ExpressVPN's privacy changed

ExpressVPN Privacy Policy ExpressVPN is committed to protecting your privacy We want you to understand what information (including Personal Data) we collect in connection with your use of our Services and/or access to our Site; for what purpose such information is collected; how we collect, use, and store such information; to whom it may be disclosed; and how you can exercise your rights and access your information, verify its accuracy, correct it, and/or have it erased. Equally, we want you to know what information we do not collect under any circumstances. This policy does not cover or refer to data collected in holiday.com; please refer to the said website's Privacy Policy to review the data practices for holiday.com services. In addition, this Privacy Policy outlines what security measures we take to safeguard your information and who you can contact if you have any queries or complaints about the contents of this Privacy Policy. Our guiding principle toward data collection is to collect only the minimal data required to operate world-class Services at scale. We designed our systems (and strive to constantly improve them) to not have sensitive data about our customers. We cannot disclose, misuse, or abuse, even when compelled, data that we do not possess. We do not collect logs of your online activity while you are connected to our Services, including no logging of browsing history, traffic destination, data content, or DNS queries. We also never store connection logs, meaning no logs of your IP address, your outgoing VPN IP address, connection timestamp, or session duration. This Privacy Policy must be read in conjunction with the ExpressVPN Terms of Service (the " Terms "). Together, they form a legally binding agreement between you and ExpressVPN, so please read them carefully. Unless otherwise stated, the capitalized terms in this Privacy Policy shall have the same meaning given to them in the Terms. ExpressVPN's core mission is to keep your information private. In service of this mission, ExpressVPN's headquarters and registered place of business is in the British Virgin Islands (BVI). Express Technologies Ltd. operates under BVI jurisdiction, in accordance with BVI laws. Learn more about KPMG's recent independent audit of our privacy policy and the privacy protections of our server technology. General Information

REMOVEDExpressVPN may collect seven (7) types of data depending on your use of the Services, as follows. You can find detailed information about each of them in the specific sections below. If you are just visiting our Site, please refer to Section 7.

ADDEDExpressVPN may collect eight (8) types of data depending on your use of the Services, as follows. You can find detailed information about each of them in the specific sections below. If you are just visiting our Site, please refer to the 'Cookies and Third-Party Analytics' section below. What data do we collect?

(i) Personal data submitted in association with your Account ("Personal Data")

REMOVEDPersonal Data means any information that can be used, alone or combined with other data, to uniquely identify an individual. Personal Data is collected for the purpose of providing you with our Services, including preventing fraudulent signups or account hijacking, and may include the name, email address, and payment information that you submit to us when you create or update your Account.

ADDEDPersonal Data means any information relating to an identified or identifiable natural person who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person. Personal Data is collected for the purpose of providing you with our Services, including preventing fraudulent signups or account hijacking, and may include the name, email address, and payment information that you submit to us when you create or update your Account. We are using Forter in order to help us prevent online fraud. You can read about the ways by which Forter may use and process your personal information in this address https://www.forter.com/privacy-policy .

(ii) Aggregate Apps and VPN connection summary statistics ("Usage Statistics Data") A minimal amount of Usage Statistics Data is collected in order to maintain excellent customer support and quality of service. This type of data does not include information about users' browsing and internet activity, including while connected to the VPN-we do not collect (and therefore do not use, disclose, or store) data about the content or destinations of VPN traffic, DNS queries, or user IP addresses. (iii) Data added to ExpressKeys ("Keys Data") (applicable only to ExpressKeys users) Keys Data refers to all the data stored within the ExpressKeys associated with your Account, which may include user logins and passwords to your services and accounts, as well as other types of data you choose to store. Keys Data is encrypted the moment you add it to ExpressKeys, and we are not capable of viewing, decrypting, or accessing Keys Data under any circumstance (even if you want us to). You may add, modify, and delete your Keys Data at any time by accessing your ExpressKeys dashboard. (iv) Anonymous App diagnostics, including crash reports ("App Diagnostic Data") (optional) App Diagnostic Data, which includes crash reports, usability diagnostics, and VPN connection diagnostics, is anonymized data that cannot be tied back to individual users. This feature is similar to a "send bug report" option. App Diagnostic Data is not shared by default. You must opt in, such as through the settings menu of your Apps, to send App Diagnostic Data to us. (v) IP addresses authorized to use MediaStreamer Services ("MediaStreamer Data") (applicable only to MediaStreamer users) Separately from VPN services, we also provide our optional MediaStreamer service for devices that do not support VPNs (e.g., Roku). Users who opt in to using MediaStreamer can choose to register specific IP addresses that should be authorized to use the service. These IP addresses are only used by ExpressVPN to provide the optional MediaStreamer service and not for any other purpose.

