What governments asked us for in the first half of 2025

Every six months, we publish a transparency report detailing the legal requests we receive and how we respond to them. It’s a straightforward account of how often authorities come looking for user data, and what happens next.

Between January and June 2025, our legal team received 374 formal requests from government, law enforcement, or civil entities, along with more than a million DMCA complaints. As in every previous cycle, we provided nothing in return. Our systems are built without logs of user activity, so there is simply nothing to share.

What changed this cycle

We’ve updated how we categorize legal requests to better reflect the types we consistently receive. This cycle, we’ve grouped categories like subpoenas, gag orders, and National Security Letters under a single line: Government, law enforcement, and civil requests. Warrants remain listed separately to keep reporting consistent with past editions.

The format may have changed, but the facts haven’t. The data is still complete, and the outcome remains the same: none of these requests resulted in the disclosure of user data.

From this cycle forward, gag orders and National Security Letters are included in the broader government and civil category.

For context: that’s more than double the number of legal requests we received in the previous reporting period (163) and a 32% increase in DMCA complaints (up from 807,788). A few previously separate categories, like subpoenas, have been consolidated to streamline the report. But the outcome hasn’t changed: our no-logs infrastructure means there is nothing to retrieve, no matter the request.

What our bug bounty turned up

Our bug bounty program remains a standing challenge to the security community: if you find a real vulnerability, we’ll fix it fast and thank you publicly. In Q2 2025, we received 82 submissions. Of those, 52 were unique. Five uncovered valid security issues. The rest helped us strengthen internal edge cases, tune automated checks, and tighten existing protections.

The point of the program is to keep pressure on the system. And it works. Every report, even the noise, keeps our infrastructure under scrutiny. That’s how we want it.

Continuing transparency and trust

This latest transparency report builds on our other long-standing efforts to keep users informed and in control. We’ve published multiple independent audit reports, open-sourced core components of our technology, and released detailed white papers on key systems like ExpressVPN Keys. You can read the full H1 2025 report on our Trust Center.