Are free VPNs safe? Three ways they pay for servers

The short answer, and who is saying it

Five of the pages we read on this question come from companies that sell a subscription: Proton (a VPN), Norton and Avast (both carry a Gen Digital copyright line), Bitdefender and Brave. That does not make them wrong. It does mean that when they say what a free VPN costs you, the company saying it has a paid plan to sell. So we use their pages for what they declare and for how they describe the business models, and we look for proof elsewhere: a lab report, a study reported by two news sites, a complaint filed with a US regulator and a security company’s report on one free service.

Their answers differ in strength. Proton says that free VPN services are, as a rule, too good to be true and are best avoided. Norton says a free VPN may suit light, occasional use, such as reading news on public Wi-Fi without logging in, and tells you to avoid one for banking, shopping or work. Bitdefender lists tracking, weak security, intrusive advertising and fake VPN apps as the biggest risks, and adds that the level of risk varies significantly between providers. Avast goes furthest toward a middle line: it says free versus paid is not by itself a reliable measure of VPN safety, and that a free plan from a well-established provider is generally a safer choice than a standalone free service with unclear ownership or vague privacy policies.

Put together, the pages we read give a conditional answer. How safe a free VPN is depends on who runs it and how it earns money, and the word free does not settle that on its own. The rest of this page takes those two questions in turn.

How a free VPN pays for its servers

Proton starts from a cost: it says it costs money to run VPN servers, develop applications and provide customer support, so a VPN service needs revenue one way or another. The pages we read describe three ways, and each is attributed below to the page that says it.

Advertising and data. Top10VPN’s author writes that “most free VPN providers rely on advertising or monetizing their user data” to cover costs, and calls that fundamentally at odds with the purpose of a VPN. In the same report, third-party adtech is described as how “most VPN providers” offer a free product and still make money. Proton says that free VPN services typically do this by abusing your privacy and selling your data to advertisers, and names Hola in 2015, Betternet in 2016 and Hotspot Shield in 2017 as services caught doing it. Brave offers two conclusions it calls not mutually exclusive: the service is poor, or its costs are covered by selling data.

A funnel to a paid plan. Norton says the free service can act as a funnel: basic functions, with the stronger privacy and performance features kept for subscribers, and monthly data caps that it says are often in the range of 2 GB to 10 GB. Bitdefender says some free plans allow only a few hundred megabytes of data per day. Avast describes lower bandwidth, smaller allowances and connection limits on the free plans of reputable providers, and says those limits are not inherently security problems. Proton describes its own free plan as partially subsidized by paid plans and as paid for by Proton Mail, whose reach in countries with strong censorship it wants to keep, and says that is why the free plan has no bandwidth limits. That is Proton describing itself.

The user’s own connection. Wikipedia says that by using Hola’s free service, users accept becoming peers in the network of Bright Data, a residential proxy provider, while paying users do not. The next sections come back to that case. The model is different in kind from the first two: the product being sold is the user’s connection, not the user’s data.

How to tell which one you are using

The vendors give checks, and they overlap. Proton says that unless there is a clear source of revenue, a service is likely not actually free but engaged in some form of data selling, and lists six things to look at: the privacy policy, the technical security, where the company is based, who runs it, assessments by trusted third parties, and whether the code is open and independently audited. Bitdefender says a trustworthy provider should be clear about how it earns money and what it does with the information it collects, and suggests checking for independent security audits and for a history of privacy controversies. Avast points at ownership, privacy policies and data practices in its comparison of standalone free VPNs with free plans from known providers.

Those are all things a provider says about itself or that a reader can look up. The pages we read do not give a way to confirm a service’s revenue model for yourself, and a statement on a pricing page is not proof of what the app does. That is why the next two sections turn to measurement.

What 100 free Android apps did in a lab

The largest test in our reading is Top10VPN’s report, written by Simon Migliano and updated on 5 June 2024. It tested the 100 most popular free VPNs in the Google Play store, apps that it says have been installed over 2.5 billion times, against around 260 million installs for the top 100 in 2018. Each app was installed on a basic Samsung phone and checked with the site’s own leak tool and with tools including Wireshark and mitmproxy.