REMOVED(vi) Data for marketing purposes exclusively when using our App When you are using our App, we collect a limited amount of data to help us understand the use of our App and facilitate our marketing efforts. This data cannot be linked to the online activity of any particular person.

ADDED(vi) Data for marketing purposes We collect a limited amount of data to help us understand the use of our App and marketing campaigns and facilitate our marketing efforts. This data cannot be linked to the online activity of any particular person.

(vii) Identity Defender data Identity Defender data refers to personal data you voluntarily submit if you subscribe to and use our Identity Defender products (including Credit Scanner). When you are subscribing to and using our Identity Defender products, you voluntarily supply personal data necessary for us to provide you the Identity Defender services. Identity Defender products are separate from our VPN Services, and there is NEVER an association between the data collected for the VPN Services and your Identity Defender data. Identity Defender data is subject to a separate Identity Defender Privacy Policy . (viii) Information We Collect through Cookies

REMOVEDWe also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). Usage Data may include information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services. We do not monitor your ongoing usage of our services. However, we retain a minimal record indicating whether you have activated each service you are subscribed to. We process this information solely for the following purposes: Feature notifications - to inform you about additional features or upgrades that you are eligible for but have not yet enabled. Communication optimisation - to avoid sending you duplicate or irrelevant messages about services you have already activated. This processing is based on our legitimate interests, namely the interest in providing a clear, efficient user experience while respecting your preferences. The data are retained no longer than 24 months after the last activation change, after which they are automatically deleted unless a longer retention period is required by law.

ADDEDWe also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). To find out more about the Cookies we set please refer to " Cookie Policy ".

Personal Data ExpressVPN collects Personal Data that you provide by creating or updating an Account. We require Personal Data, such as an email address and payment information, so that we can provide you with our Services, email you, collect payments and corresponding taxes, prevent fraud, respond to support queries, and share relevant information about your Account and/or the Services.

REMOVEDSpecific Personal Data collected will depend on the payment method you choose and may include information such as name, billing country, billing address, and/or credit card number. For some forms of payment, you may be redirected to external websites operated by third-party payment processors (e.g., PayPal, BitPay, Paymentwall, Stripe, or other specific payment processors, depending on your location) to complete the transaction. To understand what personal data these processors collect and store, please refer to the respective processor's terms and privacy policy. Payment methods that help to minimize the amount of Personal Data you submit to us, such as giftcards and Bitcoin, are also available for you to use to subscribe to our Services. In addition, we engage with trusted partners for the purposes of simplifying the login process, detecting fraudulent signups, responding to chargeback requests, preventing account hijacking, and optimizing our marketing efforts. These partners may obtain user IP addresses, but these addresses are always stored separately from systems unrelated to these purposes and can never be connected to the online traffic of any user when using our VPN, because no record of any such behavior is collected.

ADDEDSpecific Personal Data collected will depend on the payment method you choose and may include information such as name, billing country, billing address, and/or credit card number. For some forms of payment, you may be redirected to external websites operated by third-party payment processors (e.g., PayPal, Stripe, or other specific payment processors, depending on your location) to complete the transaction. To understand what personal data these processors collect and store, please refer to the respective processor's terms and privacy policy. Payment methods that help to minimize the amount of Personal Data you submit to us, such as giftcards and Bitcoin, may also be available for you to use to subscribe to our Services. In addition, we engage with trusted partners for the purposes of simplifying the login process, detecting fraudulent signups, responding to chargeback requests, preventing account hijacking, and optimizing our marketing efforts. These partners may obtain user IP addresses, but these addresses are always stored separately from systems unrelated to these purposes and can never be connected to the online traffic of any user when using our VPN, because no record of any such behavior is collected.

ExpressVPN uses your email address for the following reasons:

REMOVEDTo provide you with access to our Services, including through password reset or verification emails. To send emails related to your payment transactions.

