Urban VPN is one of the most installed free VPNs on the web, with millions of Chrome users, no sign-up and no data cap on desktop. Free and unlimited usually means someone else is paying, so the real question is not whether it hides your IP address but what it does with everything else it can see. This guide is based on Urban VPN’s own privacy policy and store listing, Koi Security’s 2025 research, and reporting from Ars Technica, The Register and The Hacker News. We did not run our own tests for this page.
This article contains no affiliate links. See our affiliate disclosure and how we review. Updated: November 2026
Bottom line: Urban VPN works as an IP changer, but we would not trust it with anything private.
- Its business model is data. Urban VPN’s privacy policy says its parent company is a data broker and that browsing data feeds market-intelligence products sold to businesses.
- It has collected AI chats. Koi Security found the Urban VPN Proxy extension capturing prompts and replies from ChatGPT, Claude, Gemini and other chatbots from July 2025, with the VPN on or off.
- The AI data category is still in its policy (updated September 4, 2026), described as protection plus de-identified “market intelligence.”
- It is still widely available. As of November 14, 2026, the Chrome Web Store lists Urban VPN Proxy with 7,000,000 users.
- If you used it with AI tools, uninstall it, and change any passwords or API keys you pasted into a chatbot.
What Urban VPN is and how it stays free
Urban VPN is made by Urban Cyber Security Inc., which its privacy policy lists at an address in Wilmington, Delaware. It offers a Windows app, Android and iOS apps, a Mac app and browser extensions. According to its “Why free?” page, browser extension and desktop users get a free connection without bandwidth limits, Android free users get 100MB a day, and iOS is Premium-only. Urban says it is “supported by its Premium VPN users.”
The privacy policy tells a fuller story. Under a heading titled “Data Broker,” it says: “our parent company is a data broker… meaning you data may be sold or shared with our parent company’s clients.” It adds that in most cases business customers get aggregated, de-identified data, but that Urban “may sell or otherwise disclose raw Personal Information to our affiliates or parent company” so they can produce market intelligence. Its California privacy notice says it sells “marketing insights and behavior segments” built from web browsing data to advertising, analytics and e-commerce companies.
That parent company is BIScience. In January 2025, security researcher Wladimir Palant documented that BIScience owns Urban Cyber Security and that browsing history collected through Urban VPN, 1ClickVPN, Urban Browser Guard and Urban Ad Blocker is sold through BIScience products such as Clickstream OS and AdClarity. BIScience’s own privacy policy describes collecting clickstream data “through browser extensions operated by our affiliated company” and says it may share raw data and panelist IDs with business customers in some cases.
What Urban VPN collects, in its own words
The current policy (last updated September 4, 2026) lists several data categories for its free products. The most important ones:
- Browsing and activity data: referrer URLs, URLs you visit, ads you view or click, and search-results data including your keywords. Urban says this is “cleaned and scrubbed” on your device before upload, and aggregated within 90 days.
- AI inputs and outputs: “prompts, queries, content, and other inputs” you enter into AI tools such as ChatGPT, Gemini, Copilot, Claude and Perplexity, plus the answers you get back. Urban says it uses this for AI protection features and also uses “de-identified, filtered, and aggregated” versions “for market intelligence or analytics purposes.”
- Identifiers: IP addresses, which Urban says are trimmed and irreversibly hashed daily, and a random Panel ID used to track data sets.
Urban’s policy itself admits that, given what people type into chatbots, “some sensitive personal data may be inadvertently processed.” Meanwhile the Chrome Web Store listing says the extension handles location, web history and website content, and that the developer declares data is “not being sold to third parties, outside of the approved use cases.”
The 2025 AI chat harvesting report
On December 15, 2025, Koi Security CTO Idan Dardikman published research showing that the Urban VPN Proxy extension carried a dedicated script for each major AI chatbot, including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok and Meta AI. According to Koi:
- The feature arrived in version 5.5.0, released July 9, 2025. Because extensions auto-update, existing users received it silently.
- The script overrode the browser’s fetch() and XMLHttpRequest functions on those sites, so it saw every prompt and response before the page displayed it.
- Prompts, responses, conversation IDs, timestamps, session metadata and the model used were sent to analytics.urban-vpn.com and stats.urban-vpn.com.
- Collection ran whether or not the VPN was connected, and turning off the “AI protection” warnings did not stop it. Koi found no toggle; the only fix was uninstalling.
- The same code was in seven sibling extensions (1ClickVPN Proxy, Urban Browser Guard and Urban Ad Blocker on Chrome and Edge), for more than 8 million users in total.
Ars Technica, The Register and The Hacker News all covered the findings. The Hacker News noted that Urban’s privacy policy, updated June 25, 2025, already disclosed collecting AI prompts for safe browsing and “marketing analytics,” and The Register noted that Urban does disclose AI data collection in its setup prompt, where it is framed as a protection feature. Koi’s point was that the disclosure and the reality did not match: the consent prompt framed it as protection, the policy described marketing use, and the store listing said data was not sold.
