Can the FBI Track You Through a VPN?

This page is part of the Proton VPN FAQ Hub.

What does a VPN hide from an investigator?

Can the FBI track you through a VPN? Nobody is in trouble for asking, since using a VPN is perfectly legal in Britain and America, and the practical answer starts with what the tunnel actually covers. A VPN encrypts traffic between your device and the VPN server, then swaps your visible IP address for the server’s. An investigator who subpoenas your internet provider gets a record showing that you connected to a VPN endpoint and how much data moved, not a list of the sites you visited.

That closes one route and leaves several others open. The device stays in your hands, the accounts you sign into keep working, the payment trail behind those accounts persists, and the service at the far end logs whatever it likes. Serious investigations rarely attack the strongest component of a system, and the encryption is the strongest component.

Can traffic correlation defeat the encryption?

Correlation attacks ignore the contents entirely and study timing and volume instead. If an adversary can watch traffic entering the VPN from your connection and traffic leaving the VPN towards a target service, matching the bursts and byte counts links the two with high confidence and no decryption required. The academic work on this against Tor is extensive, and a single hop VPN is a considerably easier target than Tor.

Pulling it off needs visibility at both ends, which in practice means a very well resourced agency with network taps, or an investigation where the destination service is already cooperating and logging. Proton’s Secure Core routing, which passes traffic through a second server in Switzerland, Iceland or Sweden before it exits, raises the cost of that observation without making it impossible.

What happens if the device itself is compromised?

A VPN protects data in transit and does precisely nothing once someone is on the machine. Malware, a forensic image of a confiscated laptop, a compromised browser extension, or a phone handed over whilst still signed in all defeat the tunnel completely, because the data sits in plaintext before it is encrypted and again after it is decrypted.

Historically this is how most high profile cases were actually resolved. Not cryptanalysis, but a phone recovered at an arrest, an unencrypted backup, a hosting provider’s billing records, or an informant. The VPN is simply not part of the story in any of those outcomes.

Can the FBI compel Proton to hand over data?

Not directly, and this is where Swiss jurisdiction genuinely matters. Proton is based in Switzerland and is not subject to US or EU subpoenas. A US agency generally has to route a request through Swiss authorities, typically under a mutual legal assistance treaty, and a Swiss court then decides whether Swiss law permits the demand. That is real friction and it filters out speculative fishing requests.

It is not immunity. Proton publishes a transparency report showing that it does receive and comply with orders from Swiss authorities, and the numbers are not small. In 2021 a Swiss court compelled Proton Mail to begin logging the IP address of one specific account under investigation, still the clearest case of what police can get from Proton Mail. Proton has stated that Swiss law treats VPN services differently from email and telecoms providers when it comes to retention, but a company’s reading of the law today is not a guarantee about the law tomorrow.

What defeats a VPN entirely?

When the answer to can the FBI track you through a VPN turns out to be yes, it is almost always because identity leaked through the tunnel rather than around it. These are the recurring causes:

Every item on that list has featured in real prosecutions. Note that none of them involves breaking encryption and most involve somebody being tired or in a hurry. Proton VPN can protect the network layer competently and still be undone by a single careless login or one file uploaded with its location tag intact.

• Signing into an account tied to your real name, which links the session to you regardless of the exit IP.
• Browser fingerprinting, which produces a stable identifier that survives every IP change you make.
• Reusing a username, avatar, writing style or phone number across identified and unidentified accounts.
• Paying with a card, PayPal account or bank transfer in your own name.
• Connecting once without the VPN, even briefly, after a reboot or a dropped session with no kill switch enabled.
• Metadata inside uploaded files: EXIF location tags, document authorship fields, screenshot timestamps.

So can the FBI track you through a VPN in practice?

For ordinary use the honest answer is that federal investigators are not running correlation attacks on your streaming habits. The realistic protections a VPN offers are against an internet provider monetising your browsing history, against a hostile local network, and against casual IP based logging by the sites you visit, which is why the no-logs position of your provider matters more than its marketing. Those are the threats most people genuinely face.

If you truly believe a nation state agency has taken an interest in you, a commercial VPN is the wrong tool and no marketing page should convince you otherwise. Tor, compartmentalised devices and operational discipline are what that situation calls for, and even then people are usually caught through their own mistakes rather than through broken maths.

---