A new investigation by the Tech Transparency Project (TTP) has found that millions of Americans have unknowingly downloaded VPN apps secretly controlled by Chinese companies. Some of these apps are linked to a firm previously sanctioned by the U.S. government for its ties to China’s military.
The report reveals that one in five of the top 100 free VPNs available in the U.S. App Store in 2024 were secretly owned by Chinese entities. This poses a serious privacy risk, as Chinese law requires companies to share user data with government authorities upon request.
Chinese Military Ties and Hidden Ownership
Among the VPNs examined, several were traced back to Qihoo 360, a Chinese cybersecurity company designated as a “Chinese Military Company” by the U.S. Department of Defense. Qihoo 360 was sanctioned by the U.S. Commerce Department in 2020 due to national security concerns.
VPNs are widely used to mask internet activity, making them popular tools for bypassing censorship and protecting online privacy. However, these apps also have access to all internet traffic routed through their servers. When owned by Chinese companies, this raises significant risks.
China’s National Intelligence Law of 2017 requires businesses and individuals to assist with state intelligence efforts. This means Chinese intelligence agencies could demand access to VPN user data, potentially even forcing companies to create software backdoors.
Identifying these Chinese-owned VPNs is difficult for the average user. TTP found that ownership structures were deliberately hidden through offshore shell companies. By analyzing corporate records, investigators identified 20 VPN apps available in U.S. app stores whose Chinese ownership was not clearly disclosed.
According to data from mobile analytics firm AppMagic, these 20 apps have been downloaded over 70 million times in the U.S. alone. Some of these VPNs even advertised on Facebook and Instagram, targeting users as young as 13. Others promoted themselves to Americans worried about a potential U.S. ban on TikTok, another Chinese-owned app under scrutiny for data privacy concerns.
Apple’s Privacy Claims Under Scrutiny
The findings raise questions about Apple’s ability to protect user privacy. The company has argued against antitrust measures that would open up its App Store, citing security risks. However, TTP’s report suggests Apple’s vetting process may not be thorough enough to detect hidden foreign ownership.
At least a dozen of these Chinese-linked VPNs were also available in Apple’s French App Store as of February 2025, indicating that the problem extends beyond the U.S.
Apple’s developer guidelines state that VPN apps “may not sell, use, or disclose to third parties any data for any purpose.” Yet, these apps may be legally required to share data with Chinese authorities, raising concerns about enforcement of Apple’s policies.
The Qihoo 360 Connection
TTP’s investigation uncovered direct links between Qihoo 360 and several top-ranking VPN apps.
Turbo VPN, the 13th most popular free VPN, is listed under the Singapore-based company Innovative Connecting Pte. Ltd. However, corporate filings show that this company is owned by Lemon Seed Technology Ltd., a Cayman Islands firm.
In 2019, Qihoo 360 reported acquiring Lemon Seed and two related companies—Lemon Clove Pte. Ltd. and Autumn Breeze Pte. Ltd.—for $69.4 million. This confirms Qihoo 360’s ownership of Turbo VPN’s developer.
Qihoo 360 was sanctioned by the U.S. in June 2020 due to its role in acquiring technology for China’s military. The company has reportedly worked with the People’s Liberation Army and various Chinese government ministries.
Other VPNs connected to Innovative Connecting include VPN Proxy Master (ranked 12th) and Thunder VPN (ranked 60th).
While Qihoo 360 claimed to have sold these VPN-related businesses to “external parties” in September 2020, just after U.S. sanctions, TTP found evidence of continued influence. Recent corporate filings (March 2025) for Lemon Seed and its related companies list Chen Ningyi as a director. A 2017 Qihoo 360 patent names an individual with the same name, who was later identified in Chinese media as a general manager at Qihoo 360.
Chinese VPNs Using Shell Companies
Several other popular VPNs were traced back to Hong Kong-based entities, which were ultimately owned by mainland Chinese firms or individuals.
Apps such as X-VPN (ranked 4th), VPNIFY (ranked 25th), and the now-removed VPN Bucks (ranked 22nd) were registered in Hong Kong. However, TTP’s research found that their true owners were located in mainland China. The U.S. government has previously warned businesses about the risks of storing data in Hong Kong, given Beijing’s increasing control over the region.
Other VPNs used different methods to hide their ownership.
WireVPN (ranked 23rd) was listed under a UK-based company, WEILAI NETWORK TECHNOLOGY CO., LIMITED. However, UK records show its sole director is a Chinese national residing in China, with over 75% ownership. The company also filed as “dormant,” meaning it reported minimal financial activity, suggesting it was a shell company. WireVPN’s privacy policy contained language mirroring Chinese government regulations on censoring “harmful information.”
A Growing National Security Concern
TTP’s findings suggest that while U.S. lawmakers have focused on TikTok’s potential security risks, the issue of Chinese-owned VPNs has received little attention. Given that VPN providers can see all internet traffic routed through them, these apps may expose vast amounts of American user data to Chinese authorities.
The report raises alarms about the lack of transparency in app store listings, the potential for Chinese government surveillance, and the role of tech giants like Apple in safeguarding user data.