On leaks, 88 apps out of 100 had some kind of leak, 83 leaked DNS requests, and 17 leaked in more than one way (IPv4, IPv6, DNS or WebRTC). Eleven suffered encryption failures. On permissions, the report says almost 70 per cent of the apps request at least one permission that puts privacy at risk, with location at 20 per cent and scanning for installed apps at 46 per cent. On tracking code, 84 apps contained software development kits from marketing or social media platforms, and 16 contained ten or more.

The part that bears on the revenue question is the traffic. Top10VPN reports that 71 apps shared personal data with at least one outside party, that 33 parties received data in all, among them the data broker Kochava and the analytics platform AppsFlyer, and that the data included 37 device fingerprints, 23 IP addresses and 61 unique tracking identifiers. It also found 93 apps whose Play Store Data Safety label differed from their own privacy policy.

The report is careful about two of its own findings. On code, it says the presence of third-party tracking code suggests data collection and sharing but is not definitive proof on its own. On malware, it reports that almost one in five apps (19 per cent) were flagged by antivirus scanners, and says those flags should be viewed with low confidence because “most of them were only identified as such by a single vendor”. Norton and Avast both repeat the one-in-five figure from this report, and the pages we read from them do not carry the caution about a single scanner.

The report is also not fixed. Top10VPN says ClearVPN, Symlex and Adguard approached it after publication and updated their apps, and it keeps a section recording such changes. Its author still recommends paying whatever you can afford, so the provider does not need another way to cover costs, while allowing that a good free Android VPN can be found by doing your research, with trade-offs such as a data cap or limited servers.

The older study, and where two reports disagree

In January 2017 two sites reported on a study of Android VPN apps by researchers from the University of New South Wales, the University of Berkeley and CSIRO, according to Tripwire. We read the two reports, from Technology Decisions (27 January 2017) and Tripwire (29 January 2017). We downloaded the original paper but could not open it here, so every number below belongs to one of those two reports, not to the paper.

Tripwire says the researchers started from more than 1.4 million candidate apps, free and paid, and kept 283 free apps that asked for the VPN permission in their manifest files. Technology Decisions reports that 75 per cent of the 283 used third-party tracking libraries, 82 per cent asked for access to sensitive data such as contacts and text messages, 16 per cent appeared to forward traffic through other users’ devices, 18 per cent used tunnelling protocols without encryption, two injected JavaScript and four performed TLS interception.

The two reports then give different numbers for the same study. Technology Decisions says over 38 per cent of the apps contained some form of malware. Tripwire says close to one in ten, eight per cent, had at least one positive malware report from VirusTotal, and gives the split of those reports: 43 per cent adware, 29 trojans, 17 malvertising, 6 riskware and 5 spyware. On tracking, Technology Decisions says 75 per cent, while Tripwire says 67 per cent of the free apps embedded at least one third-party tracking library and that 65 per cent of paid VPN apps did not, a comparison the other report does not make. We cannot say which figure is in the paper. What the pages show is that one study produced two sets of percentages, and the malware figure in particular depends on how it was counted.

Tripwire also reports that 84 per cent of the apps did not tunnel IPv6 traffic and 66 per cent did not tunnel DNS traffic, and quotes CSIRO’s Dali Kaafar saying some developers fixed what was found and some apps were removed from the Google Play Store. Put next to Top10VPN’s 2024 report, the 2017 numbers show that two different groups of researchers, seven years apart, found leaks and tracking in free Android apps. They do not show a trend: the app samples, the tests and the counting differ.