Is Urban VPN safe right now?
It depends what you mean by safe. There is no public evidence that Urban VPN installs malware or steals passwords directly. It does change your IP address, and its store listing says connections are encrypted using OpenVPN standards. If all you want is to load a geo-blocked page once on a throwaway browser profile, it will probably do that.
But a VPN’s whole job is to reduce how much of your activity a third party sees, and Urban VPN does the opposite by design. You are routing your traffic through a company whose parent describes itself as a data broker, whose policy lists your visited URLs, searches and AI conversations as data it processes, and which was found in 2025 capturing chatbot conversations by default. Calling that data “de-identified” helps less than it sounds: Koi, summarizing earlier research by Palant and Secure Annex, said BIScience’s data is tied to persistent device identifiers, and Urban’s own policy says the Panel ID can be shared with clients in limited cases.
For comparison, browser-based options like Opera’s free VPN have had their no-log claims independently audited, while Hola has a different but similar trust problem with its peer-to-peer network. Urban VPN sits at the risky end of that spectrum.
What to do if you have Urban VPN installed
- Remove the extensions. Open chrome://extensions (Chrome) or edge://extensions (Edge) and remove Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard and Urban Ad Blocker if present.
- Uninstall the apps. On Windows use Settings → Apps; on Android, long-press the app and uninstall.
- Rotate secrets you shared with AI tools. If you pasted passwords, API keys, tokens or account numbers into a chatbot while the extension was installed after July 2025, change them.
- Ask about your data. Urban’s policy lists privacy[at]urban-vpn[dot]com for privacy requests, and its California notice says you can opt out of sharing web browsing data in the app settings.
- Check your new setup. After switching to another VPN, run a VPN leak test to confirm your IP and DNS are actually hidden.
Safer ways to get a free VPN
The safest free VPNs are usually free tiers of paid products, where the company earns money from subscriptions rather than your browsing data. Look for a published no-logs policy, an independent audit and clear limits on what the free tier gets. We cover two common options in our guides to whether Proton VPN Free is safe and Windscribe vs Proton VPN. Whatever you choose, avoid extensions that ask to “read and change all your data on all websites” unless you trust the company behind them.
FAQ
Is Urban VPN safe to use?
It is not malware in the classic sense, but it is not a privacy tool we would recommend. Urban VPN’s own privacy policy says its parent company is a data broker and that browsing data, and since 2025 AI prompts and responses, can be used for market-intelligence products sold to business customers. In December 2025 Koi Security reported that the Urban VPN Proxy browser extension captured full AI chatbot conversations by default.
Does Urban VPN sell your data?
Its privacy policy says its parent company is a data broker, that it may sell or disclose raw personal information to affiliates or its parent company, and that it sells marketing insights and behavior segments built mostly from aggregated web-browsing data. Urban says identifiers are usually removed or replaced with a pseudonymous Panel ID first.
Did Urban VPN collect ChatGPT and Claude conversations?
According to Koi Security’s December 15, 2025 report, version 5.5.0 of the Urban VPN Proxy extension, released July 9, 2025, injected scripts into ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok and Meta AI and sent prompts, responses and metadata to Urban’s servers, even when the VPN was off. Urban’s current privacy policy lists AI inputs and outputs as a data category it processes.
Who owns Urban VPN?
Urban VPN is run by Urban Cyber Security Inc., a company registered in Wilmington, Delaware. Security researcher Wladimir Palant and Koi Security both report that it is owned by or affiliated with BIScience (B.I Science (2009) Ltd.), an ad-intelligence and clickstream data company.
How do I remove Urban VPN?
In Chrome go to chrome://extensions, in Edge go to edge://extensions, and remove Urban VPN Proxy plus any other Urban or 1ClickVPN extensions. Uninstall the Windows or Android app from your system settings. Removing it stops future collection but cannot recall data already sent.
What is a safer free alternative to Urban VPN?
Look for a free tier from a company that earns money from paid plans rather than data, publishes a no-logs policy and has had it independently audited. Proton VPN Free and Windscribe’s free plan are commonly cited examples; check their current terms yourself before installing.
Related guides: Is Hola VPN safe? · Is Opera VPN safe? · Is Proton VPN Free safe? · How to check whether your VPN leaks · Is Turbo VPN safe? · Is VPN Proxy Master safe?
Sources: Urban VPN privacy policy (updated Sept. 4, 2026) · Urban VPN CCPA notice · Urban VPN: Why free? · Chrome Web Store listing (checked Nov. 14, 2026) · Koi Security, Dec. 15, 2025 (archived) · Ars Technica · The Register · The Hacker News · Wladimir Palant, Jan. 2025 · BIScience privacy policy
