Some free VPNs are safe enough for light use, but many are not, and the free price is usually paid for with your data, your attention or your device's bandwidth. A VPN sees every site you connect to, so a provider that earns nothing from subscriptions has to earn money some other way. Independent research has found free VPN apps that embedded trackers, leaked traffic, injected advertising code or logged more than they admitted. A few reputable providers do offer a genuinely free tier, but they are the exception, and they are funded by upgrades to a paid plan.
This guide is written for home users and small-business staff in the US, UK, Canada and Australia. It explains how free VPNs make money, what researchers and regulators have actually documented, a red-flag checklist you can run in five minutes, how to check an app before installing it, and when a free option is perfectly reasonable. If you simply want a ranked list of free options for a Windows PC, see our separate comparison, the best free VPNs for Windows in 2026. This article is about the risk, not the shopping list.
How we sourced this article
IT Cares is an IT support company founded in 2014. We did not run our own VPN tests for this piece. Everything factual below comes from published research, news reports or vendor pages that we read, and each one is linked so you can check it. Where we could not verify something, we say so. Facts about vendor plans are as of November 2026 and can change.
What a VPN can see, and why that matters
A VPN creates an encrypted tunnel between your device and the provider's server. Websites then see the provider's address instead of yours, and anyone on the local network, such as a cafe's Wi-Fi, sees only scrambled traffic. That is the benefit. The cost is trust: the provider now sits where your internet provider used to sit. It can see which domains you visit, when, and how much data you move, and if the app also installs its own certificate or reads your device, it may see far more.
This is why a VPN is a privacy tool only if you trust the company running it. A good paid VPN has a business reason to protect that trust. A free one may have a business reason to do the opposite. For the wider question of where a VPN fits next to other protection, see antivirus vs VPN: do you need both.
How free VPNs actually make money
Running a VPN costs real money: servers, bandwidth, engineers, support and payment of legal and abuse-handling work. When the user pays nothing, the money comes from one of the following sources. Some are harmless. Some are not.
| Revenue model | How it works | Risk to you |
|---|---|---|
| Upgrade funnel (freemium) | The free tier is limited in speed, data or locations to push you to a paid plan. | Low. The business model does not depend on your data. |
| Advertising | Banner or video ads inside the app, sometimes with ad networks and trackers built in. | Medium. Ad networks collect device and usage data. |
| Selling or sharing data | Browsing, device or location data is passed to third parties or analytics firms. | High. This directly defeats the purpose of using a VPN. |
| Traffic manipulation | Injecting ads, tracking scripts or redirecting shopping traffic to partner sites. | High. Your traffic is being altered on the way through. |
| Reselling your bandwidth | Your connection is used as an exit point for other people's traffic. | High. Their activity appears to come from your address. |
| Parent company with another agenda | The VPN is a side product of a data, advertising or analytics business, or its ownership is hidden. | Varies. Ownership and jurisdiction matter. |
The US Federal Trade Commission has said the same thing in plain terms in its consumer guidance. Its February 2018 advice on VPN apps tells people to research an app before downloading it, look closely at the permissions it asks for, confirm that it encrypts data, and find out whether it passes information to third parties. You can read it on the FTC website. Those four checks are the backbone of the checklist later in this article.
Documented cases: what researchers and the press found
It is easy to make sweeping claims about free VPNs, so we have limited this section to cases we could trace to a published source. Each case is a snapshot from the date given. Apps and companies change, so treat these as examples of the kinds of problems that occur, not as a current verdict on any brand.
The CSIRO and Berkeley study of 283 Android VPN apps (2016)
The most cited academic study in this area was published at the ACM Internet Measurement Conference in 2016 by researchers from Australia's CSIRO Data61, UC Berkeley's ICSI and others. They analysed 283 Android apps that use the VPN permission, drawn from a corpus of more than 1.4 million apps on Google Play. You can find the paper on the ACM Digital Library, and a summary on the ICSI site.
Among the findings reported in the paper:
- 75% of the apps used third-party tracking libraries, and 82% requested permissions to access sensitive resources such as user accounts and text messages.
- Over 38% of the apps showed some malware presence according to VirusTotal scans, even though many had large install counts and good ratings.
- 18% implemented tunnelling without encryption, and roughly 84% and 66% did not tunnel IPv6 and DNS traffic respectively, which can leak browsing activity outside the tunnel.
- Two apps injected JavaScript into users' traffic for advertising and tracking, and one of them redirected e-commerce traffic to external advertising partners.
- Four apps compromised the device's certificate store and performed TLS interception.
- 16% appeared to forward traffic through other participating users rather than company-run servers.
Two caveats are important. The data is from 2016, so the specific percentages will not match today's app stores. And the study looked at Android apps in general, not only free ones, although the authors noted that premium apps relied less on tracking libraries than free ones. It remains a useful picture of what can go wrong when an app is given the power to handle all of a phone's traffic.
