KotoVPN

Guide · Updated August 13, 2026

Why most VPN reviews cannot be trusted

Why does every VPN site recommend the same providers?

Short answer

Because commission rates in this category are unusually high, several apparently independent providers share a parent company, and some review sites are owned by that same parent. The result is a market where the ordering of recommendations correlates with payout more reliably than with quality. This page includes the ways our own site could be wrong.

The commission structure

VPN affiliate payouts are among the highest in consumer software, often a large share of the first-term price. A two-year subscription generates a single payment big enough that the difference between recommending provider A and provider B is material to a publisher.

That is not automatically corrupting. It becomes corrupting when the scoring method is undisclosed, because then nothing external constrains where the ordering lands.

Common ownership

Several widely recommended providers share a corporate parent. In the past, that parent has also owned VPN review and comparison websites, which produced the situation where a site could rank its own group’s products against competitors.

A reader comparing "five independent reviews" may be reading fewer independent sources than they think, and choosing two providers for redundancy may mean choosing one company twice.

What an unreliable review looks like

These signals are visible without knowing anything about the site’s finances.

  • Scores to one decimal place with no stated inputs — 9.8 and 9.6 with no explanation of what separates them
  • Every provider scoring above 8, so the scale carries no information
  • Speed figures with no baseline, no run count, no client location and no date
  • Claims that a specific streaming catalogue works, with no test date
  • No provider the site earns nothing from anywhere near the top
  • A "last updated" date that changes monthly while the content does not

How this site could be wrong

The rubric is published, but we chose the weights. A different set of weights produces a different order, and ours reflect a judgement that audit evidence and jurisdiction matter most. That judgement is arguable and we have argued for it rather than hidden it.

The dataset is compiled from provider documentation, which means we are trusting providers to describe themselves accurately on the facts we have not independently verified. Our own lab measurements do not exist yet, which we state on every review rather than filling the gap.

And we do earn commission from some providers. The check we offer is structural rather than a promise: providers we earn nothing from currently occupy top positions. If that stops being true without the rubric changing, stop trusting us.

Questions

Should I ignore any site that uses affiliate links?
No — that would remove almost every source including the technically competent ones. The useful test is whether the method is published and whether unpaid options appear near the top when the method says they should.
Are user reviews more reliable?
They have different failure modes. Review platforms in this category carry a high volume of incentivised submissions, and individual reports rarely control for distance, protocol or time of day. They are useful for support quality and billing complaints, less so for performance.
How do I verify a score myself?
Ask what the inputs were. If a site cannot tell you which factors produced a number and how they were weighted, the number was chosen rather than calculated.

Terms used here

Independent audit

An examination of a provider’s systems or policy by an external firm, published with the firm’s name, the date, and the scope.

Jurisdiction

The country whose law governs the company operating the VPN, which determines who can compel it and by what process.

Related