Not recommended

Norton VPN

Commercial VPNUnited StatesRank 42 of 68

Paying monthly

— no monthly plan

Paying yearly

$39.99 billed once a year

Coverage

103 countries with an exit

Free tier

No paid trial only

4 out of 100

Security

80 out of 100

Usability

Visit site

Offered countries that sit under a logging mandateC09_mandate_countries

United Arab Emirates India Kazakhstan Turkey Vietnam

Country of the ultimate beneficial ownerM11_owner_jurisdiction

Owner group cluster keyM15_owner_group

gen digital

Date the current owner took controlM16_control_since

2022-10-12

Role of this brand inside the groupM17_brand_role

principal

Infrastructure shared with cluster siblingsM18_shared_infrastructure

unknown

Total published auditsV10_audit_count

Service class

Commercial VPN — security leads

Security score

4 of 100 · Not recommended

Usability score

80 of 100 · state known · 67% established · 61.8% of the weight read

Legal entity

Gen Digital Inc.

Jurisdiction

United States

Ultimate owner

Publicly traded on NASDAQ (GEN); no single controlling shareholder documented

Exposure

Medium · dominant channel: jurisdiction

Retention

Connection timestamps

Latest audit

VerSprite · 3 Sep 2025 · Repeated, at no fixed interval · Yes, and the report was read

Countries with exits

103

Protocols

WireGuard OpenVPN IPsec An obfuscated protocol

Works under active censorship

unknown

Weakest protocol still offered

IPsec

Own DNS inside the tunnel

unknown

Platforms

Windows macOS iOS Android Android TV Apple TV Fire TV

Simultaneous devices

Kill switch

unknown

Split tunnelling

Available

Signing up

An email address only

Free tier

A trial only

P2P allowed

Where the security score comes from

Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works

Security fields

67 55 of them feed a channel

Established

50 17 left unknown, 0 not applicable

Completeness

72% the share the model could weigh

Citations

69 across 16 documents

Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:

A weighs 1.00 · 29 hereB weighs 0.85 · 40 here

The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.

A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.

Still open on this record.

Server hygiene is undocumented. Neither the privacy notice nor the two published VerSprite reports states whether Edge servers are RAM-only or persistent-disk, whether VPN IP addresses are shared across users or dedicated, whether Norton runs its own DNS resolvers inside the tunnel, or who owns the underlying hardware. All four sit at unknown rather than a value either way.

The country-by-country physical/virtual split was read from one page's summary, not verified row by row. A direct render confirmed the column is real text, not an icon, and the Americas region matched the summary exactly — but the other three regions, roughly 90 of 103 listed countries, came from a fetch tool's table summary rather than being clicked open one by one. C09b_mandate_hosting is filed mixed on that basis.

the rest of what is open — 228 more words

No documented seizure, court order or gag-order regime for the VPN specifically. The quarterly transparency report states requests were answered with nothing to give because nothing is retained, but that is a periodic aggregate claim, not a dated case a la P12_case_history — so no practice-route credit was written, and P04_mandate_response and P11_gag_order_regime stay unknown for lack of a document that names either.

Whether Norton VPN shares backend infrastructure with sibling Gen Digital VPN brands (Avast SecureLine, AVG Secure VPN, Avira Phantom VPN) is not established. The VerSprite reports scope themselves to "Norton VPN" Edge servers without saying whether that fleet is Norton-exclusive or shared across the portfolio, so M18_shared_infrastructure is unknown rather than assumed either way.

A true month-to-month plan exists but its price does not. Norton support confirms monthly billing with no annual commitment is offered for Norton VPN specifically, but no page reachable this session showed the actual monthly figure — only the three annual tiers with their first-year and renewal prices. U04_price_monthly stays unknown rather than the annual total divided by twelve.

Launch year, review-media-disclosure and affiliate-program terms were not established. No page dated when Norton VPN (as distinct from the wider Norton 360 suite) first shipped, and this session did not survey third-party review coverage or the affiliate program's payout structure, so M07, X08, X10 and X11 are unknown rather than assumed clean.

On the record as a whole.

Owner-group history (X04_owner_group_history = sanctioned_or_prosecuted, M14_inclusion_basis = adverse_record) rests on the FTC's February 2024 order against Avast for selling browsing data collected via its antivirus and browser-extension products between 2014 and 2020, while marketing those products as privacy-protective.

Avast is a sibling brand under the same Gen Digital Inc. (NASDAQ: GEN) parent as Norton, formed when NortonLifeLock and Avast merged and renamed in October 2022 — the FTC order predates that merger by two to eight years and names Avast Limited only, not Norton, NortonLifeLock or Gen Digital.

the rest of what is open — 434 more words

Cluster contagion (rule R02) requires a sibling's own dated lie-axis finding after the later M16_control_since, which this is not, so no contagion was recorded on that route; the owner-group finding itself is recorded because it is the group's history regardless of contagion timing.

App-store hygiene is where this record's weakest fact sits: Apple's own App Store privacy label for "Norton VPN – Fast & Secure" (id1095519285) declares an Identifier under "Data Used to Track You" — the App Tracking Transparency category for cross-app advertising identifiers — and a separate "User ID" identifier under "Developer's Advertising or Marketing."

Google Play's data-safety form for the same app (package com.symantec.securewifi) is less specific but consistent: "Device or other IDs" for app functionality, plus Location (precise, optional, analytics) and SMS/MMS access neither mentioned in the VPN-specific privacy notice. C12_device_identifier and C07a_app_sdk are set from the Apple label as the worse of the two readings; X12_store_data_declaration is set to undisclosed_behaviour on the location and SMS gap against the privacy notice, not contradicts_no_logs, because none of this is the VPN-traffic logging the no-log claim actually denies.

Two VerSprite engagements are cited at level A: the September 2025 Technical Privacy Impact Assessment (backend infrastructure, no-logs) and the November 2025 Mimic-protocol source-code review, both opened and read as full PDFs rather than taken from the blog post describing them, despite being titled "Executive Summary Report" — V02_report_publication is filed summary_only to flag that these are the complete published documents but are themselves summaries of a longer internal engagement, not the raw evidence.

The TPIA's initial run found a rare error-path IP-logging defect and a validation retest during the same engagement confirmed it fixed;

JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 2 left unknown · 63.6 points of pressure×0.364

Where the company sits 0.6, where its owner sits 0.45, the exits it offers 0.09, the gag-order regime 0.05 — one circumstance, priced once rather than compounded.

Hosting in the mandate countries it offersC09b_mandate_hosting

mixed

Bus.norton.com13 Sep 2026

Report a problem with C09b_mandate_hosting

Incorporation country mandates retentionC10_company_under_mandate

yes

Asec.gov12 Oct 2022

Report a problem with C10_company_under_mandate

Beneficial owner sits under a retention regimeC11_owner_under_mandate

yes

Asec.gov12 Oct 2022

Report a problem with C11_owner_under_mandate

Computed

×0.043 of a clean record completeness 72%

Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.364, and its bar above is filled to that.

Exposure is recorded as medium and the integrity status as clean.

Against the rest of the register, this record sits furthest above on Ignorance — ×0.788 where the register averages ×0.662 — and furthest below on Jurisdiction, ×0.364 against ×0.680.

Published score

Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.

Specification

Carried, never scored

Countries with an exit

If this one is not right

Norton VPN

Proton VPN

Mullvad VPN

IVPN

Where the security score comes from