[zirgs]

If they sell data then it's possible to buy that data. So a security researcher could simply try buying that data and then expose that VPN provider.

[waithuh]

The market for data is shady. They can simply sign contracts with a few reputable "market intelligence" firms. I am also very sure that another VPN firm wouldnt mind being a proxy seller the browsing data in return for some comission.