Read their whitepaper: https://www.gstatic.com/subscriptions/marketing_page/vpn/whi...

Client source code: https://github.com/google/vpn-libraries

What they're doing - cryptographic blinding that separates authentication from user session - is probably the best approach at subscriber privacy I've seen so far.

I wonder how they'll deal with abuse.