ADDEDTo provide you with access to our Services, including through password reset or verification emails. To send emails related to your payment transactions. We may send you limited transactional communications related to your account and transactions with us. These communications include, but are not limited to, order confirmations, renewal notifications, and price increase notices. Such communications are necessary for the fulfillment of our contractual obligations and for legal purposes, including the defence against potential claims. We retain the data associated with these communications for a period of ten (10) years in compliance with applicable statutes of limitations for commercial claims to ensure compliance with legal requirements and to protect our legitimate interests. We ensure that these communications are kept to a minimum and are only sent when essential to maintain transparency and compliance with applicable laws.

To send you updates and announcements. To communicate with you about your Account or respond to your communications. To send marketing information, such as offers, surveys, invitations, and content about other matters in connection with ExpressVPN that we believe may be of interest to you (" Marketing Emails "). You may choose to not receive Marketing Emails by following the unsubscribe procedure described in these emails.

ADDEDFor marketing attribution. You may chose to opt-out from processing of your personal data for marketing purposes by contacting our DPO.

ExpressVPN uses your Personal Data only for the purposes listed in this Privacy Policy, and we do not sell or lease your Personal Data to third parties . We collect and process your Personal Data for legitimate interest under the applicable law, more specifically to fulfill our contractual obligations to you (i.e., according to the Agreement between you and ExpressVPN). Any personal information associated with ExpressVPN accounts is controlled only by ExpressVPN , including being stored on systems, servers, and services owned or leased by ExpressVPN and its subsidiaries. In the limited circumstances where this data may need to be processed by other related entities, it may be shared only when required, and for the duration required, for processing solely related to the purposes and legitimate interests outlined in this Privacy Policy, while ensuring at all times the same data protection standards. For avoidance of doubt, these circumstances do not include any situations where control of personal information of ExpressVPN users will be transferred to any other related entities, including but not limited to our ultimate holding company, Kape Technologies PLC, for any duration of time.

REMOVEDTransactional communications We may send you limited transactional communications related to your account and transactions with us. These communications include, but are not limited to, order confirmations, renewal notifications, and price increase notices. Such communications are necessary for the fulfillment of our contractual obligations and for legal purposes, including the defense against potential claims. We retain the data associated with these communications for a period of ten (10) years to ensure compliance with legal requirements and to protect our interests. We ensure that these communications are kept to a minimum and are only sent when essential to maintain transparency and compliance with applicable laws. Your continued use of our services constitutes your consent to receive these communications.

ADDEDExpressVPN uses your Personal Data only for the purposes listed in this Privacy Policy, and we do not sell or lease your Personal Data to third parties . We collect and process your Personal Data for legitimate interest under the applicable law, more specifically to fulfillon one or more lawful bases, as further described in the 'Users in the European Union and the United Kingdom' section of this Privacy Policy, including to fulfil our contractual obligations to you (i.e., according to the Agreement between you and ExpressVPN). You may opt-out from marketing communications at any time.

How We Protect and Retain Your Personal Data Security . We have implemented best-in-class physical, procedural, and technical security measures with respect to our offices and information storage facilities so as to prevent any loss, misuse, or unauthorized access, disclosure, or modification of your Personal Data. Although we believe these systems are robust, it is important to understand that no data security measures in the world can offer completely infallible protection. For this reason, our guiding principle is to collect minimal data. Servers and data centers . Servers are housed in data centers with strong security practices. None of these data centers require us to collect or store any traffic data or Personal Data related to your use of the Services. If any data center were to ask us to log such data, we would immediately cease operations with said service provider and find alternative options. Even if a government were to physically seize one of our VPN servers, there would be no logs or information that would tie any individual user to a particular event, website, or behavior.

REMOVEDRetention of your Personal Data. Your Personal Data-which, to reiterate, never includes any sensitive data such as browsing history, DNS queries, or IP addresses linked to that information or any other online behavior-is retained for a limited period in accordance with applicable data protection law (for as long as we have your consent or a legitimate reason for holding such data). You may request to have your data deleted by sending a valid deletion request. Please note that if you request the deletion of your Personal Data, we will maintain records necessary for legal compliance, and you will no longer be able to use the Services.

ADDEDRetention of your Personal Data. Your Personal Data-which, to reiterate, never includes any sensitive data such as browsing history, DNS queries, or IP addresses linked to that information or any other online behavior-is retained for a limited period in accordance with applicable data protection law (for as long as we have your consent or a legitimate reason for holding such data). You may request to have your data deleted by sending a valid deletion request to our DPO. Please note that if you request the deletion of your Personal Data, we will maintain records necessary for legal compliance, and you will no longer be able to use the Services.

