ExpressVPN

⚠ Documented concerns

We don't give ExpressVPN an overall score. A proven logging breach, or an ownership history in adware or surveillance, is not something a good feature list should be able to average away. The data below is still shown in full so you can judge it yourself.

• 2021: Then-CIO resolved US charges over UAE hacking work

  Daniel Gericke, ExpressVPN's CIO at the time, entered a deferred prosecution agreement resolving charges of conspiracy to violate US arms-export controls and to commit access-device and computer fraud, paying $335,000 of a $1,685,000 total. It required no admission of guilt and produced no conviction, but the defendants acknowledged under oath that the attached factual statement was true. That statement says he was directly involved in computer network exploitation operations for a UAE company from January 2016 and later managed its exploitation-tool development. All of that conduct predates his hiring by ExpressVPN in December 2019.

  Source ↗
• 2021: Company kept him on and defended him at the time

  Reporting at the time said ExpressVPN had no plans to change Gericke's position and fully stood behind him. The company said it had known the key facts of his employment history before hiring him, that he had disclosed them proactively, and that it could not be privy to the classified details of his role. It also said it does not condone Project Raven and that such surveillance is antithetical to its mission. The decision drew public criticism. Gericke left the company in 2023.

  Source ↗
• 2021: Acquired by Kape Technologies, formerly Crossrider

  Kape announced the $936 million purchase of ExpressVPN in September 2021 and completed it that December. Kape traded as Crossrider until 2018, when it changed its name; its chief executive said at the time that the rebrand was driven by the strong association with the company's past activities.

  Source ↗
• 2015: Parent was a major ad-injection affiliate

  Research by Google and UC Berkeley presented at IEEE Security and Privacy described Crossrider as a platform enabling drop-in monetisation via major ad injectors, and identified it as the largest affiliate of the Superfish injector. Crossrider supplied the platform and affiliate IDs rather than authoring the injectors.

  Source ↗
• 2025: Named in a continuing US hacking lawsuit

  Saudi activist Loujain AlHathloul sued DarkMatter Group and three former US intelligence operatives, Gericke among them. In August 2025 a judge allowed part of the case to proceed, dismissing other parts. The allegations are unproven, and the case concerns his work before he joined ExpressVPN.

  Source ↗

Listing a concern is a statement about the documented record, not a claim about how the service behaves today. Where a provider has since changed owner, jurisdiction or policy, that is noted above and in the report below.