Running a VPN service costs real money: servers in dozens of countries, bandwidth, engineers and support staff. When a VPN costs you nothing, someone is still paying, and the question that matters is who and how. Some free VPNs are honest samples of a paid product. Others have been found selling data, injecting adverts, or quietly turning their users' devices into relays for criminals. Because a VPN by design sees all of your internet traffic, choosing the wrong one can leave you less private than using no VPN at all. This guide explains how free VPNs make money, what independent research and law enforcement have found, and when a free option is perfectly reasonable.
Why the business model matters more for VPNs than for most apps
A free game that shows adverts is a minor nuisance. A free VPN is different because of what it can see. The US Federal Trade Commission (FTC) puts it plainly: "When you use a VPN app, you're giving the app permission to intercept all of your internet traffic." A VPN also does not make you anonymous; in the FTC's words, it "just shifts trust from those networks to the VPN app provider." So the whole value of a VPN depends on trusting the company running it, and the business model tells you a great deal about whether that trust is deserved.
How free VPNs pay their bills
Broadly, there are four models, and they carry very different risks.
| Model | How it works | Risk to you |
|---|
| Freemium | A paid provider offers a limited free tier to win customers | Low, if the provider is reputable; limits on speed, servers or data |
| Advertising | Ads shown in the app, sometimes with ad tracking libraries | Moderate; tracking and data sharing with ad networks |
| Data monetisation | Browsing or usage data shared with or sold to third parties | High; defeats the purpose of using a VPN |
| Bandwidth resale | Your connection is used to route other people's traffic | High; strangers' activity can appear to come from your address |
The FTC's guidance names the middle two directly: "Many VPN apps are free because they sell advertising within the app, or because they share your information with third parties." The Electronic Frontier Foundation (EFF) gives the same warning in its guide to choosing a VPN: VPNs "can be entirely free, but sell your data."
What the research found
The most thorough academic study of the problem examined 283 Android apps that use the system's VPN permission, drawn from more than 1.4 million apps on the Google Play store. It was carried out by researchers from Australia's CSIRO Data61, the University of New South Wales, the International Computer Science Institute and UC Berkeley, and published at the ACM Internet Measurement Conference. Among its findings:
- 67% of the apps promised to enhance privacy or security, yet 75% included third-party tracking libraries and 82% requested permissions to sensitive resources such as user accounts and text messages.
- Over 38% showed some malware presence according to VirusTotal, even though 37% had more than 500,000 installs and a quarter had at least a four-star rating.
- 18% used tunnelling protocols with no encryption at all, despite promising security.
- About 84% did not tunnel IPv6 traffic and about 66% did not tunnel DNS traffic, so some of what users believed was hidden leaked outside the VPN.
- Two apps injected JavaScript into users' web traffic for advertising and tracking, one of them redirecting online shopping traffic to advertising partners, and four intercepted encrypted (TLS) connections.
- 16% appeared to route traffic through other users' devices in a peer-to-peer fashion rather than through the provider's own servers.
The study covered all VPN-permission apps rather than free ones only, and app stores have tightened their rules since. But its central lesson has not dated: high ratings and large install counts told users almost nothing, and the researchers found that only a marginal number of reviewers had raised security or privacy concerns.
The worst case: your device as someone else's exit
The peer-to-peer model has a criminal extreme. According to the FBI, a residential proxy service called 911 S5 built what was likely the largest botnet of its kind, with over 19 million compromised IP addresses in more than 190 countries and confirmed victim losses in the billions of dollars. Its main recruitment tool was free VPN software. The FBI names the apps: MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN and ShineVPN. People who installed them got a VPN that worked, plus a hidden backdoor that let paying customers route their own traffic through the victims' computers, so that crimes including financial fraud, identity theft and bomb threats appeared to come from innocent people's homes.
The FBI has published instructions for finding and removing these programs, starting with checking Task Manager for their service names. The broader point is that "free" can mean you are not the customer but the infrastructure.
The practical limits of legitimate free plans
Reputable freemium plans avoid the worst of this, but they are deliberately limited so that the paid plan looks attractive. Typical restrictions include:
- A monthly data allowance, or slower speeds at busy times.
- A small choice of server locations, often chosen for you.
- Only one device connected at a time.
- Fewer features, such as no support for streaming services or peer-to-peer traffic.
These limits matter if you want a VPN running all day on every device. They matter much less if you only switch it on occasionally.
How to check any VPN, free or paid
- Find out who runs it. A named company with a real address, a track record and a paid product is a different proposition from an anonymous developer with a single free app.
- Read the privacy policy. Look for what is logged, for how long, and whether anything is shared with or sold to third parties. Vague language about "partners" is a warning.
- Check the store listing. Google Play's Data safety section shows what the developer says it collects and shares, whether data is encrypted in transit, and whether the app has been independently reviewed against a global security standard. Google also gives a "Verified" badge to consumer VPN apps that, in its words, "go above and beyond to protect their users". Remember that the data safety answers are written by the developer.
- Look for independent audits. The EFF lists third-party security audits and published policies among the signs of a trustworthy provider.
- Check the protocol and permissions. The EFF recommends modern protocols such as WireGuard or OpenVPN over outdated ones like PPTP, and the FTC advises checking that an app actually encrypts your information and reviewing the permissions it requests.
- Be wary of "unlimited, free, forever". Unlimited bandwidth costs money. If there is no paid plan and no advertising, ask what is paying for it.
When free is fine, and when to pay
A free tier from a reputable, audited provider that also sells a paid plan is a reasonable choice for occasional use: checking email on hotel Wi-Fi, a quick task on a network you do not trust, or trying a service before buying. In those cases you are using the free plan as intended, and the company has a clear incentive to treat you well so that you upgrade.
Paying makes more sense if you want the VPN on all the time, across several devices, at full speed, with a wide choice of locations, or if your reason for using a VPN is serious privacy. You are then paying for the thing you want, rather than with your data.
And sometimes you do not need a VPN at all. Most sites already encrypt their connections, and the FTC now says connecting through public Wi-Fi "is usually safe" for that reason. If you only browse well-known HTTPS sites at home, no VPN is better than a dubious free one.
The bottom line
A free VPN is only as trustworthy as the business behind it, and because a VPN sees everything you do online, the stakes are higher than with most free apps. Freemium tiers from established, audited providers are fine for light use. Anonymous free apps with unlimited everything, no paid plan and a vague privacy policy are the ones research and law enforcement keep catching. If you want to compare paid options, our VPN comparison sets out how we rank them.
