Urban VPN is safe only in a narrow sense: Urban markets it as a way to hide your IP address, and none of the reports we read call it malware. It is not private, though.
Its own privacy policy says the parent company is a data broker. Aggregated insights built from users’ browsing are sold to business customers, and raw personal data may pass to the parent first. Every document cited here was read on 13 November 2026.
How Urban VPN pays for a free service
Urban’s Why free? page says the service is supported by its Premium users. Browser and desktop users get no bandwidth cap, Android users get 100 MB a day, and the iOS app is Premium only.
The Urban VPN privacy policy for its apps, last updated 4 September 2026, names Urban Cyber Security Inc. of Wilmington, Delaware, as the controller and says “our parent company is a data broker”.
The data collected includes URLs you visit, ads you view or click and search results pages. Urban says it scrubs identifying details on your device before upload.
Under the data broker clause, which applies to every user, most of what reaches the parent’s clients is aggregated and de-identified.
In limited cases, the policy says, clients receive data tied to your Panel ID, a random number Urban assigns you, and are contractually barred from using it to target ads at you or passing it on.
A separate section for US residents goes further. It lists identifiers, internet activity, profiles and inferences, and sensitive data among the categories Urban may sell.
The AI chat row over the browser extension
On 18 December 2025, Malwarebytes reported Koi Security’s research on the Urban VPN Proxy extension. Koi found that version 5.5.0, released 9 July 2025, captured prompts and replies on eight AI assistants, ChatGPT and Claude among them.
Koi says the data went to parent company BiScience, even with the extension’s protection features switched off.
Video: AISecHub
Urban says several widely repeated claims, particularly on consent and user control, are “simply not true”. Its reply the same day says AI Protection is off by default and only processed chats for users who opted in.
We have not tested the code ourselves. Malwarebytes advised that if you used any of the eight extensions Koi listed, were unaware of the situation and are unhappy about it, you should assume any AI chats since 9 July 2025 may have been compromised.
By 13 November 2026 the extension was listed on the Chrome Web Store, with 7,000,000 users and version 5.15.1, last updated 11 November 2026.
The extension’s own privacy policy, updated 1 September 2026, does not list AI chat data but keeps the same data broker clause. A policy cannot show what version 5.15.1 actually does.
Urban VPN against a paid no-logs VPN
PureVPN charges a subscription and publishes a no-logs policy, which makes it a useful contrast, and our PureVPN review covers the rest.
| What the policy covers | Urban VPN apps (free) | PureVPN (paid) |
|---|---|---|
| Company named | Urban Cyber Security Inc., Delaware; parent company is a data broker | GZ Systems Private Ltd, British Virgin Islands |
| Browsing activity | Collects URLs visited, ads viewed or clicked, search results pages | Says it does not store browsing activity or history; with its Tracker and Ad Blocker on, it can view domains during the connection |
| AI chat content | Processes prompts and replies for AI Protection; aggregated versions used for market intelligence | Not among the data it lists as collected |
| IP addresses | Trimmed and hashed daily | Says it does not store your origin IP or VPN IP; a Dedicated IP add-on address stays on record for 25 days after the subscription ends |
| Selling data | Parent’s clients receive mostly aggregated insights; raw data may go to the parent | Says it does not sell or rent user data |
| Independent check | None cited in the policy | No-logs page cites an outside assessment run 16 to 22 February 2023 |
Source: Urban VPN privacy policy, PureVPN privacy policy and PureVPN no-logs page.
When Urban VPN is fine, and when to avoid it
For changing your apparent location on a video site, it can be a reasonable choice, as long as you accept that the price is your browsing data rather than cash.
Skip it for anything you would not want profiled: health searches, banking, job hunting or personal AI chats. The policy itself admits browsing data may incidentally reveal health, religious beliefs or sexual orientation.
You can switch off browsing data collection in the app or extension settings. The policy warns that once you do, “some or all of the Services will no longer be available”, so the free VPN itself may stop working.
Withdrawing consent also does not undo processing already done. Urban keeps the link between your data and your Panel ID for no longer than 90 days. After that the data is aggregated, and Urban says it may be unable to find or delete it, except where the law requires.
For a free VPN funded by paid upgrades rather than data sales, start with our list of the best free VPNs.
A VPN also does nothing against malware, which is why our VPN vs antivirus guide argues you need both.
Urban VPN questions readers ask
Is Urban VPN a virus?
None of the reports we read call it malware, and Urban markets it as a way to hide your IP address. The documented concern is different: what it collects and sells under its own privacy policy, and the 2025 dispute over AI chats Koi says its Chrome extension captured.
Does Urban VPN sell your data?
By its own account, yes. The policy says the parent company is a data broker whose business customers mostly receive aggregated, de-identified insights. Raw personal information may pass to the parent first, and in limited cases clients receive data tied to your Panel ID.
Can you use Urban VPN safely?
Keep it for low-stakes browsing, such as changing your apparent location, and avoid banking, health searches and personal AI chats. Opting out of data collection may switch off some or all features, so for private work a paid no-logs VPN is the safer tool.
