Our latest transparency report is now live, covering April, May, and June 2026. We publish these every quarter so anyone can see exactly what legal requests PIA receives, how we categorise them, and what happens across our Bug Bounty and Vulnerability Disclosure programs. Full report here: https://www.privateinternetaccess.com/blog/transparency-report-q2-2026/
The legal requests
PIA received 19 legal requests over the quarter — the same total as Q1. They break down as:
- 4 subpoenas
- 2 warrants
- 7 other government, law enforcement, and civil requests
- 6 foreign and informal requests
Importantly, these are requests received. A request doesn't mean an allegation was substantiated, that a specific PIA user was involved, or that every request was even asking for the same thing. Each one is reviewed individually against the applicable legal process and our policies.
What we actually disclosed: nothing
No VPN activity or connection logs were produced in response to any of the 19 requests. That isn't down to fighting each one — it's because the data doesn't exist to begin with. PIA runs on RAM-only servers that don't write VPN session data to disk, so there are no browsing histories or connection records that could tie a person to activity on the VPN. A legal process can tell us whether we have to respond; it can't create records our systems were never built to keep.
Bug bounty
On the security side, after removing duplicates we had 51 unique submissions this quarter, 2 of which were classified as valid and passed to the relevant teams. Worth flagging: a higher submission count doesn't mean more real vulnerabilities. It includes duplicates, informational reports, and out-of-scope findings — but every submission still goes through triage.
Our next report will cover July–September 2026. Happy to take any questions in the comments.
