About the National Privacy Test
The National Privacy Test is NordVPN’s initiative introduced in 2020 and designed to test how well online users recognize privacy and cybersecurity risks. It’s available to anyone online and does not set quotas for age, gender, or background, meaning it’s not nationally representative.
The 2026 iteration comes with specific revisions, including several questions that were replaced or reworded to address current topics such as AI-related privacy risks, deepfake recognition, and emerging physical cybersecurity threats (such as QR code and USB charging station scams).
Because of the new revisions, the results of this year’s test are not comparable to those of previous National Privacy Tests. This year, the results are compared within two categories: across participating countries to highlight the best performers, and against the overall average to see whether a country performs above or below the global norm.
Methodology
The 2026 National Privacy Test consists of 24 questions divided into three categories:
- Daily digital life. The questions are designed to measure how well people handle the routine, everyday side of their digital lives — things like managing app permissions, keeping software updated, or using public Wi-Fi safely.
- Privacy awareness. The questions are intended to evaluate how well people understand the broader privacy landscape, including how their data is collected, stored, and used by companies and platforms. This category covers topics such as password protection, awareness of data tracking, and understanding of malware and infostealers.
- Digital risk. The questions aim to assess how people respond to specific risky situations they may encounter online. This category covers scenarios such as recognizing deepfakes, evaluating whether to save payment details in a browser, responding to suspicious emails, and understanding what information should not be shared with AI tools.
The test score ranges from 0 to 100 and reflects how well a person understands online privacy and cybersecurity. Each correct answer is worth approximately 4.15% of the final score, with a higher score meaning greater awareness and better knowledge. Based on the score, participants get assigned cyber personas (more on those below).
As of this writing, 23,181 people have completed the test, down from 30,792 in 2025 and 25,567 in 2024. Participating countries included Argentina, Australia, Austria, Belgium, Brazil, Canada, Denmark, Finland, France, Germany, Ireland, Italy, Japan, Lithuania, Mexico, the Netherlands, New Zealand, Norway, Poland, Portugal, Singapore, South Korea, Spain, Sweden, Switzerland, the UK, and the US.
The numbers in this blog post reflect responses collected up to July 31, 2026. If the results on the NPT website look slightly different, that’s because more people have taken the test since then.
Note: The NPT 2026 demographic dataset covers roughly 23,200 respondents globally, but the sample is not representative of the general population. The data comes from people who take an online privacy test voluntarily, so it likely reflects more digitally engaged groups. Result comparisons should be read with this sampling limitation in mind.
Cyber personas
A cyber persona is a moniker designed to represent a different level of knowledge and awareness of anyone who completes the National Privacy Test. Based on the test results, participants can get one of the four cyber personas:
- Cyber Wanderer (1-24% score). Cyber Wanderers have very limited knowledge about online safety. They are largely unaware of how to protect their accounts, devices, or personal data and are likely to be the most exposed to common digital threats.
- Cyber Tourist (25-49% score). Cyber Tourists have some basic awareness but still make common mistakes. They may recognize certain threats in general terms but often do not know how to respond to them in practice.
- Cyber Adventurer (50-74% score). Cyber Adventurers understand most everyday privacy and security issues. They know how to protect themselves in many situations and follow reasonably good digital habits but still have knowledge gaps around more specialized or newer threat areas.
- Cyber Star (75-100% score). Cyber Stars have the strongest knowledge. They are well informed about online risks, understand how their data is collected and used, and consistently follow safe digital practices.
As of this writing, 2% of the 2026 NPT participants were Cyber Stars, 3% were Cyber Wanderers, 42% were Cyber Adventurers, and 53% were Cyber Tourists.
What are the results this year?
The 2026 NPT results linger just under the 50-point mark, with 46 points as the global NPT score. Across all participating countries, the average person correctly answers fewer than half of the privacy and cybersecurity questions on the National Privacy Test. A score of 46 means that, on average, roughly every second question is answered incorrectly.
When it comes to the three categories, the average global score was 30 points on Daily digital life, 51 points on Privacy awareness, and 53 points on Digital risk. The gap between knowing about privacy threats (51 and 53 points) and practicing safe digital habits (only 30 points) suggests that people understand privacy concepts at a moderate level but are much less likely to apply that understanding to their everyday online behavior.
What’s interesting about the results this year is that the question-level data reveals three consistent gaps between related topics, particularly:
- Password creation vs. password storage. Nearly everyone knows how to create a strong password (96%), but almost nobody knows where to store it safely (18%). This gap is the largest contradiction in the test.