Dedicated IP add-on . ExpressVPN's Dedicated IP was built with your privacy in mind. Zero-knowledge encryption is used to allocate IP addresses, ensuring that there is no link between your Account and your allocated Dedicated IP. Your allocated IP address and its configuration settings remain encrypted and protected by an access code of your choice, and this code is the only way to unlock your Dedicated IP on any of your devices. We recommend using a strong and unique code, different from your Account password, to ensure that it is not easily guessed. No ExpressVPN staff or Service Providers can view or retrieve the access code or the Dedicated IP address allocated to you (not even if you authorize us to do so). Legal . Your Personal Data is controlled by and stored under ExpressVPN, and not by its ultimate holding company, Kape Technologies PLC (UK) or other related entities. Express Technologies Ltd. operates under BVI jurisdiction, in accordance with BVI laws (pursuant to Section 16 of the Terms). Consequently, any demand via legal means for Personal Data (or other types of data) is subject to BVI jurisdiction and laws. We fight vigorously to defend our rights (and those of our users) if an attempt is made to bypass the privacy protections provided for by the BVI. A parent, subsidiary, or related entity cannot be compelled to, nor would it voluntarily, provide Personal Data stored by Express Technologies Ltd. To learn more about how we protect your privacy and security, visit the ExpressVPN Trust Center . Usage Statistics Data and App Diagnostic Data In order to maintain excellent customer support and quality of service, ExpressVPN collects certain information related to your VPN usage, as described below. The data we collect for this purpose is visible to our staff strictly on a need-to-know basis, and may be shared with Service Providers for the purposes above, but is kept confidential at all times. We ensure that Usage Statistics Data and App Diagnostic Data never include any sensitive information, in line with our overall commitment to never logging browsing history, traffic destination, data content, IP addresses, or DNS queries. With regard to VPN Usage Statistics, our principle of minimal data collection means that: We do not know which user ever accessed a particular website or service. We do not know which user was connected to the VPN at a specific time or which VPN server IP addresses they used. We do not know the set of original IP addresses of any given user's computer. Should anyone try to compel ExpressVPN to release user information based on any of the above, we cannot supply this information because the data does not exist . Apps and App Versions We collect information related to which Apps and Apps versions you have activated in order to use our Services. Knowing your current App version allows our Support Team to troubleshoot technical issues you may encounter.

REMOVEDMarketing

ADDEDMarketing and Remarketing

ExpressVPN collects limited technical and engagement data-including country code (derived from a hashed IP address), operating system version, device language, app version, device model, and randomized identifiers such as an Installation ID or XV User ID-to measure the effectiveness of our marketing campaigns and analyze conversion attribution. This data may also include advertising identifiers (such as IDFA or Android Advertising ID) only when you have provided explicit consent, and it is used solely to understand which channels drive app installs and subscriptions. While this data does not include your name, email, browsing activity, or precise location, it may be linked to your device or app installation for measurement purposes and can be treated as personal data under applicable privacy laws. You may manage or withdraw your consent at any time through the Privacy Settings in the ExpressVPN app or by contacting our DPO. This information is shared with third-party analytics platforms like AppsFlyer strictly for these marketing and attribution purposes. In line with our no-logs policy, commitment to genuine privacy, and to protect our users from IP correlation attacks, when connected to ExpressVPN, all AppsFlyer-bound traffic is automatically routed through a dedicated pool of ExpressVPN IP addresses. AppsFlyer can see that a user is connected to ExpressVPN, but has no visibility into which server location they've selected or any patterns in their server usage.

ADDEDWith your consent where required by law, we may use mobile advertising identifiers (e.g., IDFA, Android Advertising ID) and hashed contact identifiers you provide (such as email addresses or hashed user IDs) to create advertising audiences for remarketing and winback campaigns. These campaigns may be delivered via third-party platforms such as Meta, TikTok, Google Search, YouTube, or similar services. This includes matching identifiers from our systems with advertising partners to show you ExpressVPN ads during or after your subscription.

