Brave’s privacy-centric browser has been downloading VPN services to some customers’ computers without their consent. Noted by Ghacks, starting in 2022, downloading Brave to a Windows PC meant you were also downloading the company’s VPN service, regardless of whether you wanted it. The Firewall + VPN service is an extra paid subscription and would remain dormant unless the user subscribed to it. Still, that’s not the most transparent move from a company based on transparency.

The behavior is limited to the Windows version of Brave, and a post on GitHub from the company’s VP of engineering details the current behavior and a plan to change it. You can check for the VPN services on your machine in the services manager on Windows — they’re labeled as Brave VPN and Brave Wireguard. The GitHub post states that the ideal new behavior would be to download the services after someone has engaged with and paid for them, which, yes, it would be.

What’s not clear is whether the services will be removed from versions of Brave already downloaded. It’s possible to remove them manually, but until Brave changes the installation behavior, an update would probably reinstate them. One option — also detailed on GitHub — is to uninstall Brave and reinstall it without admin rights so that the program can’t install additional services. Guess it pays to be vigilant — even when it comes to privacy-conscious software.