Is Opera VPN safe? The audit, the coverage and the leaks

What the Deloitte audit checked, and the date it stops

Opera’s security blog announced the audit on 25 September 2024. It says the no-log policy of the free browser VPN was audited by Deloitte, for the VPN on Opera, Opera GX, and Opera for Android and iOS. Opera says it gave Deloitte access to the free VPN’s infrastructure for desktop, Android and iOS from 18 June to 10 August 2024, and lists five kinds of test: inspection of the VPN infrastructure and IT systems, review of the server configuration and the deployment process, review of system descriptions, documentation and policies, review of Opera’s Privacy Statement, and questions put to Opera employees.

Opera quotes Deloitte’s result: the configuration of the IT systems and the management of the supporting IT operations were “suitably designed and implemented”, in all material respects, against the criteria in Opera’s Management Assertion, as of 10 August 2024. According to Opera, that assertion says the VPN has no data logging function built in and that no data is collected about users’ browsing activity, browsing history, originating network address or other identifying information. So the audit measures Opera’s systems against Opera’s own written statement, and it is dated: 10 August 2024.

Two news sites reported the announcement. TechRadar (25 September 2024) writes that the auditors did not identify instances of non-compliance, and quotes Jan Standal, a vice president at Opera, as saying the no-log policy has stood since the service launched in 2016. Tom’s Guide (27 September 2024) calls it the free VPN’s first external audit and says Deloitte reviewed the infrastructure, the controls and the technical configuration. The pages we read do not say that either writer saw the report.

Top10VPN, updated on 4 February 2026, acknowledges that the free VPN passed a Deloitte audit confirming it will not log your IP address and browser history. It adds that it could not find the actual report and that Opera still lacks a comprehensive privacy policy for the free VPN, with only a brief paragraph inside the Privacy Statement. We did not open the report, and we read the Privacy Statement only as Top10VPN and Opera quote it.

Opera says VPN Pro was not part of this audit: its servers are provided in collaboration with Nord, which Opera says has already been audited, while the free VPN uses Opera’s own servers. Opera’s pages also cite an earlier security audit of the free VPN by Cure53, a firm based in Berlin, and its Free VPN page says Cure53 tested the code. The pages we read do not say whether the Deloitte audit was repeated after 10 August 2024, or whether it looked at what the browser itself collects; Opera describes it only as an audit of the VPN service. For another provider’s audit, set out the same way, see our page on Proton VPN.

What it covers: the browser, and only the browser

On this point the four pages that mention it agree. Opera’s post of 29 May 2026 says its free VPN protects your browsing within the Opera browser, not your entire device. The Free VPN page says the same and adds that VPN Pro extends the protection across the whole device, for up to six devices at once, with 48 country regions and the Lightway protocol, which Opera describes as open source and independently audited. Top10VPN writes that the free VPN is a browser feature and not an app you install on your device, that it routes only traffic from within Opera, and that data travelling outside Opera is not encrypted unless real VPN software is running. Windows Report says the same of traffic outside the browser.

Where they differ is the name. Opera calls it a VPN that builds “a secure tunnel” between the browser and one of its servers, encrypted with AES-256. Top10VPN says it is “only a simple TLS proxy” using HTTPS and TLS 1.3, with AES-256 on top. Windows Report says it is not exactly a fully-fledged VPN service, that it is “more similar to a proxy”, and that it does not use VPN protocols. Opera’s pages that we read do not use the word proxy. How much the label matters is left to the reader; what the three sources share is the scope. Our page on proxies and VPNs sets out how the pages we read there tell the two apart.

They also differ on the internet provider. Opera’s posts say the tunnel keeps your ISP from seeing your browsing. Windows Report writes in one place that Opera VPN can protect browsing activity from an ISP, and in another that no VPN service can hide you from your ISP. The pages do not reconcile the two sentences. Our page on what a VPN is used for sets out what a tunnel changes and what it leaves in place.

One more claim belongs to the company alone. The Free VPN page describes Opera as the only browser with a free, built-in, unlimited VPN that needs no account. We checked that against no other browser, so it stays Opera’s statement. The same page lists what free means to Opera: no account, no bandwidth limit, no ads in the VPN, one click beside the address bar on desktop and a setting on mobile.

What a lab found: kill switch, DNS and location

Top10VPN says it put the free VPN through its testing again and that not much had changed. It lists what is missing: a kill switch to stop your IP address leaking if the connection cuts out, a blocker for WebRTC leaks, and protection against malicious domains and URLs. It says the proxy does not handle your DNS requests (Google does) and that it leaks your HTML5 geolocation, and it shows a result headed “We detected DNS and geolocation leaks”. It also writes that users have complained that real IP addresses leaked while using the free VPN. Its verdict: it does not recommend the free VPN or the browser itself.

