Practicing Safe Browsing: Understanding How and Why University Students Use Virtual Private Networks

Despite their name and stated goal, Virtual Private Networks (VPNs) often introduce users to new security and privacy threats. For example, recent studies have shown that VPNs can leak user traffic to third-party trackers. In light of these developments, we set out to understand how and why a highly educated population, university students, chooses and uses VPNs, whether they are aware of data leakages by VPNs, and how their awareness and attitudes about VPNs affects their decisions to use them. To answer these questions, we conducted 32 in-person interviews, a survey with 350 respondents, and a controlled lab study with 11 users, all university students in the United States. We found that, surprisingly, access, cost, and performance trumped privacy concerns for many users; many users even expected that their VPNs were collecting data about them. Even presenting information to users about the data leaked from VPNs to third-party trackers had little effect on their attitudes, suggesting that more work is needed to improve ways to show users what can be inferred from data collected about them.