Title: Practicing Safe Browsing: Understanding How and Why University Students Use Virtual Private Networks

Abstract: In spite of their name, Virtual Private Networks (VPNs) may introduce users to new security and privacy threats. Recent studies have shown that some commercial VPNs leak user traffic to third-party trackers. In light of these developments, we aim understand how and why a technically savvy population---university students---chooses and uses VPNs, whether they are aware of data leakages by VPNs, and how awareness and attitudes about VPNs affects decisions to use them. To answer these questions, we conducted 32 in-person interviews and a survey with 349 respondents, all university students in the United States. We found that students were mostly concerned with access to content, and privacy concerns were often secondary. They made tradeoffs to achieve a particular goal, such as using a free commercial VPN that potentially collects their online activities simply to access an online service in a geographically restricted area. Many users even expected that their VPNs were collecting data about them, although they did not understand how VPNs work. Given the proliferation of choices among VPN providers, it is technically possible to achieve both access and privacy. We conclude with a discussion, informed by our results, concerning ways to help users make choices about VPNs that help them access content without compromising privacy.