Non-functional analytics consent(?)

[BowDown097]

Beginning with version 4.0.0, many requests are being sent to applytics.nordvpn.com during use, despite analytics being turned off. I don't know the contents of the requests, but I feel like this is an error, as it didn't happen prior.

❯ nordvpn settings
User Consent: disabled

[devzbysiu]

Thanks for raising this! 🙇

Starting with version 4.0.0, we’ve made the analytics behavior more visible. There are two types of analytics in the app:

• Essential analytics – minimal technical data that helps ensure the service functions reliably (e.g. stability, performance, and error tracking). These are always active.
• Additional analytics – optional usage data that helps us improve user experience. These can be turned off in the settings (as you’ve done).

What you’re seeing are requests related to the essential analytics. These were already present in earlier versions, but the handling and visibility of them is clearer in 4.0.0 and later.

Let us know if you have any further questions

[BowDown097]

These were already present in earlier versions

Well, this was the source of my confusion. I don't believe I saw any such requests just having the connection active, without using the CLI or anything, with the setting off. Now, since 4.0.0, I do, and a lot of them (over 1000 in the span of a handful of hours).

If this behavior is intentional, then I don't have any more questions. Thank you for getting back to me.

[devzbysiu]

I see 🤔 , I'll get back to you. It turns out, there is some investigation being done in parallel related to analytics so you may be right. I'll try to get more information and let you know.

In the meantime, are you able to tell what kind of requests you are observing?

[FGD-Garuda]

Hello,

Since 4.1.0 (not 4.0.0), the Analytics are constantly writing to disk every second, from 500kb to 1meg as I could see.
This heats up my NVME and wears it out in the very long run. Also I don't like seeing constant write I/Os.

4.1.1 also has the same behavior (I consider that an issue), but downgrading to 4.0.0 it is ok.

Executing journalctl -u nordvpnd.service -f, here are 2 examples of requests with responses:

Sep 19 16:21:02 Garuda nordvpnd[911]: Request:  POST https://applytics.nordvpn.com/v2/app/events map[Content-Encoding:[gzip] Content-Type:[application/json] User-Agent:[Moose/16.1.3 (Garuda Linux; linux x86_64) (No Name/No Version) debugger/log]]
Sep 19 16:21:02 Garuda nordvpnd[911]: Response: HTTP/1.1 200 - map[Alt-Svc:[h3=":443"; ma=86400] Cf-Cache-Status:[DYNAMIC] Cf-Ray:[981bc98119f08c7e-EWR] Connection:[keep-alive] Content-Length:[0] Date:[Fri, 19 Sep 2025 20:21:02 GMT] Nel:[{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}] Report-To:[{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5PapYBUeZ%2FoNqp6eXTC9lrq%2FnLYD48kNVTlhuMPhllQiG0KOnHyntoVM96%2BtI8Rr755SIQ%2Bpn23KBGrFoCEGPnPcnWJk6Q8cdaduuqFoiNA7bY6Mew%3D%3D"}]}] Server:[cloudflare]]

Sep 19 16:21:03 Garuda nordvpnd[911]: Request:  POST https://applytics.nordvpn.com/v2/app/events map[Content-Encoding:[gzip] Content-Type:[application/json] User-Agent:[Moose/16.1.3 (Garuda Linux; linux x86_64) (No Name/No Version) debugger/log]]
Sep 19 16:21:03 Garuda nordvpnd[911]: Response: HTTP/1.1 200 - map[Alt-Svc:[h3=":443"; ma=86400] Cf-Cache-Status:[DYNAMIC] Cf-Ray:[981bc987d90f8c7e-EWR] Connection:[keep-alive] Content-Length:[0] Date:[Fri, 19 Sep 2025 20:21:03 GMT] Nel:[{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}] Report-To:[{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=v1rh23DYeJmii3e3wlNjl%2BNkefGRSe6aBPgp3RIRR9K%2BwTvYvdsYkhUeIy4ooKyE96ZS5Tc57elbpZDMTSIQ68sCPYIMVRPuCAP0F1AyOYoISl8GFg%3D%3D"}]}] Server:[cloudflare]]

I have Analytics OFF and ThreatProtection as well.

EDIT: Adding iotop -o screenshot (sorry for screenshot, I could not pause it and stdout to file was showing all I/O at 0byte/s):

Any chance those writes to disk can be deactivated?

Tnx!

[devzbysiu]

Hello @FGD-Garuda , thank you for the feedback.

We are looking into it. I'll let you know when we know more