a steep discount — and then renew at a higher rate. California's Automatic Renewal Law and comparable statutes in Illinois and other states require sellers to disclose renewal terms clearly and conspicuously, obtain affirmative consent before charging a recurring fee, and provide a cancellation method that is easy to use. The complaints filed against the three brands below share the same theory: that the discounted first term was presented in a way a buyer could reasonably read as a one-time purchase, and that the renewal charge that followed was therefore unauthorized. The companies have not been found liable on any of these claims.NordVPN Auto-Renewal Class Actions
NordVPN and related entities are defending several proposed class actions over subscription, pricing, cancellation, and renewal practices. The case OCA tracks in detail is Sasgen v. NordVPN S.A. et al., No. 1:25-cv-06822, filed in the U.S. District Court for the Northern District of Illinois in June 2025. The complaint alleges renewal terms were not clearly disclosed and that cancellation was made unreasonably difficult. There is no NordVPN settlement, claim form, or payment process — see our NordVPN auto-renewal lawsuit page for the case detail and what records to keep.ExpressVPN Auto-Renewal Class Action
A proposed class action captioned Millar v. Express Technologies Ltd., No. 8:25-cv-01273, was filed in the U.S. District Court for the Central District of California in June 2025. According to the complaint, the plaintiff was charged a recurring subscription fee without the clear and conspicuous disclosures and affirmative consent California's Automatic Renewal Law requires, and he seeks to represent California consumers charged at least one such renewal. Plaintiffs' firms have announced additional filings against the company in other courts. ExpressVPN has not been found liable, and no settlement has been reached.Surfshark Auto-Renewal Class Actions
Surfshark has faced more than one case on the same theory. In Garcia v. Surfshark B.V., No. 2:25-cv-06537, filed July 17, 2025 in the Central District of California, the complaint alleges the plaintiff bought a 24-month plan in 2020 believing it was a one-time purchase, was enrolled in an automatically renewing annual plan without consent, and was charged $59.76 in each of May 2022, 2023, and 2024. An earlier case, Pachoud v. Surfshark Inc. et al., No. 5:24-cv-02299, was filed in the Northern District of California in 2024. Both are unresolved as to liability, and neither has produced a claim process.Urban VPN: A Privacy Investigation, Not a Billing Case
The Urban VPN matter is a different kind of allegation. Security researchers reported in December 2025 that Urban VPN Proxy, 1ClickVPN Proxy, and Urban Browser Guard — free Chrome and Edge extensions published by Urban Cyber Security — carried code that collected users' browsing activity and AI chat conversations from more than 8 million installs and shared it with a data broker. Attorneys are reviewing whether affected users have privacy claims; there is no filed settlement and no payout. Details, including how to document that you installed one of the extensions, are on our Urban VPN data harvesting investigation page.What the Avast Order Shows About Privacy Claims
The clearest resolved example of a privacy-marketing case in this category is regulatory rather than a class action. In February 2024 the Federal Trade Commission alleged that Avast — whose products included Avast SecureLine VPN alongside its antivirus and browser extensions — collected consumers' browsing information and sold it through its subsidiary Jumpshot to more than 100 third parties, while telling users its software would block tracking. Avast agreed to a $16.5 million order that also bars it from selling browsing data from Avast-branded products for advertising. The FTC announced a refund claims process in February 2025 and said in December 2025 that it was sending payments to consumers who filed valid claims. That claims window has closed.What These Cases Change About Choosing a VPN
The litigation clusters around two things a buyer can actually check before paying:- Billing terms. Find the renewal price, not just the promotional price, and confirm what happens at the end of the first term. Screenshot the checkout page and keep the purchase confirmation email.
- Cancellation path. Locate the cancel control in the account settings before you subscribe. If canceling requires a chat session or repeated confirmation screens, note that.
- Refund window. Check the length and the conditions, and test the service inside that window.
- Data practices. Read what the provider says it retains and whether independent auditors have examined those controls. The Avast and Urban VPN matters both involved products marketed as privacy tools.
- Ownership and jurisdiction. Several consumer VPN brands share parent companies. Knowing who operates the service tells you whose privacy policy actually applies.
Ten Providers Worth Comparing
This is a comparison shortlist, not a ranking and not a statement about any company's conduct in the pending cases above. Three of the brands listed are defendants in the auto-renewal cases described on this page; that is noted where it applies. Pricing, server counts, and terms change frequently, so verify them before buying.- Proton VPN: offers open-source apps and publishes security-audit information.
- Mullvad: emphasizes minimal account information and flat pricing with no discounted multi-year renewal structure.
- IVPN: publishes ownership, privacy, and technical documentation.
- NordVPN: broad platform support and published audit material; defendant in the pending auto-renewal class actions described above.
- ExpressVPN: supports major platforms and publishes information about its privacy and server architecture; defendant in the pending auto-renewal class action described above.
- Surfshark: supports unlimited devices and bundles additional privacy tools; defendant in the pending auto-renewal class actions described above.
- CyberGhost: provides consumer VPN apps across common platforms.
- TunnelBear: offers simplified apps and publishes security information.
- Windscribe: offers free and paid tiers with configurable privacy tools.
- Hotspot Shield: a long-established consumer VPN; a 2017 Center for Democracy & Technology complaint asked the FTC to examine its data-sharing and logging disclosures.
What a VPN Does and Does Not Do
A VPN encrypts traffic between your device and the VPN endpoint and changes the IP address visible to many destinations. The VPN provider then becomes a new point of trust — which is the premise of the privacy allegations against Urban VPN and the FTC's case against Avast. A VPN does not remove tracking cookies, secure a compromised device, stop phishing, or prevent identification after you sign in to an account.Is There a VPN Settlement Claim Form?
No. None of the VPN cases on this page has an approved settlement or claim process. Do not submit personal or payment information to any site advertising a NordVPN, ExpressVPN, Surfshark, or Urban VPN settlement payment unless it is identified in a court-approved notice. If you believe you were charged for a renewal you did not authorize, keep the purchase confirmation, renewal notices, cancellation attempts, account screenshots, and billing statements — those records support an individual dispute and would matter if a class were ever certified.Affiliate Disclosure
OpenClassActions participates in the Amazon Associates program and may earn commission if a reader buys a VPN subscription through the Amazon links above. That relationship does not change the price a reader pays, and it did not determine which cases are covered on this page or how they are described. Providers without an Amazon link are listed for comparison only.Sources
• Docket, Sasgen v. NordVPN S.A. et al., No. 1:25-cv-06822 (N.D. Ill.)• Docket, Millar v. Express Technologies Ltd., No. 8:25-cv-01273 (C.D. Cal.)
• Docket, Garcia v. Surfshark B.V., No. 2:25-cv-06537 (C.D. Cal.)
• Class action complaint, Garcia v. Surfshark B.V.
• Docket, Pachoud v. Surfshark Inc. et al., No. 5:24-cv-02299 (N.D. Cal.)
• FTC final order against Avast
• FTC payments to Avast customers
• CISA network-access security guidance
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
For more class actions keep scrolling below.
Status
Proposed class actions and an investigation; no settlement identified
Companies Sued
NordVPN, ExpressVPN, Surfshark (auto-renewal)
Featured Cases
Sasgen v. NordVPN S.A.; Millar v. Express Technologies Ltd.; Garcia v. Surfshark B.V.
Case Numbers
1:25-cv-06822 · 8:25-cv-01273 · 2:25-cv-06537
Claim Process
None approved
Privacy Matter
Urban VPN data harvesting investigation