The Hotspot Shield complaint (2017)
In August 2017 the Center for Democracy & Technology, a US advocacy group, filed a complaint with the FTC about the free VPN Hotspot Shield. According to SecurityWeek's report, the complaint alleged that the service said it kept no logs and did not sell user information, while its privacy policy described more extensive logging. It also alleged undisclosed data sharing with advertising partners and redirection of e-commerce traffic.
To be clear about what this is and is not: it was a complaint from an advocacy group asking the FTC to investigate, and these were allegations. We did not find a published FTC enforcement outcome, and we are not stating that the claims were proven. We include it because it shows a pattern that recurs: a gap between a "no logs" marketing line and what a privacy policy or app code actually says.
Hola and the bandwidth question (2015)
Hola was a very popular free browser extension. In May 2015 PCWorld reported that Hola's free service worked by routing other members' traffic through idle computers, and that Hola also sold users' bandwidth through a separate commercial service called Luminati. The operator of the imageboard 8chan said a botnet built through Luminati had been used to attack that site, and Hola's founder confirmed that a hacker had used Luminati in the attack, saying the company screened customers but this one got through. Hola said the premium plan let people avoid acting as an exit node.
The lesson is not that every peer-to-peer VPN is malicious. It is that "free" can mean you are the server. If another person's traffic leaves from your connection, any problem it causes can be traced to your address.
Onavo Protect (2018)
Facebook's free VPN app Onavo Protect was removed from Apple's App Store in August 2018 after Apple told Facebook it violated updated App Store rules on collecting data for advertising profiles. MacRumors summarised the reports. Facebook said the app was upfront about its data collection. Whichever view you take, the case shows that a VPN offered by a company whose main business is advertising deserves extra scrutiny of what it collects.
Hidden Chinese ownership of popular free apps (2025)
In 2025 the Tech Transparency Project, a US watchdog group, reported that 20 of the top 100 free VPNs in the US Apple App Store showed evidence of Chinese ownership, and that some were linked to Qihoo 360, a company on the US Commerce Department's Entity List. A follow-up in June 2025 named more apps across Apple and Google stores. The Register summarised both reports. Chinese ownership is not by itself proof of wrongdoing, and the same applies to any country. The point for users is transparency: many of these apps did not make their real ownership obvious, and you cannot judge a provider's legal exposure if you do not know who it is. Apple's guidelines say VPN apps "may not sell, use, or disclose to third parties any data for any purpose," but enforcement across thousands of apps is difficult.
The three big risks, in plain language
1. Data selling and tracking
The main privacy risk is that your browsing metadata, device identifiers or location are sent to advertisers or data brokers. A free VPN with built-in ad networks and analytics libraries can quietly do this even if the app itself never shows an ad. The CSIRO study found tracking libraries in three quarters of the apps it examined, which is why checking the privacy policy and the app's tracker list matters.
2. Malware and over-broad permissions
A VPN app on a phone is allowed to route all traffic, and many also request access to accounts, contacts, messages or files. Fake or repackaged VPN apps are a well-known way to deliver adware or spyware. If your device starts showing pop-ups, redirects or slowness after installing a free VPN, follow our guide on how to remove a virus from your computer and uninstall the app.
3. Logging and leaks
Even an honest free VPN can be technically weak. The same study found apps with no encryption or with DNS and IPv6 leaks, meaning your real activity could be visible to the network despite the VPN being "on." And a "no logs" claim is only a statement. It is worth more if an independent firm has audited it, and worth little if the company's ownership and location are unknown.
Seven red flags checklist
No single red flag proves an app is bad, but the more you tick, the less you should trust it. Run through these before you install anything.
Free VPN red flags
- No clear owner. The company name, address and country are missing or vague, or the app store listing and website disagree.
- Unlimited free with no explained business model. If you cannot work out how they pay for servers, assume it is you.
- Absolute promises. Claims such as "100% anonymous," "military-grade," "unhackable" or "no logs ever" with no audit or detail behind them.
- A short or missing privacy policy. It should say what is collected, how long it is kept and who receives it. Watch for wording about sharing with "partners" or "affiliates."
- Excessive permissions. A VPN does not need your contacts, SMS, microphone or accounts. The VPN permission itself is expected. Anything beyond it needs a reason.
- Lots of ads and trackers. Pop-ups, full-screen video ads and prompts to install other apps are signs the app earns money from attention and data.
- Reviews that look manufactured. Hundreds of short five-star reviews with no detail, or a rating far higher than the app's actual reliability.
How to check a VPN app before you install it
This takes about five minutes and covers the checks the FTC recommends.
- Find the company outside the app store. Search for the provider's own website. Look for a named company, a physical address, a jurisdiction and a contact route. A real company is easy to find.
