Free VPN Apps and Your Data

A VPN routes all your traffic through someone else's server. Whoever operates it occupies the position of maximum visibility into your internet use.

Providing that service costs money — servers, bandwidth, staff. A free provider is recovering that cost somehow, and the plausible options are limited.

How free VPNs are funded

Selling data. Traffic records, browsing patterns, or aggregated behavioural data. Repeatedly documented in academic and journalistic analysis of popular free VPN apps.

Advertising and injection. Some insert or replace advertisements in pages you visit, which requires intercepting traffic.

Selling your bandwidth. Your device becomes an exit point for other people's traffic, sold as a residential proxy service. This means requests from strangers appear to come from your connection. It has been found in popular free apps and it is disclosed, when it is disclosed, in terms nobody reads.

As a loss leader for a paid tier. The legitimate model, usually with strict data limits.

Not funded at all. Abandoned apps that still work and are not maintained, which is its own risk.

What research has found

Independent analyses of free VPN applications have repeatedly found: absent or broken encryption, third-party tracking libraries embedded in the apps, DNS leaks that reveal browsing despite the tunnel, permissions far beyond what the function requires, and shared ownership between apps presented as independent competitors.

The pattern is consistent enough that free VPN apps from unidentifiable companies should be treated as a data collection product with a VPN feature.

The specific risk of the mobile app

A VPN app on a phone gets a system-level permission to intercept all network traffic. That is a substantial grant.

Check who publishes it. A company you can identify, in a jurisdiction you can name, with a real address.

Check the permissions requested beyond networking. Location, contacts and storage access have no function in a VPN.

Check the ownership. Several apparently independent VPN brands share a parent company, and the ownership chains are sometimes deliberately obscured.

What a VPN does and does not do

It hides your destinations from your network and your internet provider.

It hides your address from the sites you visit.

It encrypts traffic on the local network.

It does not make you anonymous. You remain signed in, your browser is identifiable, cookies persist.

It does not stop tracking.

It does not protect against malware or phishing.

It moves trust rather than removing it. Your provider could see your traffic; now the VPN operator can.

The last point is why a free VPN is worse than no VPN for most people: you have transferred visibility from a regulated telecommunications company with a legal obligation to you, to an unknown company with a business model you cannot see.

When you actually need one

On genuinely untrusted networks, and this matters less than it did now that nearly all traffic is encrypted.

To hide destinations from your network operator — an employer, a landlord, an internet provider.

To access services from another region, with the caveat that this often breaches terms of service.

Where surveillance is a genuine concern, in which case the choice of provider is a serious decision and free is not an option.

For ordinary browsing on a home connection, a VPN adds little. Much of the advertising is built on a threat model that HTTPS largely closed.

If you want one

Pay for it. The cost is modest and it aligns the incentives.

Choose a provider with an independent audit of its no-logs claim, published, recent, by a named firm.

Check the jurisdiction.

Prefer one that has been tested by a legal demand and demonstrably had nothing to hand over.

Use your phone's cellular connection instead where you just want to avoid a café network. Simpler, and no third party.

Checking a provider before you install

Ten minutes that eliminates most of the bad options.

Find out who owns it. A company name, a jurisdiction, an address. Several apparently unrelated VPN brands share a parent, and the chains are sometimes deliberately obscured.

Look for a published independent audit of the no-logs claim — named firm, recent, with a report you can read rather than a badge.

Check whether they have been tested by a legal demand and demonstrably had nothing to hand over. This is worth more than any policy statement.

Read the permissions the mobile app requests. Location, contacts and storage have no function in a VPN.

Check whether they sell your bandwidth. Search the provider's name alongside terms about residential proxies. This has been found in popular free apps.

Check the payment model. A free service with no paid tier and no visible revenue is monetising something, and the something is you.