You would think a company whose core product is supposed to be about privacy would be extra careful to respect its customers' privacy on their own website.
I think you make a valid point, but there's a difference between their sales pipeline and their actual product. These VPN providers are businesses, and they're trying to optimize their sales. What demographics are most interested in their products? How did they get there? Does Google Analytics (or Facebook, or similar) have profiles on people shopping for VPNs? Are there advertising patterns that could have better ROI for attracting users?
I'm not defending the ethics of major VPN providers -- they certainly don't all have stellar records -- but I would be surprised if any major SaaS company didn't track user behavior on their brochureware/sales pages.
Great. But being privacy-conscious organizations, the VPN providers are surely including a clear and explicit opt-in/opt-out to any kind of data collection. Right?
Checks nordvpn’s site
Whoops. Nevermind.
All of these VPN services lean really hard into the fear factor for marketing, and this article seems no different. Just identifying a minor worst-case risk on their competitor's sites, extrapolating that risk and hoping no one notices these are websites (not services), and bundling it up nicely in an SEO-friendly blog post. VPN services are notoriously suss when it comes to disclosure anyway, but they're largely marketing to the lowest common denominator of the privacy-paranoid.
Next week's cruft article: "Your VPN provider knows your IP address"
Rinse and repeat.
Which VPN providers are using replay scripts on their website from services that don't properly exclude passwords, payment information, and PII from the replays?
That's actually worth reporting about. The rest seems like fearmongering.