A warrant canary is a statement, published regularly on a company’s website, that the company has not received a secret court order, national security letter, gag order, or similar government request for data. When the canary disappears from the website, or when the company stops publishing it, that absence is the signal: something has changed.
The name comes from coal mining. Miners carried canary birds into tunnels because canaries are more sensitive to toxic gases than humans. When a canary died, miners knew to evacuate. A warrant canary works the same way: the absence of the signal is the warning.
Why VPNs use warrant canaries
In many countries, including the United States, law enforcement agencies can issue data requests to companies with accompanying gag orders that prevent the company from disclosing the request. National Security Letters are the most prominent example in the US: they require recipients not to reveal that they received one.
If a VPN provider receives an NSL requiring them to secretly install logging software or hand over user data, they cannot tell users about it directly. But they can stop updating their warrant canary, and sophisticated users watching for that absence can infer that something has happened.
The legal theory behind this is uncertain: some lawyers argue that removing a canary statement constitutes compelled speech in reverse, which may itself be constitutionally problematic. But in practice, warrant canaries have been used by VPNs and tech companies for years without legal challenge on this specific point.
Which VPNs maintain warrant canaries?
ProtonVPN maintains an active transparency report page that includes a warrant canary statement. It is updated quarterly and explicitly states whether ProtonVPN has received any secret orders, FISA requests, or similar demands. Switzerland’s legal framework provides some protection: Swiss law does not have a direct equivalent to US National Security Letters.
Mullvad maintains a warrant canary and transparency page. It was most recently updated in line with its transparency commitments. After the 2023 police raid, Mullvad confirmed in its transparency report that the raid occurred and that no data was handed over, a level of transparency that goes beyond a canary to direct disclosure.
NordVPN maintains a transparency report that updates regularly. Panama, where NordVPN is incorporated, has no intelligence-sharing agreements with the US and does not have National Security Letter equivalents in its legal system. The warrant canary is less legally necessary in this context but is maintained for user trust.
Windscribe explicitly maintains a warrant canary and is known in the privacy community for direct, transparent communication with users about its legal interactions with authorities.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
What a warrant canary does not protect against
It is important to be clear about the limits. A warrant canary is useful if:
You are monitoring it. If the canary disappears and you are not checking, you will not notice.
The company is acting in good faith. A canary is only meaningful if the company would actually remove it when required, rather than maintaining a false canary under a secret order. There is no way to audit this from the outside.
The legal theory holds. Courts have not definitively ruled on whether maintaining a false canary constitutes illegal perjury or whether removing one constitutes compelled speech. The legal environment varies by country.
A warrant canary does not protect against:
A future logging requirement that the company complies with after the canary is removed. The canary tells you that something has changed; it does not prevent the data from being collected once the order is served.
A provider that decides to comply with a secret order and also quietly removes the canary without drawing attention to its absence. This is theoretically possible but would be a significant reputational risk.
Metadata analysis by adversaries who have access to your ISP, regardless of whether the VPN provider’s canary is intact.
How to use a warrant canary practically
Know your VPN’s canary location. Most VPNs publish their transparency reports on a dedicated page. Bookmark it.
Check it periodically. Quarterly is sufficient for most users. Some privacy-focused users set a reminder to check monthly.
Know what to look for. A canary statement typically says something like: “As of [date], [company] has not received any national security letters, FISA orders, secret court orders, or other requests requiring non-disclosure of data requests.” If this statement is missing or out of date, investigate.
Combine with jurisdiction knowledge. A canary from a US-based VPN is more legally relevant than one from a Panama or Switzerland-based VPN, because those jurisdictions are less vulnerable to NSL-type demands in the first place.
Does a VPN need a warrant canary if it keeps no logs?
This is a legitimate question. If a VPN provider genuinely keeps no logs, a government order to hand over data results in nothing being handed over, because there is nothing to give. Mullvad demonstrated this in practice.
A canary is most important for VPNs that might have metadata even under a no-logs policy, or where jurisdiction makes secret orders more likely. For a no-logs, RAM-only VPN in Panama or Switzerland, the canary is a useful transparency signal but is less operationally critical than for a US-based provider.
Warrant canaries are a useful transparency tool but are not a substitute for audited no-logs policies or strong jurisdictional protection. The providers that maintain the most credible canaries are also those with the strongest underlying privacy architecture: ProtonVPN, Mullvad, NordVPN. A canary from a provider in a bad jurisdiction that keeps metadata is less meaningful than a canary from a no-logs provider in a privacy-friendly country.
Keep reading: Does Mullvad Keep Logs? What the Police Raid Actually Proved and Five Eyes, Nine Eyes, and What VPN Jurisdiction Actually Means.