Opera VPN Review – Data Collection Tool in Disguise?

Like many free products you find online, Opera VPN comes with a catch – actually, several catches.

Taking a page out of the adware playbook, Opera VPN offers a free service that collects your data for “promotional campaigns and advertising” – as they openly disclose in their Terms. What’s more, Opera is not even offering a true VPN (virtual private network), but instead a browser proxy. This browser proxy does not offer full encryption of traffic on your operating system or the privacy and security of a real VPN.

Those who are looking for a good VPN service should consider other options and read the fine print.

What is Opera VPN?

Opera VPN is a browser proxy that encrypts traffic between the Opera browser and a proxy server. Unlike a true VPN, Opera’s “VPN” only works within the browser, rather than encrypting all traffic on your operating system. In other words, Opera’s “free VPN” is not a VPN at all, but rather just a browser proxy.

HelpNetSecurity had this to say about Opera’s claims:

Michal Špaček, a web developer and security engineer based in Prague, researched the way Opera’s VPN works and discovered there’s more marketing than security behind Opera’s claims.

“What Opera offers is not a VPN as such. It’s just a proxy for the browser. You still need a full VPN if privacy is what you care about (and you should care about your privacy). Other tools you use, including for example email clients like Outlook, won’t use this ‘VPN’,” Špaček told Help Net Security.

While Opera may have done this little tweak of definitions with the best intentions, end users should understand that this free service by Opera is nowhere near the security provided by a real VPN solution,” Per Thorsheim, founder of PasswordsCon, commented.

Technically, Opera should not be marketing this as a VPN at all, but that’s what they are doing.

Opera is not alone in this regard. Firefox recently launched a “Firefox Private Network” that many are falsely calling “Firefox VPN” – despite it also not being a VPN.

Is Opera VPN safe and secure?

Lots of people are wondering if Opera’s free VPN is safe and secure. According to many experts, the answer is no, Opera VPN is not safe or secure.

Perfect Privacy wrote an interesting blog post where they explain some of the dangers of the Opera browser VPN:

When setting up the proxy, the browser requests a “device_id” which contains a unique user ID. This device_id is sent to the proxy for every browsing request and will remain permanently tied to the browser.

This becomes worrisome when you look at Opera’s business model. According to their privacy statement Opera reserves the right to pass on data to third parties for advertising and marketing purposes. Additionally, SurfEasy logs Usage and Bandwidth data. [Note that Opera bought SurfEasy in March, 2015 to incorporate a VPN into their browser.]

In summary: Not only is Opera’s “Free VPN” no VPN at all, but you also potentially compromise your privacy when using it. As the saying goes: If you are not paying for the product, chances are that YOU are the product.

We’ll examine Oper’s privacy policy in detail further below (spoiler: it’s not good).

This issue becomes even more interesting when you examine who (now) owns Opera…

Who owns Opera VPN?

Opera began as a Norwegian company that offered a Presto-based web browser for most operating systems, until switching to Chromium in 2013. In July 2016, Opera was sold to a Chinese consortium led by Qihoo 360 and the Chinese billionaire Zhou Yahui.

Opera’s Terms of Service list the owner as Opera Unite Pte. Ltd., which is a Singapore-based company.

This is also a trend we’ve seen in the VPN industry. CyberGhost VPN was purchased by an ad-tech company, Kape Technologies, in 2016 for about $10 million. McAfee, the US cybersecurity company, purchased TunnelBear in March 2018 for an undisclosed amount.

The Opera contact page maintains the facade of a European business with a Norwegian flag and an Oslo address for the company’s “Headquarters”. This is rather misleading given the new ownership and Singapore jurisdiction the business actually operates under.

Interestingly, just two months after the Chinese acquisition of Opera, they decided to launch the “free VPN” within the browser (September 2016).

Could it be that the new buyers intended to leverage Opera’s popularity for data collection, which is a large and profitable business?

Opera browser data collection

A quick look at Opera’s privacy policy reveals many concerning issues.

First, when you download the Opera browser you will be provided with a unique ID. This is often done by advertisers to track your online activities, which are linked to your unique ID for advertising purposes.

Reading the privacy policy, we learn that usage statistics (what you do online) is being recorded and linked to your unique ID:

The big red flag here is usage data and how this is connected to your unique ID.

No privacy-oriented service should be collecting usage data, which is the exact opposite of privacy. But in the context of an advertising business, this makes sense. More data means better targeted ads and more advertising revenue. This is the same business model as Google, after all (see the Google alternatives guide).

International data transfers

The next problem we come to is data transfers – how your data is transferred to different jurisdictions. From the privacy policy,

When we do collect personal data, it may be transferred to partners in countries other than Singapore.