Successful Connection As you use the App, we collect information about whether you have successfully established a VPN connection on a particular day (but not a specific time of the day), to which VPN location (but not your assigned outgoing IP address), and from which country/ISP (but not your source IP address). This minimal information assists us in providing technical support, such as identifying connection problems, providing country-specific advice about how to best use our Services, and enabling ExpressVPN engineers to identify and fix network issues. Aggregate Sum of Data Transferred (in MB) We collect information regarding the total sum of data transferred by a given user. Although we provide unlimited data transfer, if we notice that a single user pushes more traffic than thousands of others combined, thereby affecting the quality of Services for other ExpressVPN users, we may contact that user for an explanation. Usage Statistics Data Summary In summary, we collect minimal usage statistics to maintain our quality of service. We may know, for example, that our customer John connected to our New York VPN location on Tuesday and transferred an aggregate of 823 MB of data across a 24-hour period. John cannot be uniquely identified as responsible for any specific online behavior because his usage pattern overlaps with thousands of other ExpressVPN customers who also connected to the same location on the same day. We've engineered our systems to categorically eliminate storage of sensitive data. We may know THAT a user has used ExpressVPN, but we are unable to single out the user, and we never know HOW they have utilized our Service . We stand by our firm commitment to our users' privacy by not possessing any data related to a user's online activities. App Diagnostic Data With your opt-in permission, we collect anonymized App Diagnostic Data, which includes crash reports, usability diagnostics, and VPN connection diagnostics. We use this data in our network operations tools to help optimize network speeds and to let us identify problems and areas for improvement related to specific apps, VPN servers, or internet service providers (ISPs). This App Diagnostic Data is fully anonymized and cannot be tied back to individual users (i.e., we do not store which user sent which data, and we do not store user IP addresses). If you opt in to share this information with ExpressVPN (in the settings menu of your Account), we will collect the following anonymized App Diagnostics Data: Diagnostic information about if and how a VPN connection attempt failed. Speed test data.

REMOVEDApp diagnostics, including crash reports and usability diagnostics, without any personally identifiable information. These are handled in an anonymized form by the following Service Providers bound by non-disclosure and other contractual obligations, dependent on the platform you are using ExpressVPN on: Windows : Sentry, owned by Functional Software, Inc. See Sentry's Privacy Policy . Mac : Firebase Crashlytics, owned by Google, and Sentry, owned by Functional Software, Inc. See Firebase's Privacy and Security documentation and Sentry's Privacy Policy . Linux : Sentry, owned by Functional Software, Inc. See Sentry's Privacy Policy . iOS : Firebase Crashlytics, owned by Google, and Apple. See Apple's Privacy Policy and Firebase's Privacy and Security documentation . You can disable Apple's crash reporting in iOS settings as described here . Android : Firebase Crashlytics, owned by Google. See Firebase's Privacy and Security documentation . Browser extensions : Google Analytics, owned by Google. See Google's Privacy Policy . Windows : Sentry, owned by Functional Software, Inc. See Sentry's Privacy Policy . Mac : Firebase Crashlytics, owned by Google, and Sentry, owned by Functional Software, Inc. See Firebase's Privacy and Security documentation and Sentry's Privacy Policy . Linux : Sentry, owned by Functional Software, Inc. See Sentry's Privacy Policy . iOS : Firebase Crashlytics, owned by Google, and Apple. See Apple's Privacy Policy and Firebase's Privacy and Security documentation . You can disable Apple's crash reporting in iOS settings as described here . Android : Firebase Crashlytics, owned by Google. See Firebase's Privacy and Security documentation . Browser extensions : Google Analytics, owned by Google. See Google's Privacy Policy .

ADDEDApp diagnostics, including crash reports and usability diagnostics, without any personally identifiable information. These are handled in an anonymized form by the following Service Providers bound by non-disclosure and other contractual obligations, dependent on the platform you are using ExpressVPN on: Windows: Sentry, owned by Functional Software, Inc. See Sentry's Privacy Policy . Mac: Firebase Crashlytics, owned by Google, and Sentry, owned by Functional Software, Inc. See Firebase's Privacy and Security documentation and Sentry's Privacy Policy . Linux: Sentry, owned by Functional Software, Inc. See Sentry's Privacy Policy . iOS: Firebase Crashlytics, owned by Google, and Apple. See Apple's Privacy Policy and Firebase's Privacy and Security documentation . You can disable Apple's crash reporting in iOS settings as described here . Android: Firebase Crashlytics, owned by Google. See Firebase's Privacy and Security documentation . Browser extensions: Google Analytics, owned by Google. See Google's Privacy Policy . Windows: Sentry, owned by Functional Software, Inc. See Sentry's Privacy Policy . Mac: Firebase Crashlytics, owned by Google, and Sentry, owned by Functional Software, Inc. See Firebase's Privacy and Security documentation and Sentry's Privacy Policy . Linux: Sentry, owned by Functional Software, Inc. See Sentry's Privacy Policy . iOS: Firebase Crashlytics, owned by Google, and Apple. See Apple's Privacy Policy and Firebase's Privacy and Security documentation . You can disable Apple's crash reporting in iOS settings as described here . Android: Firebase Crashlytics, owned by Google. See Firebase's Privacy and Security documentation . Browser extensions: Google Analytics, owned by Google. See Google's Privacy Policy .

