Summary

  • In the same Chilean sample, destination addresses geolocated to Chile accounted for 9.5% of requests through one VPN and 64.2% through another.
  • DNS answers diverged more for page dependencies than for the domains people typed, while hosting-organization overlap stayed much higher.

“We measured from Chile” sounds like a method. In this study, it hid a choice capable of moving the result from one request in ten to almost two in three.

APNIC published the finding on 30 October from research led by Sachin Kumar Singh. The team tested four VPN providers across 14 economies. For each economy, it loaded 1,000 websites: 800 globally ranked sites, 100 locally popular sites and 100 government sites. Each site was scheduled for 25 visits through each provider during three weeks in March and April 2025. The browser records included the servers serving page components such as scripts and fonts.

Chile makes the problem hard to wave away. In the same sample, 9.5% of analysed requests through ExpressVPN were associated with server addresses geolocated to Chile. The corresponding shares were 62.7% through Surfshark and 64.2% through NordVPN. That is a 54.7 percentage-point spread in what counted as domestic-looking delivery, with the source economy and website set held constant. It is a study result, not a count of Chileans, consumer VPN market share or a map of stored data.

The path explains why provider choice matters. A VPN exit changes the network a site sees. DNS can return a different address; a content-delivery network can select another replica; routing can carry the same address to a different physical facility. Across the study’s provider pairs, DNS answer sets disagreed in about 12% of comparisons for initial domains and 31% for dependency domains. Yet the answers shared at least one hosting organization in 98% and 96% of comparisons, respectively. A different IP or serving location often sat inside a more stable company-level picture.

That gap can change a policy conclusion. A researcher who samples one VPN may describe an economy as keeping web requests at home; another provider can make the same economy look far more dependent on foreign endpoints. The study measured where request destinations were geolocated. It did not measure where an account, workload or backup was stored.

The method should name the VPN as part of the instrument. Report provider, protocol, exit location, resolver, observation window and whether embedded resources count. When the conclusion depends on domestic-versus-foreign endpoints, repeat the run through another provider and publish the spread. “From Chile” is not enough.

Sources: APNIC’s research account; the authors’ original paper.