- Read the privacy policy for three things. What data it collects, how long it keeps it, and whether it shares data with third parties. If you cannot find those answers, that is the answer.
- Look for independent audits. Reputable providers publish the auditor's name, the date and a link to the report. A badge with no report is just a badge.
- Check the permissions. On Android, the store page lists them. On iPhone, the App Privacy section lists what the app says it collects and links to you. Be wary if it states it collects browsing history, identifiers or location for advertising.
- Check the protocol. Modern apps use WireGuard, OpenVPN or IKEv2. Avoid anything that does not say, or that uses the legacy PPTP protocol.
- Scan for trackers. Free tools such as the Exodus Privacy database list the trackers embedded in Android apps, which is a quick way to see whether a "privacy" app is full of ad networks.
- Test for leaks after installing. With the VPN on, visit a DNS and IP leak test site. If your real address or your internet provider's DNS servers show up, the VPN is not protecting you.
- Download only from the official store or the vendor's site. Never from a link in an ad, an email or a forum. Fake versions of real VPN brands exist.
Safer free options, and what "safer" means
A free tier from a paid VPN company is a different thing from a standalone "free VPN" app. The company already earns money from subscribers, so the free plan is a sample, not the product. That does not guarantee quality, but it removes the strongest incentive to sell your data.
Proton VPN Free. As of November 2026, Proton's free plan page states that the free plan has no data or speed limits, shows no ads, follows a strict no-logs policy, and covers one device, with paid plans adding features such as P2P support and streaming access. Proton also describes the apps as open source and independently audited. Securitum, an independent security firm, has published a no-logs audit report of Proton VPN dated 2025, and coverage of that audit says it covered production servers. An audit is a point-in-time review, not a permanent guarantee. We have not independently tested the service.
Windscribe Free. According to Windscribe's own pages and independent reviews, the free plan gives 10 GB of data per month once you confirm an email address, and 2 GB without one, across a limited set of locations. Sources differ on the exact number of locations, so check the current page. Its no-logs policy is described by the company as having been tested in court. We did not independently verify audit details.
For a broader comparison including more options, speeds and Windows-specific notes, use our best free VPN for Windows guide. We intentionally do not repeat that ranking here.
Free trial is not the same as free tier
A "free trial" that asks for a card and renews automatically is a subscription in disguise. A genuine free tier works without a payment method. Check the sign-up flow before you decide which one you are getting.
When a free VPN is fine, and when it is not
| Situation | Free VPN from a reputable provider | Unknown free VPN app |
|---|---|---|
| Quick browsing on cafe or hotel Wi-Fi | Reasonable for occasional use | Not worth the risk |
| Online banking or work accounts | Not necessary. HTTPS and MFA matter more | Avoid |
| Streaming and large downloads | Data caps and speed limits will get in the way | Avoid |
| Sensitive activity (journalism, activism, legal risk) | Use a paid, audited provider and read its threat model | Avoid |
| Company laptops handling client data | Use a business-grade solution | Never |
For most people, a VPN is useful on untrusted public networks, but the risks of public Wi-Fi are smaller than they used to be because most sites use HTTPS. Our article on public Wi-Fi safety: real risks vs myths explains what a VPN does and does not add. A VPN is not a replacement for a firewall, antivirus or good account hygiene, which is covered in firewall vs VPN vs antivirus.
What a VPN does not protect you from
Some of the damage from free VPNs comes from people expecting too much. A VPN does not stop phishing, malware downloads, weak passwords or account takeovers. It does not make you anonymous to the websites you log in to. It does not protect a device that already has malware. The basics that actually prevent most compromises are unique passwords in a password manager, multi-factor authentication and a reliable antivirus.
If you already used a questionable free VPN
- Uninstall it and remove any VPN profile or certificate it added in your device settings.
- Run a malware scan with your security tool and a second-opinion scanner.
- Change important passwords from a clean device, starting with email, banking and your password manager. Turn on MFA where it is missing.
- Review account activity for logins from places you do not recognise.
- Watch for scams. If a data broker or tracker had your email, expect more phishing for a while.
If you are not sure whether the device is clean, our guide on warning signs that your computer is hacked lists what to look for.
What to do next
- Decide whether you need a VPN at all. If you rarely use public Wi-Fi, you may not.
- If you do, pick a provider with a named company, a clear privacy policy and an independent audit, and prefer a free tier from a paid service over an anonymous app.
- Remove any unknown VPN apps from your phone and computer.
- Turn on MFA and use a password manager so a leaked password is not a disaster.
If you are unsure which VPN apps are already on your devices, or you suspect one has caused problems, IT Cares can help remotely. We offer a 60-minute Expert Consultation at $119.99 CAD (plus applicable taxes) where a technician reviews your devices, removes questionable software and sets up safer defaults. You can book a session online or call 1 (888) 711-9428. No VPN or other tool can offer a guarantee of security, so we focus on reducing risk sensibly.