Upon activation of any of our Apps, you will be asked if you would like to share App Diagnostics Data with ExpressVPN. You can start or stop sharing this data at any time in your App's settings menu. On iOS, Apple's crash reporting can be turned off in iOS settings .

REMOVEDFor user experience and analytics purposes, ExpressVPN uses several analytics services, including from third-party Service Providers. These services may use cookies, mobile identifiers, and other data to generate reports and statistics, but have no access to information that directly identifies individuals nor any Personal Data that users provide to ExpressVPN. What is a Cookie? Cookies and other similar technologies are small text files used to store information about your visit to the Site on your computer or mobile device (" Cookies "). Cookies allow websites to "remember" your actions or preferences over time, which allows us to optimize and improve the user experience of the Site by helping us deliver certain functionalities, such as website login and language settings. The Cookies we use may vary over time as we continuously update and improve our Site. Disabling Cookies When you visit the Site for the first time, you will be invited to set your Cookie preferences. You can also change these preferences at any time by selecting Cookie Preferences from the menu at the bottom of most pages on the Site. Alternatively, you may be able to change your Cookie preferences from the settings panel of your browser. Note that our Site may not work as intended if you choose to disable Cookies. ExpressVPN's Cookies The Cookies set by ExpressVPN enable us to set your language preference, attribute visitors to a marketing channel, and, once you log in, securely show you information that is specific to your Account. The Cookies contain a user identifier, but no directly personally identifying information such as your name or email address and do not track any activity outside of ExpressVPN's domains. Third-Party Cookies ExpressVPN uses Cookies from third-party services for Essential, Functional, and Marketing purposes. Cookies that are necessary for the proper functioning and optimization of the Site are known as Essential Cookies. For example, we use PayPal to allow users to make payments via that service. Other Essential Cookies in use include those that allow payments via Forter, Braintree, and Chargebee; those that allow us to analyze and improve page performance, including Google Analytics, Google Optimize, Visual Website Optimizer, and Google Tag Manager; those that allow us to manage traffic, deliver content, and combat malicious bots, including Cloudflare, Cloudfront, and Gstatic; and one that allows you to specify your Cookie preferences, Usercentrics Consent Management Platform. Essential Cookies cannot be disabled, and by using the Site, you are consenting to them. Cookies that enable us to properly display or manage elements on the Site are known as Functional Cookies. For example, we use Google Fonts to properly display text. Other Functional Cookies in use include those for displaying video, including YouTube Video and Vzaar; those that produce maps, including OpenStreetMap and Google Maps; those used in managing Cookies, including Google Ajax and jQuery; one for tracking and reporting errors, Sentry; one for displaying avatars, Gravatar; and one for presenting quizzes and questionnaires, Typeform. Functional Cookies can be disabled. Cookies that are used by advertisers to serve ads that are relevant to your interests are known as Marketing Cookies. For example, we use Google Ads remarketing to show advertisements on third-party websites (including Google) to users who have visited our Site. We may show such users advertisements on a Google search results page or on a site in the Google Display Network. Other Marketing Cookies in use include those from DoubleClick Ad, Facebook Pixel, Facebook Social Plugins, Google AdServices, Google Syndication, Microsoft Advertising Remarketing, X, and PayPal Marketing Solutions. Marketing Cookies can be disabled. Service Providers, including Google, use Cookies to serve ads based on someone's past visits to the Site. Any data collected will be used in accordance with our Privacy Policy and Google's privacy policy. In addition to setting Cookie preferences via your browser or the menu at the bottom of our Site, users also may opt out of Google's use of Cookies by visiting the Google Advertising Opt-out Page. Users may opt out of Google Analytics by visiting the Google Analytics Opt-out Page. Users may opt out of third-party use of cookies by visiting the Network Advertising Initiative Opt-out Page . Device information ExpressVPN uses device information (including device type, operating system/language, or user agent, as well as mobile identifiers provided by Android or iOS devices) to generate statistics related to the marketing channels and advertising partners through which users learned about and signed up for ExpressVPN Apps. This device information does not contain your name, email address, or other Personal Data. Disabling or resetting mobile identifiers Users may disable or reset the mobile identifiers associated with their devices at any time. For instructions, see Apple's page on Advertising & Privacy on iOS devices and Google's page on Managing your Google Settings on your Android device . Email/communication analytics To assess and improve the emails and other communications we send, ExpressVPN or its Service Providers may collect data for statistical reports. For example, we may generate reports assessing whether emails were successfully sent, whether there were any delivery delays, or the number of times an email was opened.

