This transparency report covers legal and copyright requests received between July and December 2025

• Most requests were DMCA notices generated and submitted at scale through automated systems
• Requests from governments, law enforcement, and civil entities declined compared to H1 2025
• Three warrants were received and are listed separately for clarity
• None of the requests resulted in the disclosure of user data
• Bug bounty testing continued, with a small number of valid issues identified and fixed

What authorities asked us for in the second half of 2025

Requests for user data are a routine part of operating on today’s internet. Some arrive from authorities, and many more arrive through automated copyright systems. This report records what ExpressVPN received between July and December 2025, and what followed.

During this period, most requests arrived at scale rather than individually. DMCA notices accounted for the overwhelming majority, generated and submitted through automated systems. Requests from government, law enforcement, and civil entities were far fewer by comparison.

As in every previous reporting period, none of these requests resulted in the disclosure of user data. ExpressVPN’s systems are built so that browsing activity and connection records aren’t retained.

Legal request overview (H2 2025)

The most visible change in the second half of 2025 was volume, particularly on the copyright side. DMCA requests continued to increase, driven largely by automated notice systems that generate and submit complaints at scale. These requests now arrive as bulk data rather than individual claims.

Requests from government, law enforcement, and civil entities moved in the opposite direction. Their overall number declined compared to the previous reporting period, and they remained relatively limited when set against the volume of copyright notices. We also received three warrants during this cycle, which are listed separately for clarity and consistency with past reports.

While the mix and scale of requests shifted, the outcome did not. None of the requests received during this period resulted in the disclosure of user data. ExpressVPN’s systems are built without activity logs, so there’s nothing to retrieve when requests seek browsing or connection information. 

How bug bounty testing played out in H2 2025

Our bug bounty program exists to keep pressure on the system. We invite independent researchers to test our apps, infrastructure, and core VPN platform in ways that internal review alone can’t replicate.

In H2 2025, we received 143 submissions, 120 of them unique. Fourteen reports uncovered valid security issues, all of which were addressed. The remaining submissions didn’t expose exploitable weaknesses, but they weren’t wasted effort. They tested boundaries, challenged assumptions, and helped confirm that critical protections behaved as intended under scrutiny.

That balance is the point of our program. Most testing should result in nothing breaking, but when something does, it should be found quickly, fixed quietly, and folded back into the system. 

Continuing transparency and trust

Privacy services ask users to place a high degree of trust in their systems. Transparency reporting is how we make that trust measurable.

By publishing the requests we receive, the scrutiny our systems face, and the outcomes that follow, we give readers a way to judge our claims against a growing public record. Over time, that record shows whether protections hold up under pressure, whether responses stay consistent, and whether design choices have real consequences.

Earlier transparency reports, independent audits, and technical disclosures are available on the ExpressVPN Trust Center.