For years, a convenient story has circulated about the Chinese internet. The government blocks Google, WhatsApp, Wikipedia, and a long list of other foreign services. People download a VPN. Life continues, more or less, on the other side of the wall.
A cache of leaked internal documents now suggests that story is badly out of date. VPN use in China is not a mass habit. It is a thin, fragile sliver of traffic — and much of even that sliver may not be private at all.
In June 2026, researchers Jessica Batke and Laura Edelson published a detailed analysis of traffic reports from Geedge Networks, a Chinese firm that builds internet surveillance and censorship systems. The documents were part of a leak of more than 100,000 files that a consortium of journalists and researchers has been examining. Buried in that pile was something rare: real measurements of what people in China were actually reaching online, including blocked foreign apps.
What the leak actually measured
In 2022 and 2023, Geedge ran a field test in the Xinjiang Uyghur Autonomous Region, watching traffic that flowed through China Unicom, China Mobile, and China Telecom. After the test, the company moved toward a more centralized setup using the carriers’ own data facilities. The researchers focused on weekly reports covering China Unicom and China Mobile from January through July 2023. China Telecom’s reports were missing from the leak, as was one week in January.
The reports tracked traffic that crossed a provincial border — either to the rest of China or abroad — and listed connections to a set of “commonly used” foreign services: news sites, video platforms, social networks, messaging apps, blogs, and video-calling tools. The list looks less like a popularity ranking and more like a political worry list. Several of the named services barely moved any data at all. Some did not even generate enough traffic in a week to load a single webpage.
Xinjiang is not a typical sample of China. It is among the most heavily policed regions on earth. People have been punished for little more than having WhatsApp on a phone. That almost certainly suppresses attempts to reach banned services. The researchers are clear about this, and they still argue the numbers tell us something about the country as a whole: China’s blocking system was not a special Xinjiang-only filter. The same anti-VPN machinery ran nationwide. Fear may have lowered demand in Xinjiang, but the technical barrier was already high everywhere.
Almost all of the internet stays inside China
Foreign traffic never reached 6 percent of the total in any of the reports reviewed. Over seven months it averaged just over 4 percent. The rest stayed domestic.
That is not only a matter of taste. Beijing has spent years making the domestic internet a closed habitat. Foreign platforms are banned or starved of local servers. Homegrown substitutes absorb the demand. Circumvention tools have been squeezed. In Xinjiang, the constant possibility of punishment adds another layer: self-censorship. Put those together, and cross-border traffic collapses to a rounding error.
The listed foreign apps themselves were a rounding error inside that rounding error. Combined, they generally made up less than 1 percent of foreign traffic — about 0.004 percent of all traffic. On an average day, those services exchanged just under 320 gigabytes with users in the region. About 26 million people there used mobile internet in 2023. Spread across the two carriers in the reports, that works out to a few hundredths of a megabyte per person per day. A short video clip uses more data than that.
A connection is not the same as getting through
Raw connection counts overstate real use. Google, one of the most-reached names on the list, saw about 48,000 unique IP addresses from the region on an average day, moving about 82 gigabytes. That is roughly 1.7 megabytes per address — less than a typical search-and-results page, and far less than opening a document or loading an image-heavy site.
Traffic was also skewed. One China Mobile address accounted for 1.3 gigabytes in a single week in April 2023. When a handful of heavy users pull the average up, most of the remaining “users” are probably leaving with almost nothing. Many of those Google connections look like brief slips through a crack in the filter, followed by a dead session. The person on the other end never got a working page.
Unique IP addresses are a rough stand-in for people, not a headcount. One person can appear as two addresses, from home and from work. One address can hide several people. Even so, the picture is consistent: only a small share of the population even tries, and a smaller share succeeds.
The VPNs that still work are often the ones the state can watch
China has not banned every VPN. It has split them into two species.
State-approved VPNs are still legal, mainly so businesses can reach the foreign services they need. They provide access. They do not provide privacy. The point of licensing them is to keep the economy from seizing up while remaining able to see where traffic goes.
A genuine independent VPN would hide the destination. In the Geedge data, destinations were often visible. That is a strong clue that a lot of the “successful” foreign-app use ran over approved tunnels, not black-market ones. If someone had been using a properly encrypted, unapproved VPN, Geedge would still have seen traffic leaving the country — but not the exact site on the other end.
