"NordVPN presents a moderate-to-high privacy risk profile comparable to mainstream consumer services, driven by collection of sensitive financial data (credit cards, bank accounts, national IDs), extensive advertising identifier tracking across multiple ad platforms (Google, Bing, Facebook), and sharing with third-party analytics and error-tracking services. The 182-day retention of session tracking data and absence of clear opt-out mechanisms for advertising tracking further elevate privacy concerns. While not at the level of aggressive data brokers, these practices significantly exceed what users would expect from a privacy-focused VPN service."
Take Action
3 Privacy Improvements Available
nordvpn Privacy Concerns & Scorecard
No explicit opt-out mechanisms visible for advertising tracking, and cookie consent implementation is incomplete or obscured in the available policy documentation
NordVPN collects sensitive financial data including credit card information, bank account information, and national ID numbers, along with browsing session data and advertising identifiers
Extensive tracking of advertising parameters (gclid, msclickid, fbclid) enabling cross-platform ad targeting and session-based tracking with referral source attribution
Data may be shared with partners for advertising and analytics, increasing the risk of exposure.
Session cookies and first-session cookies are retained for 182 days (approximately 6 months), which is a lengthy period for tracking data
Privacy preferences app settings
- 1Open the NordVPN desktop or mobile application
- 2Go to the General section in the app settings
- 3Find the 'Privacy Preferences' subsection
- 4Review each listed preference — note which are marked 'Essential/Required' (cannot be disabled) and which are optional
- 5Toggle off any optional privacy preferences you do not wish to enable and save the changes
Data deletion
- 1Log in to your Nord Account at my.nordaccount.com
- 2Navigate to account settings and locate the option to delete your account
- 3Confirm account deletion — this permanently removes access to all Nord products and services linked to the account
- 4To also request deletion of personal data held by NordVPN (right to erasure under GDPR/CCPA), contact NordVPN's support or data protection team directly with your erasure request
Marketing email opt out
- 1Log in to your Nord Account at my.nordaccount.com
- 2Navigate to your account notification or email preferences settings
- 3Toggle off marketing email notifications and save your changes
- 4Alternatively, click the 'unsubscribe' link at the bottom of any marketing email received from NordVPN
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, service delivery, billing, and customer support
Payment processing and identity verification
Service improvement, session management, and analytics
Cross-platform advertising attribution, conversion tracking, and retargeting
Website compatibility, debugging, and session identification
Cross-Platform Tracking
NordVPN tracks users across advertising platforms (Google Ads, Bing Ads, Facebook Ads) using platform-specific identifiers (gclid, msclickid, fbclid) embedded in URLs and cookies. Session data and referral information are retained for 182 days to enable cross-platform advertising attribution and retargeting.
Tracking Methods:
Session Cookies
First-session cookies retained for 182 days to maintain user session state and track browsing behavior during subscription period
Advertising Pixels & Tags
Google, Bing, and Facebook advertising pixels embedded on website to capture gclid, msclickid, and fbclid parameters for cross-platform ad targeting and conversion tracking
UTM Parameter Tracking
Campaign tracking parameters (utm_source, utm_medium, utm_campaign, etc.) automatically captured and retained to attribute user acquisition sources across marketing channels
Sentry Error Tracking
Debug information and error data transmitted to Sentry (debug.nordsec.com) for application monitoring and performance analytics
AI & Data Training
nordvpn does not train AI on your content
Based on their public policy, your content is not used to train AI models.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed nordvpn
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.