ADDEDUsers in California Under the "Shine the Light Act" (California Civil Code Section 1798.83), California residents may request information about any disclosure of personal data to third parties for their direct marketing purposes. We do not disclose any such data to third parties for direct marketing. Nonetheless, California residents who wish to make a request (once per user per year) may contact us as described in the 'How to Contact ExpressVPN' section below. The following rights (which may be subject to certain exemptions or derogations) shall apply to individuals covered by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the " CCPA "): You have the right to know what categories and specific pieces of personal information are being collected about you, the sources from which it is collected, the purposes for which it is used, and the categories of third parties with whom it is shared. You have the right to request the deletion of your personal data. Please note that such deletion may result in us no longer being able to provide you with our Services. You have the right to opt out of the sale or sharing of your personal information for cross-context behavioural advertising. ExpressVPN does not sell or share your personal information as defined under the CCPA; however, you may exercise this right at any time by contacting us. You have the right to request the correction of inaccurate personal information that we hold about you. You have the right to limit the use and disclosure of your sensitive personal information to purposes that are necessary to perform the services you have requested. You have the right not to be discriminated against for exercising any of these rights or other rights under the CCPA. You have the right to withdraw your consent on which processing is based at any time. We will respond to verifiable consumer requests within forty-five (45) days of receipt, which period may be extended by an additional forty-five (45) days where reasonably necessary, provided we notify you of the extension. You will not be charged a fee to exercise any of the above rights. Users in Other US States A number of US states, including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others, have enacted comprehensive privacy laws that grant their residents certain rights over their personal data. If you are a resident of a state with an applicable privacy law, you may have some or all of the following rights, depending on your state of residence: The right to access and obtain a copy of the personal data we hold about you. The right to request the correction of inaccurate personal data. The right to request the deletion of your personal data, subject to certain exceptions. The right to opt out of the sale of your personal data, targeted advertising, and, in certain states, profiling that produces legal or similarly significant effects. The right to obtain your personal data in a portable and readily usable format (data portability). The right not to be discriminated against for exercising your privacy rights. Where required by applicable state law, we will obtain your consent before processing sensitive personal data, which may include data revealing racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship or immigration status, genetic or biometric data, and precise geolocation data. ExpressVPN does not sell your personal data to third parties. To exercise any of the rights described above, or if you have questions about your state's privacy protections, please contact us as described in the 'How to Contact ExpressVPN' section below. We will respond to your request within the timeframe required by applicable law. If you are unsatisfied with our response, certain state laws may permit you to appeal our decision by contacting us, and we will respond to your appeal in accordance with the applicable law. We do not offer our Services for use by children and, therefore, we do not knowingly collect Personal Data from, and/or about individuals under the age of eighteen (18) or under the age of majority in the jurisdiction of residency / from which the Services are used. If you are under the age of eighteen (18), or under the age of majority in the jurisdiction where you reside or from which you use the Services, do not provide any Personal Data to us without the involvement of a parent or a legal guardian. In addition, we comply with the US Children's Online Privacy Protection Act (" COPPA ") and do not knowingly collect personal information from children under the age of thirteen (13). For the purposes of the UK GDPR and the DPA 2018, we do not intend to offer information society services directly to children. Where consent is relied upon as the lawful basis for processing, the consent of a child under the age of thirteen (13) must be given or authorised by the holder of parental responsibility, in accordance with section 9 of the DPA 2018. In the event that we become aware that you provide Personal Data in violation of applicable privacy laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us as described in the 'How to Contact ExpressVPN' section below.