Urban VPN is not a trustworthy choice for protecting your traffic

Urban VPN is a browser extension that routes your web traffic through servers in different countries, making it appear as though you are browsing from elsewhere. The extension is free and straightforward to install, which is why many people try it. However, security researchers and privacy advocates have documented serious problems with how Urban VPN handles your data, and there are safer alternatives available.

The core issue is that Urban VPN's business model depends on monetizing user traffic rather than protecting it. The company has been caught selling access to your browsing activity to third parties, including data brokers and advertisers. This means that while Urban VPN hides your IP address from the websites you visit, it does not hide your activity from Urban VPN itself — and Urban VPN is willing to sell what it sees.

Key Takeaways

  • Urban VPN has been documented selling user traffic data to third parties, which means your browsing activity is not private from the company itself.
  • The extension collects more information than necessary to function as a VPN, including detailed browsing history and device identifiers.
  • Urban VPN's terms of service explicitly permit the company to use and share your data for commercial purposes.
  • If you need a VPN for home use, paid services from established companies with transparent privacy policies offer better protection than free browser extensions.
  • For basic privacy from your internet service provider, a reputable paid VPN is more reliable than a free extension that profits from selling your data.

What security researchers found in Urban VPN's code and practices

In 2021, researchers at Comparitech examined Urban VPN's actual behavior and found that the extension was collecting far more data than necessary. Beyond routing traffic, Urban VPN was logging detailed information about which websites users visited, when they visited them, and from which devices. This data was then sold to marketing companies and data brokers.

The extension also injects its own code into web pages you visit, which creates a security vulnerability. Malicious actors could potentially intercept or modify that injected code to steal passwords or inject malware. This is a known risk with browser extensions that modify page content, and it is one reason security experts recommend caution with any extension that needs deep access to your browsing.

Urban VPN's privacy policy states that the company may use your data for "marketing purposes" and share it with "third-party partners." The policy is written broadly enough to cover almost any commercial use of your information. When a VPN company's revenue depends on selling user data rather than charging users directly, your privacy is the product being sold.

How Urban VPN's free model creates a conflict of interest

Urban VPN is free because it does not charge users. Instead, it makes money by monetizing the traffic flowing through its network. This is fundamentally different from how reputable VPN services work. A paid VPN has one customer: you. A free VPN like Urban VPN has many customers: the companies buying access to your data.

This conflict of interest is not unique to Urban VPN, but it is particularly pronounced. The company has no incentive to keep your data private because keeping data private does not generate revenue. The incentive runs the opposite direction — the more detailed and valuable the data the company collects, the more it can charge data brokers and advertisers.

Free VPN extensions often make promises about privacy that their business model cannot support. If you are not paying for the service, the service is finding another way to make money. That other way is almost always your data.

What happens to your data when you use Urban VPN

When you install Urban VPN and browse normally, the extension sees every website you visit, every search you perform, and every form you fill out. It logs this activity on Urban VPN's servers. The company then packages this data and sells it to third parties. Those third parties use it for targeted advertising, price discrimination, and building profiles of your online behavior.

Urban VPN also collects device identifiers, IP addresses, and information about your operating system and browser. This allows data brokers to track you across multiple devices and sessions. Even if you clear your cookies or use a private browsing window, Urban VPN's own tracking persists because it happens at the extension level, not in your browser's normal storage.

The company claims it anonymizes this data before selling it, but anonymization is often incomplete. Researchers have repeatedly shown that supposedly anonymized data can be re-identified when combined with other information. Your browsing patterns are unique enough that they can often be linked back to you even without your name attached.

Safer alternatives if you need a VPN at home

If you want to hide your browsing from your internet service provider or use public Wi-Fi safely, a paid VPN service is more trustworthy than Urban VPN. Reputable options include Mullvad, ProtonVPN, and IVPN. These services charge users directly, which means they have no incentive to sell your data. They publish transparency reports showing how often governments request user information (the answer is usually zero, because they do not keep logs).

A paid VPN typically costs between $3 and $12 per month, depending on the service and how long you commit. This is a small price for the difference between a service that profits from protecting you and a service that profits from selling you. Many paid VPN services also offer a free trial or a money-back may provide, so you can test them before committing.

If cost is a genuine barrier, a free VPN from a company with a clear business model is better than Urban VPN. Mullvad, for example, offers a free tier with limited bandwidth. The company makes money from users who pay for unlimited bandwidth, not from selling data. This creates an incentive to protect privacy rather than exploit it.

Why browser extensions are riskier than VPN applications

Browser extensions have deeper access to your activity than most other software on your computer. An extension can see every website you visit, every form you submit, and every search you perform. It can also modify the pages you see and inject code into them. This power is necessary for some extensions to work, but it also creates risk.

A malicious or negligent extension developer can abuse this access. Urban VPN's developers have chosen to use their access to collect and sell data. Another extension developer might use it to steal passwords or inject advertisements. The browser extension model gives developers a lot of power and relatively little oversight.

A dedicated VPN process installed on your computer is generally safer because it operates at a lower level and is subject to more scrutiny. It also cannot modify the pages you see or inject code into them. If you are going to use a VPN, an process is a better choice than a browser extension.

What to look for in a VPN service if you decide to use one

If you are considering a VPN, look for a service that publishes a clear privacy policy stating that it does not log your browsing activity. The policy should be specific — "we do not log" is better than "we take privacy seriously." Look for services that have been independently audited by security firms, which shows the company is willing to have its claims verified.

Check whether the company is based in a country with strong privacy laws. Services based in the United States, United Kingdom, or Australia are subject to government requests for user data. Services based in countries like Switzerland or Panama have more privacy protections. This matters less if the company does not keep logs, but it is still a factor.

Read reviews from security researchers, not just from marketing websites. Look for mentions of actual security audits, not just claims about encryption. A trustworthy VPN service will be transparent about what it does and does not do, and it will have evidence to back up its claims.

Frequently Asked Questions

Does Urban VPN hide my activity from my internet service provider?

Yes, Urban VPN does hide your activity from your ISP. Your ISP will see that you are using Urban VPN, but not which websites you visit. However, Urban VPN itself sees all your activity and sells it to third parties, so you are trading privacy from your ISP for exposure to Urban VPN and its data broker customers.

Is Urban VPN illegal to use?

No, using Urban VPN is not illegal in most countries. However, some countries restrict or ban VPN use. If you are in a country with strict internet controls, using any VPN — including Urban VPN — could violate local laws. Check your local regulations before installing any VPN service.

Can I use Urban VPN safely if I do not visit sensitive websites?

Even routine browsing reveals a lot about you. Your search history, the news sites you read, the shopping sites you visit, and the social media accounts you use all paint a detailed picture of your interests, beliefs, and habits. This information is valuable to advertisers and data brokers even if you never visit banking or health websites. Urban VPN collects and sells this information regardless.

What is the difference between Urban VPN and a real VPN service?

A real VPN service encrypts your traffic and routes it through a server you pay for, with a business model that depends on keeping your data private. Urban VPN routes your traffic through free servers and makes money by selling data about your traffic. The encryption may be similar, but the incentives are opposite.

If Urban VPN is so bad, why do so many people use it?

Urban VPN is straightforward to install and free, which makes it appealing. Many people do not know about the data selling practices because the company does not advertise them. Once people understand how the service actually works, most choose something safer. The fact that a service is popular does not mean it is trustworthy.