3 companies control many big-name VPNs: What you need to know

Let’s say you’re in the market for a VPN (virtual private network). You’re probably looking for some combination of better privacy (from snooping ISPs, advertisers or governments), increased online security (who knows who else is on that public Wi-Fi node?) or even more flexible video streaming options. Unlike mobile operating systems (two main options) or US mobile providers (three basic choices), you might be impressed with the range of VPN providers available to you. At first glance, you’ll see at least a dozen options. However, many of the biggest names in the industry today — and some of CNET’s top VPN picks — are owned by just three parent companies. And those “big three” have gotten even larger in just the past few months, thanks to an increasing wave of VPN consolidation. Pair that with the deliberately opaque and multinational ownership structure of many VPNs and it’s becoming even trickier to make sense of which providers are owned or controlled by which parent companies.

To be clear, the pace of mergers and acquisitions in the business world at large — and the technology and media space in particular — has never been frothier. Last year was a record year, and with new 2022 deals like Microsoft-Activision and Sony-Bungie, 2022 is already looking like a monster. Industries tend to consolidate over time, and that process can sometimes bring smoother economies of scale (your Amazon Prime account now works at Whole Foods, for instance). But it can also have undesirable effects on consumers. For starters, consolidation often impedes or outright kills healthy competition in a given industry, ultimately driving prices up for consumers while reducing the incentive for companies to innovate and improve their services for their customers. 

In the VPN industry, consumer privacy is paramount, which means transparency is critical whenever one company acquires or merges with another. As a VPN user, you want to have a clear picture of which corporate entities have access to and are controlling your data, and who, if anyone, that data is shared with. In the wake of a merger or acquisition, that picture is too often fuzzy, creating confusion for existing and new subscribers about who controls their data, and which legal jurisdictions and rules are in effect. That latter point can be a matter of life and death for users like dissidents and journalists — or even just citizens looking to access the web beyond the firewall of an authoritarian government. 

Mergers and acquisitions are often glazed with catch lines like “joining forces” and “teaming up” — usually to bring “even more value to our customers.” But consumers should be aware of how these deals affect them and their data privacy, particularly when it’s happening in the VPN industry.

To help you understand which parent companies you’re entrusting with your privacy when you use one of these VPNs, we’ve broken things out. These are the three companies that own and control many of the biggest names in the VPN industry today. The data here is based on public disclosures, including the companies’ own websites and press releases. For a more detailed (but slightly outdated) look at industry ownership, you should also check out this detailed January 2022 report from VPN Pro.

Note that CNET is in the process of updating the reviews and rankings of our top VPN picks in light of these recent ownership changes.

Kape Technologies Plc (Formerly Crossrider Plc)

Kape Technologies owns at least four noteworthy VPNs, the biggest being its most recent acquisition, ExpressVPN. The company adopted its current name in 2018 partly to distance itself from its troubling past: It produced the Crossrider adware that allowed third parties to manipulate internet users’ browser traffic.

Other notable holdings: Kape Technologies also owns prominent review sites vpnMentor and WizCase — disclosures to this end can be found at the top of both websites. But as Restore Privacy has reported, many of the Kape-owned brands above jumped in their rankings after the review sites came under the Kape umbrella, calling their objectivity into question. (Kape didn’t return CNET’s earlier request for comment on those reports.)

Ziff Davis (Formerly J2 Global, Inc.)

Ziff Davis, formerly J2 Global, acquired IPVanish, StrongVPN and Encrypt.me from Stackpath in April 2019 for an undisclosed amount. 

• IPVanish: Read CNET’s IPVanish review.
• Strong VPN: Encrypt.me (which acquired Buffered VPN in November 2019) has merged with StrongVPN, along with ibVPN and SaferVPN.

Other notable holdings: Ziff Davis also owns a wide variety of technology sites (Ookla, Down Detector, Encrypt.me) and media outlets, including Mashable, IGN and PCMag.com. Note that despite the legacy branding, ZDNet hasn’t been part of the Ziff Davis corporate family since CNET completed its acquisition of the brand back in 2002. 

Nord Security (Tesonet)

Nord Security is the parent company behind various cybersecurity tools, including NordVPN and now Atlas VPN as well as Surfshark. Tesonet, meanwhile, is the Lithuanian IT business incubator that helped NordVPN and Surfshark get off the ground in their early days. Lithuanian entrepreneur Tom Okman is the co-founder of both Nord Security and Tesonet. Nord tells CNET that the Nord Security team has always operated independently of Tesonet. Nevertheless, the management overlap between the two companies is notable.

Other notable holdings: Tesonet also lists Hostinger, a prominent web host, as a company it’s helped create and/or invested in.