NordVPN and Surfshark are merging, continuing VPN consolidation trend

NordVPN and Surfshark have finalized a merger agreement between the two VPN providers, the companies announced Wednesday. Though the specifics of the transaction aren't being released, the finalized merger agreement follows months of negotiations between the two companies that began in mid-2021, according to a joint press release issued by Surfshark and Nord Security, NordVPN's parent company. 

Surfshark and NordVPN had been rivals in the ultra-competitive market for VPNs (virtual private networks) prior to the merger, but are now joining forces to "solidify both companies' offerings in different market segments and diversify the geographical reach," according to the press release. More consumers have turned to VPNs in recent years to counter increasingly invasive digital tracking from search engines, ISPs and advertisers, as well as to circumvent local content restrictions and censorship. 

But the merger of two of the industry's top names -- both of which have long been among CNET's top VPN picks -- highlights the continued trend of consolidation in the VPN industry, which finds more brands under the umbrella of just three big companies -- Kape Technologies, Tesonet and Ziff Davis -- making it more important than ever to understand which entities are ultimately controlling the data sharing and privacy policies that underpin VPNs. 

The merger announcement follows the news just days ago that Surfshark wasdeveloped with the help of Tesonet, the same Lithuanian business incubator that helped NordVPN in its early days. While the Tesonet-NordVPN relationship was already known, the ties between Tesonet and Surfshark had been previously undisclosed. That changed last week after a report at Lithuanian news site Verslo žinios. 

Responding to that report, Surfshark's communications head Dominykas Dimavičius said "... Surfshark wasn't developed with NordVPN as it's a completely different company. Even though we operate from the same country, NordVPN is our competitor." The news of the merger turns that statement on its head, though the companies will continue operating autonomously and "rely on separate infrastructure and product roadmaps," according to the press release.

When asked about how the merger affects the companies' respective data and privacy policies, Dimavičius told CNET that Surfshark is "legally bound not to share any information between the entities that would go against our Terms of Service or Privacy Policy, therefore we have no plans in doing so without notifying our customers in advance."

Surfshark CEO and founder Vytautas Kaziukonis said that consolidation in the market is a sign of the industry's maturity, but acknowledges there are challenges ahead. "Nord Security and Surfshark joining forces will set the ground to scale in different digital security dimensions, which is necessary to meet the growing requirements of our customers."

Meanwhile, Tesonet and Nord Security co-founder Tom Okman hopes the merger will help establish the companies as an "internet security powerhouse." 

"The increasing complexity of cybersecurity and digital privacy is a growing challenge worldwide. We believe that this industry requires radical simplification and ease of access, both for consumers and businesses," said Okman.

Still, for consumers, the ongoing consolidation means an increasingly smaller number of companies ultimately have access to and control of your data -- no-logging policies notwithstanding -- not to mention a decreased motivation for competitive pricing. Surfshark had a well-earned reputation of delivering a comparable experience to Nord at a lower cost. It will be interesting to see how the pricing and data policies look in the months ahead, once both brands are rolling into the same balance sheet.