- AI-related risks. Most people know that social media posts can be used to train AI models (91%), but far fewer know what information should not be shared with AI tools (57%), and almost nobody understands AI privacy issues at work (5%).
- Data tracking. A large majority of participants know that companies collect their browsing data (83%), but a much smaller share understand what cookies actually do (24%), what data apps access through permissions (8%), or what tools exist to limit tracking (near 0%). This suggests the participants understand the abstract concept of being tracked but are unaware of the mechanics of AI-based tracking and the means to limit it.
How well did the US population do in the National Privacy Test?
With an average score of 48, Americans are tied for fifth place with Austria and Switzerland in this year’s National Privacy Test (Singapore ranks first with 52 points). The US also presents one of the more contradictory profiles in the dataset.
Americans lead the world in understanding how devices get infected with malware and are among the best at recognizing AI-driven scams, spotting deepfakes, and knowing what to do when they receive a suspicious bank email (all above 92%). This suggests strong media literacy around high-profile cybersecurity threats.
However, the US has some blind spots in more routine areas. For example, Americans are among the worst in the world at knowing where to store passwords safely, and they significantly underperform on understanding why app updates matter for security. They also score below average on awareness of QR code risks. These results suggest the US population is well informed about threats they hear about in the news but less attentive to the everyday habits that form the backbone of daily digital security.
US cyber personas
Of 2,472 American participants (as of this writing) who took the 2026 NPT, 2% fell into the Cyber Wanderer category and 3% into the Cyber Star category. The vast majority of the US population — 47% and 48% — were classified as Cyber Tourists and Cyber Adventurers, respectively.
These numbers further confirm the previously mentioned hypothesis that Americans are aware of most online threats but could do better in safeguarding against them.
Global trends
Based on this year’s NPT results, Europe is the strongest region overall and the most internally diverse. Its strengths lie in data privacy awareness — European respondents outperform the global average on awareness of Meta’s tracking practices, safe password storage, and browser-saved credit card risks. This trend likely reflects the cultural and regulatory influence of the GDPR.
As for the Asia-Pacific region, Singapore leads the entire world in the NPT score, while South Korea ties for the last place with Argentina and Italy. The region’s distinctive strength is reading the terms of service and being aware of malware infections. Its main weakness is Meta data collection awareness, which is likely due to Meta’s weaker market presence in parts of Asia.
North America shows a strong knowledge profile on malware, bank fraud response, and deepfake identification. These strengths reflect high media literacy around cybersecurity threats. However, the region has major blind spots, including app update awareness, password storage, and QR code risks. The US edges ahead of Canada, mainly because of stronger malware awareness and threat recognition.
Finally, Latin America scores the lowest, though the gap to the global average is modest (42.7 against 46 points). The region’s relative strength is bank fraud response and app update behavior, which suggest good awareness of practical, high-stakes security actions. Some of its weaknesses include AI scam recognition, AI tool data-sharing awareness, and unused account management. Argentina is the weakest performer with particularly low scores on password storage and infostealer knowledge.
Peculiarities in demographic analysis
It’s a common stereotype that age is the dominant divide when it comes to technology and cyber threats. The 2026 NPT results seem to support this idea — the 65+ group’s weaknesses include emerging physical cybersecurity risks, digital hygiene practices, and newer threat types, which points toward concrete, targetable educational priorities rather than a need for general awareness-raising.
However, the “young people are digital natives” narrative is not entirely correct, either. Young adults are indeed better at recognizing newer threats like USB charging risks and QR code scams, but they scored less than older adults at recognizing scam patterns, responding correctly to fraud emails, and understanding app permissions. These results suggest that digital fluency is not the same as digital wisdom. Moreover, the 30-44 age group outperforms everyone — likely because it is both digitally fluent and experienced online.
How does the NPT reflect global resilience to cyber threats?
The 2026 National Privacy Test paints a consistent picture across all participating countries. People seem to know more about online privacy than ever before, but that knowledge rarely translates into action. Awareness of dramatic, newsworthy threats — deepfakes, malware, bank fraud — is high almost everywhere. And yet, the basic, everyday habits like safe password storage, timely app updates, and caution around QR codes are where most respondents fall short.
Since the test is different from its earlier iterations (with new questions about AI-related cyber risks), it’s hard to compare this year’s results with previous NPT data. However, the gap between the threats people recognize and those they’re actually exposed to seems to be growing.
Think you’d score higher? Take the National Privacy Test opens in a new tab and see how your knowledge stacks up. And if you’re curious about the full picture, check the global results for all countries in the 2026 NPT report opens in a new tab.
Complete research materials for this study can be found here opens in a new tab.