This is also quite concerning as it is it seems to be intentionally worded in a vague and open-ended manner. What are these partners and other countries? Who knows.

Third party data collection

Opera’s privacy policy also describes how third party partners will be collecting your data:

Our applications and services include third-party technology or code, some of which may use your data in different ways. When such third-party technologies use previously collected data, they typically act as data processors for us.

These third parties include Google, Facebook, Yandex, Outbrain, and over a dozen others.

Opera is also collecting your location for targeted ads.

Does Opera VPN keep logs?

Now that we’ve covered how the Opera browser itself is collecting vast amounts of data, let’s examine the so-called VPN.

Opera’s privacy policy states the following under the “Browser VPN” section:

When you use our built-in VPN service, we do not log any information related to your browsing activity and originating network address.

Therefore it appears that the proxy servers themselves (the “browser VPN”) are not collecting your data. But don’t be fooled, because the browser itself may still be logging your activities, even if they proxy servers aren’t logging anything.

On the opposite end of the spectrum are no logs VPN services that have been verified to not keep any logs.

The Opera business model

How can a company offer completely free products and continuing paying the development, collocation and bandwidth expenses?

Simple. By monetizing the user. This is done by collecting user data, which is either sold to third parties or used for targeted advertisements. Sure enough, we read from the Terms page that ads are the key to Opera’s business model:

Our Services are ad-supported.

To support our business and continue providing you with the Services for free, we will display the advertisements of select partners to you. By using our Services, you consent to the placement of such advertisements within the Services.

That sums up most free apps you find in the Google Play and Apple stores.

Also recall that Opera is partnering with about twenty different companies, which are also collecting your data through Opera’s apps.

Data collection is big business. This is why we see so many free VPN services with shady practices.

As an alternative, you could go with a cheap VPN that’s under $4 per month.

How to use Opera VPN

Ok, so maybe you still want to try out Opera VPN despite all the privacy risks and data collection practices. Here’s how.

1. First, you need to download the Opera browser for your operating system, which you can get here.

2. Then, select Settings from the menu (Preferences on Mac OS).

3. On the left side of the page, click on the Privacy & Security section and then scroll down to the VPN preferences. From there, simply toggle the VPN on.

4. With Opera VPN now enabled, you will then see the blue VPN icon in the address bar. Clicking this will open up a drop-down menu to turn the VPN on/off and also select a region.

Like other browser proxies I’ve tested, it’s a simple setup without many features or customization options. Another (paid) service that offers browser proxies is NordVPN.

On a positive note, Opera VPN is very simple and easy to use.

Does Opera VPN work for torrenting and Netflix?

No, Opera VPN does not work for torrenting because it is only encrypting traffic through the Opera browser. Torrent clients that are outside of the browser would not be getting encrypted. This means your IP address and torrenting activities would remain exposed, potentially opening you up to copyright infringement claims.

Check out the best VPNs for torrenting instead. Now let’s examine Netflix.

Unfortunately, Opera VPN also did not work well with Netflix in my testing. On a positive note, there are other VPNs that work with Netflix that you can use.

Is Opera VPN fast?

For all tests with this Opera VPN review, I was using an Opera browser inside a Windows 10 virtual machine. Because I did not want to give Opera my private IP address, I first connected to a (real) VPN on the host computer, thereby encrypting and securing all traffic.

To run speed tests, I first checked my VPN connection to a nearby server in Luxembourg, which was providing about 85 Mbps. Then I selected “Optimal location” within Opera VPN for testing, since this would probably give me the best speeds.

Running some speed tests using the site speediest.net, I was getting around 30 to 35 Mbps download speeds.

Given that my baseline speed was 85 Mbps and Opera VPN was only providing about 33 Mbps, I would conclude that Opera VPN is not fast.

Does Opera VPN leak IP addresses or DNS requests?

First, we must again emphasize an important point: Opera VPN is only encrypting traffic within the Opera browser. Therefore this proxy cannot handle data on your operating system with other apps and browsers, like a tradition (real) VPN service would. In that sense, your data is always leaking outside of the Opera browser since it’s not encrypted (unless you are using a real VPN).

With that out of the way, does Opera effectively encrypt your data within the browser?

A few years ago, there were multiple reports of Opera leaking IP addresses. The culprit for these data leaks was WebRTC and the WebRTC leak vulnerability – an issue we’ve covered here before. Because Opera runs on Chromium, it is vulnerable to WebRTC leaks.

With Chromium browsers like Opera, WebRTC cannot be disabled, but only blocked. WebRTC can be disabled in Firefox, as explained in my Firefox privacy modifications guide.

Fortunately, Opera has since patched this bug by implementing a WebRTC block, and I did not find any leaks within the browser.