Monday, May 5, 2025
HomeSecurity NewsFacebook Owned Onavo VPN Collects User Data Even it is Turned Off

Facebook Owned Onavo VPN Collects User Data Even it is Turned Off

Published on

SIEM as a Service

Follow Us on Google News

Facebook launched a free VPN program Onavo Protect for Android and iPhone to boost the user privacy and to keep the information secure. But as promised it does not anonymize, instead, it drains your privacy.

Even when the Onavo VPN is turned off it keeps on sending daily Wi-Fi data usage, Mobile data usage, and frames to indicate how long the VPN is connected.

It was criticized starting this month due to its promotional activities and it was first reported by Techcrunch, infosec researcher Will Strafach published a blog post tracking the types of data collected by Onavo Protect.

- Advertisement - Google News

Onavo Protect contains a Packet Tunnel Provider app extension that performs the additional functions along with the VPN.

Also Read Is it possible to Read Someone Facebook Messages Without Them Knowing?

What are the Data’s Collected – Onavo Protect

Onavo Protect sends Mobile network name, Mobile network code, Mobile country code, Locale/language, iOS version, and Onavo app version.

Onavo tracks when the mobile device screen is on/off, likely only while connected to Onavo Protect.

Tracks daily data usage on Wi-Fi and mobile data using system APIs

DNS request to measure the latency.

Onavo performs timing measurements of Packet Tunnel Provider performance.

Onavo Protect

Facebook response to 9to5mac “When people download Onavo Protect to help secure their connection, we are clear about the information we collect and how it is used. Like other VPNs, Protect acts as a secure connection including when people are on public Wi-Fi.”

This helps us improve and operate the Onavo service. Because we’re part of Facebook, we also use this information to improve Facebook products and services.

We let people know about this activity and other ways that Onavo uses, analyses, and shares data before they download it. We also regularly review our apps and make updates based on feedback from people.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...

RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals

The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

FBI Alerts Public to Scammers Posing as IC3 Officials in Fraud Scheme

The Federal Bureau of Investigation (FBI) has issued a warning regarding an emerging scam...

New ‘Waiting Thread Hijacking’ Malware Technique Evades Modern Security Measures

Security researchers have unveiled a new malware process injection technique dubbed "Waiting Thread Hijacking"...

EU’s GDPR Article 7 Poses New Challenges for Businesses To Secure AI-Generated Image Data

As businesses worldwide embrace digital transformation, the European Union’s General Data Protection Regulation (GDPR),...