Free VPNs: someone is paying, and it is not you

A VPN moves all of your traffic through someone else's computer. That is the whole product. So the only question worth asking about a free one is who is paying for that computer, and what they get back.

Bandwidth costs money. Servers cost money. A provider carrying a million people's traffic has a bill arriving every month, and if none of that million is paying it, the bill is being covered some other way. Sometimes that other way is honest — a paid product with a deliberately limited free tier, used as a shop window. Often it is not.

What researchers actually found

This is not speculation. Two large studies looked inside the apps themselves.

At the NDSS security conference in February 2026, a team from the University of Michigan, the University of New Mexico and IIT Delhi presented MVPNalyzer, a system that automatically tests VPN apps rather than trusting their descriptions. They ran it against 281 free Android VPN apps with a combined 2.4 billion installs. The results were not close calls: DNS queries leaking outside the tunnel, traffic travelling in plaintext, and tunnels built on ciphers that were retired years ago — close to one in five used weak or outdated encryption, including Blowfish and triple DES.

In October 2025, Zimperium's zLabs analysed 800 free VPN apps across Android and iOS. They reported apps requesting permissions a VPN has no use for — reading contacts, tracking location — alongside outdated and vulnerable code.

In August 2025, Citizen Lab and Arizona State University identified popular Android VPN apps with more than 700 million downloads between them collecting location data.

An earlier and often-cited survey of free providers found that roughly three quarters shipped third-party tracking libraries. Tracking libraries are not an accident. They are how the app is monetised.

Then there is the breach

Collected data does not stay collected. In 2023, records tied to the free service SuperVPN were exposed — reports put the figure above 360 million records, including email addresses, users' original IP addresses, geolocation, device identifiers and information about sites visited. An earlier incident linked to SuperVPN, GeckoVPN and ChatVPN exposed roughly 21 million records.

Read that list again. The original IP address plus the sites visited is precisely the pairing a VPN is bought to prevent existing anywhere. It existed, in a database, and then it was on the open internet.

The tell: how does this company eat?

You do not need to reverse-engineer an APK. Four questions get you most of the way.

• Who owns it, and is that on the website? Many "different" free VPN apps in the same app-store category turn out to share an owner, an SDK and a server pool. A provider that hides its corporate identity is telling you something.
• What does the privacy policy permit, not promise? Marketing says "no logs". The policy is the binding document. Look for connection timestamps, source IP, "aggregated analytics", and any clause about sharing with "partners" or "affiliates".
• What permissions does the app ask for? A VPN needs to create a tunnel interface. It does not need your contacts, your call log, or your precise location.
• Has anyone independent checked? A published third-party audit, with a date and a scope, is worth more than any badge on a landing page.

Free tiers that are actually fine

Not every free offer is a trap. The honest pattern is easy to recognise: a company with a paid product gives you a genuinely limited slice of it — a few gigabytes a month, one device, fewer locations — because it wants you to upgrade. The service is identical to the paid one, just rationed. Its revenue is subscriptions, and your traffic is a cost it is trying to convert, not an asset it is trying to sell.

The pattern to walk away from is unlimited, unrationed, unexplained free service with no paid product behind it. Nobody gives away the expensive thing forever out of goodwill.

A short checklist

1. Find the paid product. If there isn't one, find the revenue. If you can't, stop.
2. Read the privacy policy's retention section, not the homepage.
3. Check the app permissions before you accept them.
4. Prefer a provider that publishes who it is and where it is incorporated.
5. Treat "military-grade encryption" as marketing. Treat a named protocol, a named cipher and a published audit as information.

The uncomfortable summary

A paid VPN is not automatically trustworthy — money buys an incentive, not integrity, and there are bad paid providers too. But with a free one you are not the customer, and every technical decision inside the app is made by someone whose income depends on something other than protecting you. The 2026 measurements are what that looks like when you open it up.