HideMyAss VPN Review 2026: What 'No Logs' Leaves Out

Quick answer

HideMyAss is a long-running VPN controlled by Avast Software s.r.o. and owned within Gen Digital, the company behind Norton and Avast. It is best known for one thing, the 2011 case in which it logged a user's connections and handed them to the FBI. It has since stopped collecting browsing history, originating IP addresses and connected DNS queries, but it still retains defined server, client, account and billing records. Its 2020 outside assessment has not been repeated publicly. In our evidence matrix it scores 3.25. As a casual tool from a big brand it works. For anyone whose reason for using a VPN is to resist a determined legal request, its corporate structure, retention model and history make it a weaker privacy choice than a provider that proves its current practice through repeated independent audits.

The 2011 case that defines HideMyAss

In 2011 a member of the hacking group LulzSec used HideMyAss to hide his address while attacking Sony Pictures. HMA received a court order, complied with it, and provided the connection records it held. Those records, the times a specific account connected and the originating IP address, helped the FBI identify Cody Kretsinger, who pleaded guilty and was later sentenced to about a year in federal prison (The Register; US Department of Justice).

HMA did not hide from it. Its public defence was that a legitimate company cooperates with a court order, and that the alternative, refusing, would invite far worse, such as having its whole network monitored. That argument is reasonable on its own terms. The lesson for a reader is the one that outlasts the case. A no-logs promise is only worth what the company actually keeps and the jurisdiction it keeps it in. HMA held connection records and sat in a country that could compel them, so the promise on the website was not the thing that decided the outcome. The data it retained was.

This is why we weight an audited record of what a provider retains, and the jurisdiction it operates in, above any marketing claim. You can read how we grade all of it on our methodology page.

Who owns HideMyAss

HideMyAss was built in 2005 by Jack Cator, reportedly at sixteen, to get around a school firewall, and run through his company Privax. AVG bought it in 2015 (AVG newsroom). AVG was then absorbed by Avast in 2016, and Avast merged with NortonLifeLock in 2022 to form Gen Digital (Wikipedia). So HMA now sits in the same portfolio as Norton, Avast, AVG and Avira.

That matters in the way ownership always does. HMA answers to a large public company whose incentives are its own, and it shares a corporate roof with several other security brands. None of that makes it unsafe by itself. It does mean the brand on the app is not an independent operator, which is worth knowing before you trust it, and it is the same lesson as our wider VPN ownership map.

Who controls HMA and which jurisdiction applies

HMA's current privacy policy does not name a UK company as the controller. It names Avast Software s.r.o. in the Czech Republic, identifies NortonLifeLock UK Limited as the UK representative for UK residents, and says HMA is part of Gen Digital. That is a more complicated structure than the old shorthand that HMA is simply a UK VPN. The corporate parent is US-listed, the controller is Czech, the brand has UK representation, and its servers operate across multiple countries.

This does not make lawful access impossible. HMA says it may disclose the personal data it holds when served with valid subpoenas, warrants or other legal documents. The relevant privacy question is therefore not which flag appears beside the brand, but which entity controls each record, where it is processed, what is retained and what a valid order can compel that entity to provide.

What HMA retains despite the no-logs label

To its credit, HMA changed course. Before 2020 it retained linkable connection logs, reportedly for around 30 days. In 2020 it announced a no-logs policy and commissioned the firm VerSprite to assess its apps and infrastructure, which rated the user-privacy impact as low (PR Newswire; ProPrivacy).

Read that for what it is. It is a real improvement, and a public one. It is also a single assessment, paid for by the provider, in 2020. We could find no newer no-logs audit in the years since. The strongest providers now publish independent no-logs audits on a repeating schedule, so each year's claim is checked again. One audit five years ago is better than none, but it is not the same thing, and a review that pretended otherwise would be doing the reader a disservice.

The current policy supplies the missing precision. HMA says it does not send the originating IP address, DNS queries while connected, browsing history or transferred data to its servers. It does retain the cumulative amount of data transmitted by a server for 18 months; client connection events for 12 months; application events for 18 months; user-authorised crash reports for 90 days; and account information while the account remains active. Billing records may be retained for up to ten years to meet legal obligations (HMA privacy policy).

HMA says the server totals and client events are not paired with individual activity and cannot reveal browsing. That is the strongest case in its favour, and it matters: operational telemetry is not equivalent to a history of sites visited. But the phrase "no logs" still compresses several different claims into one. The burden of proof is to show, with a current independent assessment, that the identifiers, aggregation and deletion controls prevent those retained events from being linked back to a person in practice.

How HideMyAss scores in our matrix

HideMyAss scores 3.25 in our formula, last verified 21 January 2026. The product itself is competent. It has wide platform coverage, a large server network and the backing of a major security company, and it scores reasonably on those practical lines. What pulls the number down is the part that matters most to a privacy buyer, a poor jurisdiction and a thin, dated audit trail against rivals that verify themselves repeatedly. The score is a competent product weighed down by the things you cannot patch with a faster server. Our rankings are formula-driven and never moved by commission.

Who should use HideMyAss

Use HideMyAss if you want a mainstream VPN from a large brand for everyday tasks like geo-unblocking and basic protection on public Wi-Fi, and the company's jurisdiction and history are not part of why you want a VPN in the first place. It is a working product and a well-resourced one.

Choose something else if your reason for using a VPN is to resist a determined legal adversary, or if you simply want the strongest evidence rather than the biggest brand. On our evidence, NordVPN leads on raw score, and Proton VPN pairs a top-tier score with a repeatedly audited Swiss no-logs record and a jurisdiction outside the Five Eyes. Both are disclosed affiliate partners, and that disclosure is the reason you can trust the ranking, which is computed from evidence rather than from who pays us. You can weigh every provider we grade, HideMyAss included, in our comparison tool.

The point is not that HideMyAss is a scam. It is that its own most famous moment is the clearest demonstration of the rule that should guide the choice. Judge a VPN on what it retains and where it sits, not on the name.

Frequently asked questions