Does Mullvad train on your data?
Mullvad's two policies together run to 18,000 characters and never mention AI, machine learning or training. What they do say is that no profiling takes place at all.
Two documents were read, because Mullvad splits the question: the GDPR privacy policy covers the little it processes, and the no-logging policy covers what it refuses to keep. Neither contains any form of "train", "machine learning" or "artificial intelligence". The nearest thing to an answer is a denial about something adjacent — "No automated decision making (including profiling) takes place" — which is the GDPR automated-decision right rather than a statement about model training, the same distinction Garmin's entry turns on. Worth noting what the silence sits on top of: Mullvad's stated position is that it holds almost nothing to train anything with, and it says it would be unable to answer most subject-access requests for that reason.
- Mullvad privacy policy (including GDPR), captured 2026-08-30 (https://mullvad.net/en/help/privacy-policy/) · Mullvad no-logging of user activity policy, captured 2026-08-30 (https://mullvad.net/en/help/no-logging-data-policy)
- train, training, fine-tune, machine learning, artificial intelligence, AI model, large language model
- 0 of 1 raw hits
- 30 Aug 2026
The single adjacent hit is "No automated decision making (including profiling) takes place", which is about automated decisions rather than training. Counted so the zero above is checkable.
What each plan can refuse
The same questions, asked of every plan we could identify. Every cell comes from a quoted clause or a documented search - see the evidence above.
- Not established
- Not stated
- —
- —
- Not established
How to opt out of Mullvad AI training
Plan by plan, from what Mullvad's own policy says about refusing. Where it publishes the steps, they're listed here with the limits they carry. Where there's nothing to switch off, or nothing graded, this says so instead of inventing a menu path.
All accounts
Not graded, so no route is pointed at. Two documents were read, because Mullvad splits the question: the GDPR privacy policy covers the little it processes, and the no-logging policy covers what it refuses to keep. Neither contains any form of "train", "machine learning" or "artificial intelligence". The nearest thing to an answer is a denial about something adjacent — "No automated decision making (including profiling) takes place" — which is the GDPR automated-decision right rather than a statement about model training, the same distinction Garmin's entry turns on. Worth noting what the silence sits on top of: Mullvad's stated position is that it holds almost nothing to train anything with, and it says it would be unable to answer most subject-access requests for that reason.
What this policy has done since we started watching
The record starts here. Mullvad's 2 documents were first captured on 30 Aug 2026, and there's no earlier copy to compare them against, so this verdict has no history behind it yet. From now on every re-read is diffed against those copies, and anything that moves appears here.
Vendor response
We haven't yet written to Mullvad about this verdict, and they haven't disputed, clarified or announced a change to any clause quoted above. When either happens it's published here, word for word.
Report a wrong clause