VLC media player 3.0.24 — the first minute without a single click

How we tested: a clean Debian 13 in a disposable container, VLC 3.0.24 (package vlc 3.0.24-0+deb13u1 from the Debian repository — for Linux, VideoLAN itself points there). Run as a regular user on a virtual screen, 60 seconds, nothing clicked. 16.10.2026. Every network request and every file written was recorded; the code was not decompiled. The container was deleted afterwards.

Package SHA-256: 15d647be8392c26ba3671936f9d1e34cfe1e9d51bfc791ee0598e0610870f92e

Summary

What we checked	Result
Built-in telemetry, crash reporting, analytics, ad SDKs	none
Network requests in the first minute	none — no DNS lookup, no connection
Files written in the first minute	none
The program ran the whole time	yes — the `vlc` process alive at second 54, screen captured

What is built in

747 files (68 MB) across all 16 VLC packages were checked. No code of known telemetry, crash reporting, analytics or ad SDKs was found.

The files do contain third-party addresses, but these are addresses in the code, not requests — VLC did not contact them during the test. They belong to features that only work when used:

Addresses	Where they come from in VLC
`videolan.org`	VLC’s own website and help
`last.fm`	module that sends played tracks to Last.fm — must be enabled with your own account
`opensubtitles.org`	subtitle search on the user’s request
`jamendo.com`, `shoutcast.com`, `twitch.tv`	music and radio catalogues in the sidebar, link playback scripts
`ajax.googleapis.com`, `jquery.com`, `upload.wikimedia.org`	pages of the web interface for controlling VLC from another device — off until you turn it on

In VLC’s favour

Without a single user action VLC sends nothing: no statistics, no crash reports, no update check (in the Debian build; the Windows version from the VideoLAN site checks for updates — we have not tested it). Networked features exist, but each needs an action — enabling a module, opening a catalogue, asking for subtitles.