Do you trust Xi with your 'private' browsing data? Apple, Google stores still offer China-based VPNs, report says

A Tech Transparency Project report reveals that both Apple's and Google's app stores offer numerous free VPN apps owned by Chinese companies, some linked to Qihoo 360, a firm under U.S. export controls due to alleged ties to China's People's Liberation Army. This raises concerns because Chinese law could compel these companies to share user data with Beijing, potentially compromising user privacy despite Apple's policy prohibiting data disclosure to third parties; neither Apple nor Google have commented on the findings.

Analysis

A Tech Transparency Project (TTP) report reveals significant data privacy and national security risks associated with numerous free VPN applications owned by Chinese companies available on both Apple's App Store and Google's Play Store. The TTP's initial investigation found 20 of the top 100 free VPNs on the US Apple App Store last year exhibited Chinese ownership, with a follow-up report in May identifying two VPNs (Turbo VPN and VPN Proxy Master), linked to Qihoo 360, still available, alongside 11 other Chinese-owned apps. Qihoo 360 is notably on the U.S. Commerce Department's Entity List due to alleged ties with China's People's Liberation Army. Similarly, Google's Play Store was found to offer four Qihoo 360-connected apps (Turbo VPN, VPN Proxy Master, Snap VPN, and Signal Secure VPN) and seven other Chinese-owned VPNs. This poses a considerable risk as Chinese law can mandate local companies to share user data with Beijing, potentially compromising user communications despite platform policies. Apple's guidelines prohibit VPN apps from selling or disclosing user data, and Google requires transparency in data handling, yet the efficacy of these rules against Chinese state directives is highly uncertain. The absence of comment from Apple (AAPL) and Google (GOOGL, GOOG) on these findings, which carry a strongly negative sentiment score (-0.75 overall, -0.5 for both tickers), amplifies concerns about potential reputational, regulatory, and cybersecurity fallout for the tech giants.

Key Decisions for Investors

• Investors should monitor Apple (AAPL) and Google (GOOGL, GOOG) for potential reputational damage and erosion of user trust if these China-based VPNs lead to data privacy incidents, which could also attract heightened regulatory scrutiny from authorities.
• Consider the increased risk of regulatory actions or stricter compliance demands on app store operations, particularly concerning apps from entities like Qihoo 360 that are under U.S. export controls or originate from nations with conflicting data privacy and national security laws.
• Evaluate the potential for broader scrutiny of Apple's and Google's app vetting processes, as weaknesses exposed by the continued presence of these VPNs could imply wider ecosystem vulnerabilities, potentially impacting investor confidence in their platform security and integrity.