Free VPNs: What's the Catch and When Is It Safe to Use Them?

Who pays for a free VPN

A VPN service has two main expenses: servers in data centers and the traffic passing through them. The more users, the higher the bill. If users pay nothing, the service relies on these revenue sources:

1. Ads. Banners and videos inside the app, or sometimes ads injected directly into the web pages you visit.
2. Data. Information about the sites and apps you use is sold to ad networks, analytics companies, or used by the service owner.
3. Paid versions. The free tier restricts speed, data, or server choice to push you toward a premium subscription. This is the most honest approach.
4. Your device. The app rents out your internet connection and IP address to third parties, turning your phone into a node in someone else's proxy network.

Users rarely suspect the second and fourth methods. App descriptions don't mention them, and privacy policies bury them in confusing jargon.

This creates a conflict of interest. A paid service makes money when you are happy and renew your subscription. A free service profits from your traffic, data, and attention—the more it extracts, the better for them and the worse for you.

What researchers found inside VPN apps

One of the most cited studies on Android VPN apps was conducted by researchers from Australia's CSIRO agency, UNSW, and UC Berkeley. In 2016, they analyzed 283 Google Play apps that requested system-level VPN permissions (research PDF).

• 75% of the apps contained third-party tracking libraries.
• 82% requested access to sensitive data, including user accounts and SMS.
• 18% didn't encrypt traffic at all, despite promising anonymity and security.
• At least one VirusTotal engine flagged 38% of the apps for malicious or unwanted code, mostly adware.
• Two apps injected custom JavaScript into web pages for advertising and tracking; one even redirected e-commerce purchases to partner sites.

A decade has passed, and Google has tightened its store policies. However, the business model remains the same, as cases from the 2020s clearly show.

How free VPNs sell and leak data

The most famous case is Onavo Protect. This free VPN app was owned by Facebook and marketed as a privacy tool. In reality, the company used the collected user activity data for its own commercial purposes, including business analytics. In 2023, the Federal Court of Australia, following a lawsuit by the ACCC regulator, ordered Facebook Israel and Onavo to pay $20 million AUD for failing to disclose how user data was actually being used (ACCC).

Sometimes, data simply leaks. In 2020, researchers found an exposed server belonging to seven free VPN providers based in Hong Kong. It contained about 1.2 TB of records, including email addresses, plaintext passwords, IP addresses, and activity logs. All seven services claimed to have a strict no-logs policy (ESET WeLiveSecurity).

A list of visited websites might seem harmless until you look at the big picture. Clinic and pharmacy sites reveal health issues; banks and payday loans show financial status; job boards indicate employment needs; baby stores suggest family plans. Ad networks love this kind of profile, and scammers do too.

A 'no-logs' promise in an app description means nothing without a transparent business model and independent audits. A free service has a much stronger incentive to store data than a paid one: your data is their product.

How a free VPN turns your phone into someone else's server

This model is less obvious, but its consequences are the most severe. There is a market for residential proxies: companies sell access to the IP addresses of everyday home and mobile connections. Since this traffic looks like regular human activity, it's purchased for web scraping, fraud, spam, and account hacking. Millions of these IP addresses are harvested through free VPN apps.

The scheme is simple. The developer embeds a third-party software development kit (SDK) into their app in exchange for payment. The app does what it promises, but the SDK quietly routes someone else's traffic through your device in the background.

• 2015: It was discovered that Hola, a popular free VPN, sold users' idle bandwidth through its Luminati service, which was then used to launch a cyberattack. The company's founder confirmed the attack ran through their network (PCWorld).
• May 2024: The US Department of Justice dismantled the 911 S5 botnet, which comprised roughly 19 million IP addresses. The malware was distributed through free VPN apps like MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN, and access to infected devices was sold to criminals. Prosecutors estimate the administrator made around $99 million (US DOJ).
• March 2024: Researchers at HUMAN found 28 apps on Google Play containing an SDK that silently turned phones into residential proxies. 17 of them posed as free VPNs. Google removed them from the store (BleepingComputer).
• January 2026: Google announced it had disrupted IPIDEA, one of the largest residential proxy networks. Google cited free VPN apps as a key acquisition channel for these devices. The apps worked as VPNs but enrolled users' devices as exit nodes without clear consent. In just one week in January, over 550 threat actor groups routed traffic through this network's IPs (Google Threat Intelligence).

The consequences for the phone owner are very real. Your IP address gets flagged in cyberattacks and scams, causing websites to hit you with CAPTCHAs or block your accounts. Your battery and data plan are drained by background tasks. Google also explicitly warns that attackers can use these infected devices to pivot into other devices on your home network.

Fake apps and 'free keys' from Telegram

Apps that merely pretend to be VPNs are a separate issue. In November 2024, Kaspersky reported a 2.5x global increase in users encountering malicious or potentially unwanted apps disguised as free VPNs compared to the previous quarter (Kaspersky).

In Russia, scams are often tailored to local concerns. In April 2026, the financial publication Tinkoff Journal (T—Zh) described a scheme targeting iPhone users: a 'free VPN' claiming to speed up Telegram asks for the phone's passcode to install network settings. A few days later, the phone gets locked, and scammers demand a 100,000 ₽ ransom to unlock it (T—Zh). A legitimate VPN app will never ask for your phone's lock screen passcode.

Fake apps often copy the name and icon of a famous provider, adding words like 'Pro', 'Free', or 'Fast'. Before installing, verify the developer's name matches the official website, and use the download link from that site rather than clicking a random ad.