Windows Report reaches the opposite verdict. It writes that it has no reason to believe the service is unsafe, and that it should be entirely safe as long as you remember it covers only the browser. It also writes that the no-log policy makes the service safe for banking, torrenting and streaming; Top10VPN, by contrast, reports that HBO Max, Hulu, Prime Video and Netflix blocked Opera’s free US addresses, so the two sites disagree on streaming as well. Its page does not mention a kill switch, leaks or the Deloitte audit, so the two sites do not contradict each other on those points; one tested them and the other did not write about them. Top10VPN says that buying a VPN through its links supports its work, and Windows Report says it may get a commission; both are worth knowing when reading the verdicts.

Opera’s pages do not answer this directly. The Opera pages we read do not mention a kill switch or leaks. On DNS, the Free VPN page says the VPN does not collect, store or process browsing activity, DNS queries or originating IP addresses. Top10VPN says DNS requests do not go through the VPN and that it saw them leak. The two sentences describe different things, what Opera records and where the request travels, and the pages we read do not set them side by side. Our page on the kill switch explains what one does and how to test whether yours works.

Where the servers are: three versions

Opera and Top10VPN agree that you choose among three regions. They disagree on what is behind them. Opera’s post of 29 May 2026 says physical servers in three regions: America, Asia and Europe. The Free VPN page says, in one place, three real (not virtual) locations: the U.S., Singapore and the Netherlands; in another, the United States (Ashburn), Europe (Amsterdam, Netherlands) and Asia (Singapore); and in its how-to steps, America, Asia or Europe. Top10VPN says that, although you can choose only among three regions, its tests were given IP addresses from at least seven virtual locations: Argentina, Germany, Norway, Singapore, Sweden, the US and Vietnam. It adds that the “Optimal location” option mostly connected it to a server in Norway.

The pages we read do not explain the gap between the physical servers Opera describes and the addresses Top10VPN saw, though Opera’s own post of 29 May 2026 says the VPN badge shows “the virtual location, and the virtual IP address”, so Opera too uses the word virtual for what you see. VPN Pro, Opera says, offers 48 country regions.

On speed, Opera says the most you may notice is a higher ping, a matter of milliseconds. Top10VPN measured an impact on its internet speed of 10% on short distances and 20% on longer routes, which it says roughly matched the average of other free proxy plugins, and it says servers connected almost instantly. For streaming, Top10VPN reports that HBO Max, Hulu, Prime Video and Netflix detected and blocked Opera’s free US IP addresses.

Why it is free, and what the browser collects

The Free VPN page tells readers to ask three things of any free VPN: how it pays for bandwidth, whether its no-log policy has survived an outside audit, and why it asks for an account. Taking them in turn for Opera, the sources give three wordings of the first. The post of 29 May 2026 says the free VPN is not the core product and that Opera makes money through advertising, business partnerships, and paid subscriptions such as VPN Pro and Opera Neon, so it does not need to monetize the VPN. The Free VPN page lists search engine partnerships, browser features and paid subscriptions like VPN Pro. Top10VPN says the Privacy Statement no longer mentions selling user data to third parties and quotes it as saying Opera monetizes its products in various ways, mostly by selling advertising within the applications themselves. The audit is covered above, and the Opera pages say no account is needed.

Top10VPN separates the VPN from the browser. It says that given the no-log nature of the service, jurisdiction is not a big concern, but that it is not ideal in light of the data the browser itself collects. Its examples: a unique device_id that the browser uses for ad targeting (it says most of these tracking features can be turned off in the settings, though that may not prevent all interest-based profiling); telemetry; and crash reports that may include the URL and a screenshot of the last page. It also recalls that in 2016 Opera’s synchronization service was hacked and over 1.7 million users had information exposed, and it says Opera is based in Norway, a Nine Eyes member, and owned by the Chinese company Kunlun Tech. Opera’s pages that we read mention the Norwegian headquarters and the GDPR, and do not mention the ownership.

On requests from authorities, Opera’s post says they must come through Norwegian authorities and that Opera answers that it has no user data to share. It points to a Transparency Report updated bi-annually; the Free VPN page calls it periodic. We did not open the report. The Opera blog also lists a post of 22 June 2026, “How does Opera make money? An explainer on monetization”; we did not open it, so the three wordings above come from the pages named.

New on public Wi-Fi: 24 September 2026

An Opera post of 24 September 2026 says the free VPN now turns itself on when it detects that you are connected to a public Wi-Fi network. The function is off by default: you enable it in the browser settings. Opera says it is rolling out first to users based in the United States and France. When it is active the VPN button in the tab bar changes colour, and the VPN disconnects when you leave the public network and engages again the next time you join one. Opera says the VPN performs a quick check whether a network is public or private, and that the check does not mean Opera is tracking or logging the networks you connect to.

The Free VPN page describes the same option as a setting that connects the VPN in the background whenever you join an open public Wi-Fi network. It does not say that the option starts switched off or where it is available, so the post is the more complete of the two on those points.

We ran no test of any kind: no leak test, no kill switch test, no speed test, and we did not check the automatic connection on a device. We did not open the Deloitte report or read the Privacy Statement itself. We read a ProPrivacy review and did not use it: it describes locations and apps that differ from Opera’s current pages and shows no review date we could read, although its text mentions a March 2026 update about the Android app. Our VPN pages rank no service until we have paid for the accounts and used them ourselves, and this page ranks no service.