Two named cases, and an unnamed list

Hotspot Shield Free VPN. On 7 August 2017 the Center for Democracy and Technology (CDT) said it had filed a complaint with the US Federal Trade Commission about the app, alleging unfair and deceptive practices under Section 5 of the FTC Act. The app’s Google Play description said that privacy and security were guaranteed. Working with developers of Carnegie Mellon University’s Mobile App Compliance System, CDT says it found the app sharing network names, MAC addresses and device IMEI numbers with third-party advertising networks without telling users. It also points to a gap between the “no logs” claim and a privacy policy that says VPN providers may log data about a connection, for purposes that include delivering third-party advertising. A second analysis, CDT says, found the app injecting JavaScript through iframes for advertising and tracking, and not sending mobile carrier information over HTTPS. The page we read does not say how the complaint ended.

Hola. Wikipedia says that from late 2014 Hola sold access to its users as exit nodes under the name Luminati, at $20 per gigabyte, that Hola’s founder confirmed this and argued it had always been part of the agreement with free users, and that Hola added a note to its FAQ after a critic emailed the company. Luminati became Bright Data in March 2021. In December 2018 Tech Monitor reported that Trend Micro had urged customers to uninstall HolaVPN, saying each device running the free version becomes an exit node monetized through Luminati, whose prices, Tech Monitor writes, start at $500 a month. It quoted Trend Micro saying that users’ IP addresses are regularly exposed to the sites they visit, and that the “vast majority” of Luminati traffic was likely related to fraud with mobile advertisements and to traffic from mobile apps. It also quoted the co-founder saying that Hola can be free because each user is also an exit node for other users.

Hola answered. In the same article a spokesman says the Trend Micro report is sensational and irresponsible, that Hola is a free unblocker and not a privacy VPN, that its premium VPN users are not part of the peer network, and that free users provide idle resources to Luminati in return. The two accounts describe the same mechanism, free users as the supply; Trend Micro calls the service high risk, and Hola’s spokesman calls Luminati a fully legitimate transparency network. We did not open the Trend Micro report itself.

An unnamed list. Brave’s page says that in 2021 three free VPNs leaked detailed credentials for more than 21 million users and that in 2023 another leaked 360 million user records. It does not name them, and a note says these providers got caught because the data they collected was leaked online. Brave also says 47 per cent of VPN users choose free versions and that over two-thirds of free VPN users report performance problems, but the page we read does not say where those figures come from.

When a free plan from a known provider is a different thing

Avast and Proton draw a line that Top10VPN’s counts do not: Top10VPN tested the 100 most popular free apps in the Play Store and reports them together. Avast says a free plan from a well-established provider that also sells paid plans is generally a safer choice than a standalone free VPN, and that the limits on such plans, such as bandwidth or connection caps, are not inherently security problems. Proton makes a version of the same argument for its own plan. Brave’s page and Norton’s speak of free VPNs as one group, though Norton adds that this does not mean all free VPNs are unsafe.

The pages we read do not say how many people use a free plan from a known provider rather than a standalone free service, and Top10VPN’s findings are for Android apps in 2024: they say nothing about iPhones, Windows, Macs or browser extensions. Norton names one Chrome extension, uncovered by Koi Security with spyware-like functions added in an update, without a date. If you are weighing a specific free plan, two of our pages read one closely: Proton VPN, where the question is what the company says it logs and who checked, and Opera’s built-in free VPN. Two more cover the ground underneath: what a VPN is used for and what a kill switch is for, which matters when a connection drops.

One risk sits outside all of these tests. Bitdefender says that one of the biggest risks does not come from legitimate free VPNs at all: cybercriminals sometimes create fake VPN apps meant to infect devices with malware or steal credentials, and it advises downloading VPN software only from trusted developers and official app stores. Avast adds that in 2025 Google warned of a surge of fake VPN apps that masquerade as privacy tools. Both are vendor pages, and we did not trace the Google warning.

We name no safest free VPN. The vendors’ pages recommend their own products, and we do not.

What we did not do

We tested no VPN. We did not open the CSIRO paper, the Trend Micro report on Hola or Hola’s own reply beyond the lines Tech Monitor quotes. We did not read how Top10VPN earns its revenue, and it is itself a review site. Tech Monitor’s date comes from the text of the article, and we did not check it against the site. The figures from Norton, Avast and Brave about CNET, Zimperium, Security.org and Google are theirs, repeated from their pages, and we did not trace them.