Free keys from Telegram channels are the same risk in a different wrapper. A VLESS key or config file gives you access to a server run by an unknown person. They can see where you browse and can shut down the server or start harvesting your data at any time. We do not publish such lists and advise against using them. For more on how a key from a dedicated service differs from a random Telegram key, read our guide on VLESS keys and subscriptions.

Free VPNs on Android, iPhone, and PC: Where the risks lie

Most of the cases described above involve Android, but other platforms have their weak spots too.

Android

Google Play is the largest app store, and most of the incidents mentioned involve it. Additionally, Android allows app installations from APK files found on any website, a feature malware distributors heavily exploit. Only install VPNs from Google Play or the developer's official website, and never disable Google Play Protect: Google states it actively disables apps with known proxy SDKs and warns users.

iPhone

The App Store reviews apps more strictly, but it's not foolproof. Onavo Protect was available on the iPhone for years and only vanished from the App Store in 2018 when Apple decided it violated data collection guidelines (Gizmodo). On an iPhone, the biggest danger is what an app asks for after installation: your passcode, a configuration profile, or Mobile Device Management (MDM) access.

PC

On a computer, a free VPN usually takes the form of a browser extension or a downloaded program. Hola, the app that kicked off the bandwidth-selling trend, was widely distributed as a Chrome extension. An extension with 'read and change all your data on the websites you visit' permissions sees everything you do in the browser, so only install them from highly reputable developers. 'Free VPN' software from unofficial sites is just another way to spread malware, much like pirated games. The US DOJ noted that the 911 S5 botnet spread via VPN software and pay-per-install services that bundle malware with legitimate installers.

When it's safe to use a free VPN

A free VPN isn't always a trap. There are scenarios where it's perfectly clear who is paying for the servers and why.

• A trial period for a paid service. They let you test the product in hopes you'll subscribe. Just keep an eye on auto-renewal; we explain how to avoid surprise charges in our guide on how to choose a VPN.
• A corporate VPN provided by your employer. The company pays for it, and the company sees your traffic. Use it for work tasks, and turn it off for personal browsing.
• A free tier from a well-known company that makes its money on premium plans. The free version acts as a marketing tool, and its limits are clearly stated—like a few gigabytes of data per month, access to just one or two countries, or capped speeds. Check who owns the company, how long they've been around, and if they've passed independent security audits.
• Built-in browser features from major developers. For example, Microsoft Edge includes a Secure Network feature that gives you 5 GB of free data per month when signed into a Microsoft account. These features typically only protect browser traffic, not the whole device, and as Microsoft notes, they aren't available in all regions.

In all four scenarios, you know who runs the servers and how they stay in business. If you can't answer those questions, it's better not to install the app.

Sometimes, paying a tiny amount is the smartest choice. If you only need a VPN for a one-week trip, daily billing costs less than a cup of coffee: at Byte VPN, a week costs just 70 ₽.

How to vet a VPN app before installing

Vetting an app takes about ten minutes and weeds out most shady options. This works for Android, iPhone, and PC.

1. Look up the developer. The app page on the App Store or Google Play will list their name and website. The site should feature a company name, contact info, and a clear description of the service. If the developer is just a string of random letters and has no website, move on.
2. Check the developer's other apps. If an account has a dozen identical apps called 'VPN Fast Secure', it's a factory farming users.
3. Open the privacy policy and find answers to three questions: what data is collected, how long it's kept, and who it's shared with. If you see terms like 'partners', 'advertising networks', and 'app usage analysis', you know exactly how the service makes money.
4. Check what data the app collects. Google Play has a 'Data safety' section, and the App Store has 'App Privacy' labels. A VPN client does not need access to your contacts, SMS, phone calls, files, or precise location.
5. Read the one- and two-star reviews. Five-star reviews are easy to fake, but the bad ones are where real people complain about full-screen ads, surprise charges, and weird phone behavior.
6. Read the system warning after installation. When you connect for the first time, Android and iOS will ask for VPN permission and warn you that the app can see your network traffic. This is normal for a VPN, which is why you need to decide if you trust the developer before tapping 'Allow'.
7. Ensure the VPN actually works: verify your IP address changes and that DNS requests aren't leaking. We explain how to do this in our article on how to check your VPN.

Signs your VPN app is doing too much

A proxy SDK or background adware rarely announces itself, but there are indirect signs. Be alert if any of the following happen after installing a VPN:

• Your phone gets hot and the battery drains fast, even when idle, and the VPN app tops the battery usage stats.
• The app consumes hundreds of megabytes in your data usage stats, even though you barely used it.
• Ads pop up over other apps or on your home screen.
• Websites constantly ask you to solve CAPTCHAs, or your accounts are suddenly locked for 'suspicious activity'. This happens when someone else is browsing from your IP address.
• After an update, the app requests new permissions that have nothing to do with VPN functionality.

None of these signs guarantee malicious intent—even honest VPNs trigger CAPTCHAs occasionally. But if two or three line up, it's best to delete the app and follow the steps below.

If you've already installed a shady VPN

1. Uninstall the app.
2. Remove the leftover VPN profile. On an iPhone, go to Settings → General → VPN & Device Management; if there's an unfamiliar device management profile, delete that too. On Android, VPN profiles are usually in Settings → Network & internet → VPN (on Samsung, Connections → More connection settings → VPN). If you can't find it, use the settings search bar.
3. Change passwords for any accounts you logged into while the VPN was active, and enable two-factor authentication wherever possible.
4. On Android, scan your phone with Google Play Protect to ensure it removes any apps Google has flagged as malicious.

For a step-by-step guide on installing and configuring a VPN safely, check our tutorials for Android and iPhone.