This distinction matters more than the marketing word “VPN.” A tunnel the government issues is a permission slip. A tunnel the government cannot inspect is the thing people usually mean when they say they want a VPN.
How rare is VPN use, really?
Older public estimates of VPN use in China were almost useless, stretching from about 3 percent of internet users to 30 percent. The leak lets researchers put a floor and a ceiling on the Xinjiang numbers.
Ceiling: if every byte of foreign traffic were treated as VPN traffic to a banned site, the share would still average around 4 percent. That is an extreme overcount. Some foreign services on the list were not even blocked at the time.
Floor: on an average day, about 154,000 unique IPs reached the named foreign apps, but many of those addresses hit more than one app. The single most-reached service, Google, averaged about 48,000 IPs. Doubling that to account for the missing third carrier lands around 100,000 people a day — about 0.4 percent of a regional population of 25 million.
The real figure sits somewhere between those bounds. The researchers put typical VPN use in the low single digits, in the same neighborhood as a 2022 estimate of about 3 percent, and possibly lower. Even if usage in richer coastal provinces is two or three times the Xinjiang rate, it is still not a third of the country. It is not even close.
Domestic apps did not just win. They buried the competition.
The top five domestic services drew about 25 times as many unique addresses as the top five foreign ones, and moved about 1,000 times as much data. Video-heavy local apps naturally inflate traffic volume, so the researchers looked at both users and bytes. It did not matter. Foreign services were almost invisible on both measures.
There was also no clean link between “blocked” and “unpopular.” Skype and Snapchat were among the least-blocked names on the list; only Skype cracked the top five by traffic. The most-reached foreign names — WhatsApp, Google, and Twitter — were blocked, which means the people who got through were using some kind of VPN, most likely an approved one.
Some obvious giants never appear in the reports at all. TikTok, the international twin of Douyin, is blocked in China and was already one of the world’s heaviest mobile apps by 2023, yet it is absent. Foreign games are absent too, despite years of official anxiety about online gaming. The documents do not explain the omissions. The safest reading is that Geedge was tracking political sensitivity, not a complete map of foreign demand.
One crack in the wall showed the demand is still there
Late May and early June 2023 produced the only real bump in the listed foreign apps. That is the stretch of the calendar when Chinese authorities are especially tense about any mention of the 1989 Tiananmen Square crackdown. For three weeks, those apps rose to between 1 and 2 percent of foreign traffic, driven by a sharp spike in WhatsApp on China Unicom.
Even at its peak, WhatsApp was about 2 percent of foreign traffic, or 0.1 percent of all traffic, in the week of June 5, 2023. That is not a mass movement. It is a flicker. But the user count jumped by orders of magnitude in a few weeks. The researchers cannot say exactly why — a short-lived circumvention trick, a misconfiguration, a brief hole in the filter. They can say what it implies. When a blocked service becomes reachable, people rush it.
That is the other half of the story, and it is as important as the low baseline. The leak cannot measure people who want foreign apps but are too afraid, too locked out, or too unsure how to start. It can only count the people who actually connected. The WhatsApp spike is a reminder that those two numbers are not the same. The government can constrain behavior. It cannot erase the desire.
What this means if you still have a choice
The practical lesson is not that VPNs are useless. It is that a VPN is only as free as the network that allows it.
In China, the state learned that banning a list of websites is not enough. It also had to choke the tools that hop the list, license the leftovers, and make the domestic internet good enough — or frightening enough — that most people stop trying. The result is an internet that looks complete from the inside and sealed from the outside. A few percentage points of users still poke at the seam. Many of them do it through tunnels the authorities can inspect.
If you live in a country where you can install a VPN without a license, that is not a small convenience. It is the difference between a private tunnel and a supervised one. Use a provider you chose, not one a government assigned. Prefer modern protocols with a small, auditable design. Keep the app updated. Do not confuse “connected” with “unobserved.”
The Geedge documents are a snapshot of one region, in one window of time, from two of three carriers, with local-only traffic missing and latent demand uncounted. They are still the clearest recent look we have at real Chinese network behavior. They show a censorship system that is working — not perfectly, but well enough that unsanctioned access has been pushed to the margins.
A wall that lets 3 percent of people through is still a wall. The people on the other side of it, for now, are the ones who still get to decide whether a VPN is a private tool or a government service with a friendlier name.
