How much of what we measure about the Internet reflects the Internet itself, and how much is shaped by the tools we use to collect those measurements? Researchers often use Virtual Private Networks (VPNs) to collect measurements through connections in different economies. This approach commonly assumes that VPNs in the same economy provide roughly the same view.
Our study shows that using different VPN providers can change which servers a browser connects to, and the economies in which those servers are located, even when connecting from the same economy. These provider-dependent differences can lead studies to overestimate or underestimate how much web traffic stays within an economy, how much crosses borders, and which economies appear to host the infrastructure serving users.
This means that a study using one VPN provider may conclude that web traffic is largely served within an economy, while another provider may make the same economy appear much more dependent on infrastructure outside of it. The choice of measurement tool can therefore shape not just the data collected, but also conclusions about data localization, cross-border exposure, and the geographic distribution of the Internet.
How we tested whether VPN choice changes Internet measurements
To investigate this, we built VPN-Scope, a system that visits the same websites through different VPN providers at nearly the same time, using connections in the same economy and, where possible, the same city. Our study covered four providers (ExpressVPN, NordVPN, ProtonVPN, and Surfshark) and 14 economies across Europe and the Americas. We selected 1,000 websites per economy, combining globally ranked websites with locally popular and government websites. Each website was scheduled for 25 visits through each provider over three weeks in March and April 2025.
For each visit, we recorded the servers contacted as the page loaded, including those supplying embedded resources such as scripts and fonts. We then examined their locations and hosting organizations. Additional experiments investigated the Domain Name System (DNS) and identified the physical locations serving content through different VPNs. Together, these tests helped us connect the differences we observed to the mechanisms producing them.
How much VPN providers changed the measured Internet infrastructure
Our measurements from Chile show how VPN choice changes the share of requests that appear to be served domestically rather than from abroad. In Chile (Table 3), 9.5% of the analysed requests through ExpressVPN were associated with server addresses geolocated to Chile. The corresponding shares were 62.7% through Surfshark, and 64.2% through NordVPN. The distribution across other economies also changed: Brazil accounted for 57.1% through ExpressVPN, compared with 2.4% through NordVPN.
These were measurements of the same website set from the same source economies, yet they produced noticeably different geographic pictures. The example also shows why the VPN provider is not just an implementation detail: Changing the provider can change the geographic conclusion a researcher would draw from otherwise comparable measurements.
A researcher using NordVPN would therefore observe a majority of analysed requests associated with domestic servers, while one using ExpressVPN would observe the opposite. For studies informing data-localization policy, that difference can change the apparent reliance on domestic versus foreign infrastructure, although these measurements alone do not establish where data is ultimately stored.
| Destination economy | ExpressVPN | ProtonVPN | Surfshark | NordVPN |
| US | 90.6 | 87.3 | 86.0 | 89.7 |
| RU | 2.7 | 4.0 | 3.8 | 3.8 |
| DE | 2.2 | 2.3 | 2.3 | 2.2 |
| NL | 1.3 | 1.2 | 4.1 | 1.2 |
| CA | 0.7 | 2.4 | 0.9 | 0.3 |
| IE | 0.8 | 0.9 | 0.8 | 0.8 |
| JP | 0.6 | 0.6 | 0.6 | 0.7 |
| CN | 0.5 | 0.6 | 0.6 | 0.6 |
| FR | 0.4 | 0.3 | 0.6 | 0.5 |
| GB | 0.2 | 0.5 | 0.3 | 0.3 |
| Destination economy | ExpressVPN | ProtonVPN | Surfshark | NordVPN |
| GB | 63.8 | 53.6 | 53.9 | 52.6 |
| US | 10.3 | 10.7 | 10.2 | 11.2 |
| NL | 5.0 | 10.9 | 12.2 | 7.1 |
| DE | 4.9 | 7.4 | 6.5 | 5.8 |
| RU | 5.8 | 6.1 | 6.5 | 6.1 |
| IE | 5.4 | 5.9 | 5.4 | 5.7 |
| BE | 2.8 | 2.7 | 2.7 | 5.1 |
| FR | 0.8 | 1.5 | 1.2 | 5.1 |
| CN | 0.7 | 0.7 | 0.9 | 0.7 |
| JP | 0.5 | 0.6 | 0.6 | 0.6 |
| Destination economy | ExpressVPN | Surfshark | NordVPN |
| CL | 9.5 | 62.7 | 64.2 |
| US | 24.4 | 25.5 | 25.1 |
| BR | 57.1 | 2.8 | 2.4 |
| RU | 3.9 | 3.3 | 3.1 |
| DE | 2.4 | 2.4 | 2.4 |
| NL | 0.9 | 0.9 | 1.0 |
| IE | 0.7 | 1.0 | 0.8 |
| JP | 0.3 | 0.6 | 0.5 |
| FR | 0.5 | 0.5 | 0.3 |
| CA | 0.4 | 0.4 | 0.3 |
The differences also appeared in our DNS experiments. When comparing two providers in the same economy, the returned address sets differed in approximately 12% of comparisons for initial website domains. For dependency domains, the additional services supplying scripts, fonts, analytics, and other page components, the disagreement rose to approximately 31%. Looking only at the website address someone types into a browser can therefore miss a substantial part of the variation.
However, different addresses did not usually mean different hosting companies. At the organization level, the compared DNS answers shared at least one hosting organization in 98% of initial-domain comparisons and 96% of dependency-domain comparisons. This is an overlap, not necessarily an identical set of companies. The broader finding is that VPN choice affects our picture of where content is served more strongly than our picture of which companies serve it.
What researchers can control to make VPN measurements more reliable?
Some sources of variation can be reduced through careful experimental design. Researchers can independently verify VPN server locations, compare connections from the same city where possible, and keep browser settings and measurement timing consistent. They should also record the provider, connection settings, and network used, rather than describe a measurement only as coming ‘from Italy’. The DNS service answering website-name lookups also needs to be checked. Choosing the same service in each configuration does not guarantee that every VPN will use it.
Other differences arise from decisions made by the networks themselves. Content Delivery Networks (CDNs) distribute copies of content across multiple locations, and can select different servers according to the network a request comes from. Routing can also take two connections to different physical locations even when they use exactly the same destination address.
In our targeted tests, VPN connections starting in Milan reached content-serving locations in Milan or Frankfurt. A shared starting city — and even a shared destination address — was therefore insufficient to guarantee a shared physical destination. These decisions depend on network arrangements that researchers cannot standardize through browser or VPN settings alone.
One view of the network
Taken together, these results suggest that the VPN provider should be treated as part of the experimental design, not simply as a tool for obtaining a connection from a particular economy. Researchers should report which provider and connection settings they used, verify where the VPN exit is actually located, and, when geographic conclusions matter, consider repeating measurements across more than one provider.
Even these steps cannot eliminate all of the variation: DNS infrastructure, CDN steering, and network routing can still cause two VPN connections from the same economy, or even the same city, to reach different servers or physical locations. The importance of this variation also depends on the question being asked.
Our measurements suggest that conclusions about which economy an endpoint is in, whether traffic appears to remain domestic, and which physical replica serves the content are more sensitive to VPN choice, while conclusions about which hosting organizations are involved are generally more stable.
For studies of cross-border data flows, data localization, or the geographic distribution of Internet infrastructure, a result obtained through one VPN provider should therefore be understood as one view of the network rather than a provider-independent picture of the economy.
Sachin Kumar Singh is a Postdoctoral Researcher at the University of California, whose research interests lie in the broad areas of security, privacy, and Internet measurement.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.