Introduction
Free VPN apps are one of the most misunderstood categories in the App Store. Privacy software, by definition, costs money to run: servers in dozens of countries, bandwidth for millions of users, encryption infrastructure, and development teams don’t operate for free. When a VPN costs nothing, the question isn’t whether there’s a catch — it’s what the catch is. This post explains exactly how free VPNs make money, identifies the specific risks associated with the most problematic ones, tells you what the research evidence actually shows, and explains when a free VPN is acceptable versus when you genuinely need a paid one.
What a VPN Actually Does (and Doesn’t Do)
A VPN — Virtual Private Network — routes your internet traffic through an encrypted tunnel to a server operated by the VPN provider. This achieves two things: your internet service provider cannot see which sites you’re visiting, and websites you visit see the VPN’s IP address rather than yours.
What a VPN does not do: it doesn’t make you anonymous. The VPN provider can see all your traffic. It replaces your ISP’s surveillance with the VPN company’s surveillance. Whether that trade is worth making depends entirely on whether the VPN provider is more trustworthy than your ISP — and with free VPNs, the answer is often disturbing.
How Free VPNs Actually Make Money
The VPN industry is an excellent place to apply the “if you’re not paying, you’re the product” principle. There are several documented monetisation models:
- Selling bandwidth: Some free VPNs route other users’ traffic through your device’s internet connection — turning your phone into an exit node. Hola VPN, one of the most downloaded free VPNs historically, operated on exactly this model. Your bandwidth can be used for anything, including botnet activity.
- Selling usage data: Some VPNs log the very browsing data they claim to protect and sell it to data brokers and advertisers. A 2017 CSIRO study found 75% of free VPN apps in the Google Play Store contained at least one tracking library, and 38% contained malware indicators.
- Injecting ads: Certain free VPNs modify the web pages you visit to inject advertising — sometimes replacing existing ads, sometimes adding new ones. This is a direct breach of any reasonable privacy expectation.
- Selling subscriber email lists: Free VPNs requiring email registration may sell or share those lists. The email you used to sign up becomes a marketable data point.
- Legitimate upselling (the exception): Some free VPNs are legitimate, with the “free tier” being a genuine product designed to convert users to paid plans. ProtonVPN and Windscribe operate on this model.
The Research Evidence on Free VPN Apps
The CSIRO study (Commonwealth Scientific and Industrial Research Organisation, Australia) remains one of the most comprehensive analyses of VPN app behaviour. Of 283 Android VPN apps analysed:
- 75% used at least one third-party tracking library
- 82% requested permissions to access sensitive resources
- 38% contained malware indicators
- Only 37% actually encrypted all user traffic despite advertising encryption
A subsequent 2019 analysis by Top10VPN found that over 50% of the top free VPN apps in Google Play were owned by Chinese companies — raising concerns given Chinese law requires companies to cooperate with government intelligence requests.
Free VPNs That Are Genuinely Acceptable
- ProtonVPN Free: The gold standard of free VPNs. Run by the same Swiss organisation behind ProtonMail, with a verified no-logs policy audited by independent security firms. Free tier offers unlimited data but limits users to one device and servers in three countries (US, Netherlands, Japan). No data selling, no ads, no bandwidth trading.
- Windscribe Free: Offers 10GB of data per month, servers in 10+ countries, and a credible no-logs policy. Windscribe is a Canadian company that has published clear documentation of its data practices and passed independent scrutiny. The 10GB limit makes it suitable for occasional use — public WiFi, travel — but not as a full-time solution.
When You Actually Need a Paid VPN
- Regular public WiFi use — coffee shops, hotels, airports. Public WiFi can be monitored by anyone on the same network. A VPN encrypts your traffic so even a malicious access point cannot read it.
- International travel — accessing streaming services tied to your home country. Free VPNs are almost universally too slow and too unreliable for streaming.
- Remote work with sensitive data — your employer may require a paid, audited business VPN, not a consumer free app.
The Five Questions to Ask Before Installing Any VPN
- Is there a published, independently audited no-logs policy?
- Where is the company incorporated? (Switzerland, Iceland, and Panama have strong privacy protections)
- Who owns the company? (Several popular VPN apps are owned by parent companies with questionable track records)
- What’s the business model? (If there’s no paid tier and no obvious corporate customer, how do they fund the service?)
- What do their app permissions actually request? (A VPN requesting access to your contacts, calendar, or microphone should be immediately deleted)
Frequently Asked Questions
Can a free VPN steal my personal information?
Technically yes, and some have been documented doing so. Because a VPN routes all your traffic through its servers, a malicious VPN has full visibility into your unencrypted traffic. Always use free VPNs from verified providers with published, audited no-logs policies — like ProtonVPN or Windscribe. Avoid obscure free VPN apps with few reviews or untraceable ownership.
Is a VPN illegal to use?
In most countries, using a VPN is completely legal. VPNs are standard tools used by businesses, remote workers, and privacy-conscious individuals worldwide. Some countries restrict VPN use — China, Russia, Iran, and the UAE have regulations limiting or banning certain VPN services. Always check local laws when travelling to countries with known internet restrictions.
Does a VPN slow down my internet?
Yes, all VPNs introduce some latency because traffic is routed through an additional server. Premium paid VPNs with nearby servers typically add 10–30ms of latency, which is imperceptible for browsing and streaming. Free VPNs with overloaded servers can slow connections significantly — sometimes making streaming impossible.
Can I use a free VPN for Netflix?
Generally no. Netflix actively blocks known VPN IP addresses to comply with regional licensing agreements. Free VPNs rarely invest in the infrastructure needed to keep their IP addresses unblocked. Paid VPNs like ExpressVPN and NordVPN specifically advertise Netflix compatibility — but even then, it’s a constant cat-and-mouse game.
Does a VPN protect me from hackers on public WiFi?
Yes, this is one of the most legitimate use cases for a VPN. On an unencrypted public WiFi network, anyone with the right tools can intercept unencrypted traffic. A VPN encrypts all your traffic before it leaves your device, making intercepted data unreadable. For sensitive tasks on public WiFi — banking, work email — a reputable VPN is a meaningful security layer.
Conclusion
Free VPN apps are not free, and the cost is usually your data or your bandwidth. For occasional, low-sensitivity use, ProtonVPN’s free tier is the only genuinely trustworthy option. For regular VPN use — especially on public WiFi, while travelling, or for streaming — a paid VPN from a credible provider is worth the $4–10/month. The three things to remember: always check who owns the VPN app; look for an independently audited no-logs policy; and if a VPN is completely free with no paid tier and no corporate customer base, it is almost certainly monetising your data.
Protect your phone the right way — read our guide on How to Stop Apps Tracking You on iPhone and Android for the full privacy audit checklist.
