Opera VPN
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Oslo-heritage browser VPN (Opera Norway AS): Deloitte-audited free browser proxy + paid VPN Pro, but ultimately Chinese-controlled via Kunlun Tech (Opera Limited, Cayman/NASDAQ). Listed as a warning.
Opera VPN offers EU hosting in Norway, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under VPN.
Assessment notes
Opera VPN is the 'Norwegian outside, foreign inside' case in this category. The data controller and heritage entity is Opera Norway AS in Oslo (a 30-year-old Norwegian browser maker; the free browser VPN dates to 2016 via the SurfEasy acquisition), and the free in-browser VPN passed an independent Deloitte no-log audit (18 Jun–10 Aug 2024) confirming no logging of browsing activity or originating network address, so on a pure product-privacy axis it is defensible. But the ownership reality is the opposite of a sovereignty win: Opera Norway AS rolls up via Opera Services AS → Opera Holdings AS to Opera Limited, incorporated in the Cayman Islands and listed on NASDAQ (OPRA), which is in turn majority-owned and controlled by Kunlun Tech Co. Ltd. (Beijing-based, Shenzhen-listed; ~69% stake), whose controlling shareholder Zhou Yahui is also Opera's executive chairman. The structural exposure is therefore dual and non-EEA: a minor US-nexus from the Cayman/NASDAQ listing, but material exposure to Chinese-law / non-EEA control of the ultimate parent, captured here as cloud_act_exposure: material (closest tier; the controlling jurisdiction is China, not the US). country_iso is kept as NO to reflect the Oslo operating entity / buyer-facing brand, with the Chinese control captured in ownership_signal + this rationale. The paid Opera VPN Pro (~€4/mo, 6 devices) does not run on Opera's own fleet: it is a white-labelled third-party network (originally NordVPN, more recently reported to be ExpressVPN/Kape technology), neither EU-owned. Listed as a warning, not a recommendation: no EU/Norwegian sovereignty signal survives the Kunlun Tech control.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Opera VPN
Opera VPN is two products under one brand, both carrying the Opera name and its Oslo heritage. The free browser VPN is a no-registration, unlimited, browser-only TLS/HTTPS proxy built into the Opera browser, offering three broad regions (Americas, Europe, Asia) rather than country-level choice; it is a proxy for Opera browser traffic, not a full-device VPN tunnel, and lacks a kill switch. The paid Opera VPN Pro is a full-device VPN (Windows, macOS, Android; no native iOS/Linux app at audit) priced around €4/month with annual plans roughly 50% cheaper, 6 simultaneous devices, and a 30-day money-back guarantee. Crucially, VPN Pro does not run on infrastructure Opera owns: it is a white-labelled third-party network, originally NordVPN's servers, more recently reported (TechRadar) to be powered by ExpressVPN's technology, so the underlying fleet belongs to non-EU VPN consolidators.
On product privacy, Opera has a genuine credential: the free browser VPN completed an independent Deloitte no-log audit (engagement 18 June–10 August 2024) which verified that the infrastructure contains no logging functionality and collects no data about browsing activity or originating network address. Opera Norway AS is the named data controller, and the privacy statement describes both free VPN and VPN Pro as no-log services, with only a random subscriber ID shared with the third-party VPN Pro provider.
The reason this listing exists as a warning rather than a recommendation is the ownership chain: the cleanest 'Norwegian outside, foreign inside' example in the directory. Opera Norway AS (Oslo) is wholly owned through Opera Services AS and Opera Holdings AS by Opera Limited, a holding company incorporated in the Cayman Islands and listed on NASDAQ under OPRA. Opera Limited is in turn majority-controlled by Kunlun Tech Co. Ltd. (a Beijing-based, Shenzhen-listed Chinese technology group holding roughly 69%) whose controlling shareholder Zhou Yahui also serves as Opera's executive chairman. The 2016 acquisition by a Kunlun-led Chinese consortium is the moment the heritage Norwegian browser became a Chinese-controlled asset. For an EU/EEA sovereignty audit, none of the Norwegian heritage signal survives this: the ultimate decision-making and beneficial control sit under Chinese jurisdiction, the listed parent under Cayman/US-securities jurisdiction, and Norway itself is a member of the 'Nine Eyes' extended intelligence alliance. Best read: a usable free browser proxy with a real Deloitte audit, but the structural antithesis of a sovereignty pick. EU/EEA buyers wanting an actual sovereignty profile should prefer Mullvad (SE, founder-owned), ProtonVPN (CH, non-profit Foundation), IVPN, or AirVPN (IT, founder-controlled).
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Opera VPN
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Italy · €7/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Sweden · €3.75/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Romania · €2.19/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
AirVPN
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€7/mo |
AzireVPN
Sweden
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€3.75/mo |
CyberGhost
Romania
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€2.19/mo |