Are free VPNs safe? What a study of 281 apps found

A VPN sends every site you open and every app that phones home through one company's servers. Your internet provider stops seeing where you go, and the VPN company starts. So a VPN never removes the party watching your traffic. It replaces them, and with a free VPN you usually have no idea who the replacement is or how they pay their server bill.

Short answer: most free VPNs are not safe, but a few are. A 2026 study of 281 free Android VPNs found more than 80 percent contacted advertising and tracking servers, and many leaked traffic or used broken encryption. The safe exceptions are limited free tiers from established paid providers that publish who they are and prove their no-logs claims.

Are free VPNs safe to use?

It depends entirely on who runs the servers and how they make money. The free VPNs at the top of app store charts look identical: five stars, a shield logo, "military-grade encryption." The difference is invisible from the listing and obvious once you follow the money.

A VPN is the most trust-heavy app on your phone, because it sees everything the other apps send. Running one costs real money in bandwidth, servers, and engineers. If you are not paying, somebody else is, and they are paying for something.

How do free VPNs make money?

Business model	Who pays	What it costs you	Documented example
Selling or sharing usage data	Advertisers, data brokers, the parent company	A record of your apps and browsing	Facebook's Onavo
In-app ads and tracking SDKs	Ad networks	Trackers watching the traffic you meant to hide	246 of 281 apps in the NDSS 2026 study
Reselling your connection	Other customers who rent your IP	Strangers' traffic leaving the internet under your IP address	Hola, 2015
State-linked ownership	Unclear, and that is the problem	Data held by a company that must cooperate with its government	Qihoo 360-linked apps
Free tier of a paid product	The paying customers	Speed, server, or data limits	Established providers' free plans

Four of those five models are paid for with you. Only the last one is a real gift, and it is a sales tool: the provider wants you to upgrade, so it has a reason to behave.

What the research found

The biggest study so far, 2026. At the NDSS security conference in February 2026, researchers from the University of Michigan, the University of New Mexico, and IIT Delhi ran 281 free Android VPN apps through a testing framework they built. Per The Hacker News:

Apps flagged with at least one problem had more than 2.4 billion installs between them.
246 apps, more than 80 percent, contacted known advertising and tracking servers. 76 sent the phone's advertising ID.
29 let traffic leak outside the encrypted tunnel. 24 of those leaked DNS lookups, the list of sites you visit, and those 24 alone had about 360 million installs.
61 sent some data in plain text. Nearly one in five used outdated ciphers such as Blowfish or triple DES, and a few set the tunnel cipher to "none," which switches encryption off entirely.

These are not obscure apps. They are the ones people find by searching "free VPN" in the Play Store.

Facebook ran a VPN to watch its rivals. Facebook bought Onavo in 2013 and offered its VPN as a way to keep your information safe. Onavo recorded which apps people used and for how long. Internal documents later published by a UK parliamentary committee showed Facebook used that view to see WhatsApp pulling ahead of its own Messenger, intelligence behind its $19 billion WhatsApp deal. Apple pulled Onavo from the App Store in 2018, and Facebook shut it down in February 2019.

One in five top free VPNs had hidden Chinese owners. The Tech Transparency Project examined the 100 most popular free VPNs in the US App Store in 2024 and found, as TelecomsTechNews reported, that 20 were secretly owned by Chinese companies, with more than 70 million US downloads combined. Turbo VPN, VPN Proxy Master, and Thunder VPN traced back to Qihoo 360, which the US Commerce Department sanctioned in June 2020. China's 2017 National Intelligence Law requires companies to cooperate with state intelligence work.

Browser extensions are not safer. In August 2025, Koi Security found that FreeVPN.One, a Chrome extension with more than 100,000 installs and a "Featured" badge in the Chrome Web Store, was quietly taking screenshots of the pages its users visited and sending them to a remote server, as CSO Online reported. A badge from the store is not a privacy audit.

Is a free VPN worse than no VPN?

Sometimes, yes. Without a VPN, your internet provider sees the sites you connect to. With a bad free VPN, your provider may still see some of them through leaks, and a second company that wants to monetize you now sees everything, occasionally in plain text. You added a watcher instead of removing one. (For what your provider sees without any VPN, read can my ISP see my browsing history.)

How to vet a free VPN in 10 minutes

Do this before you install, not after.

Find the real owner. On the App Store, scroll to the "Seller" field. On Google Play, open "About this app" and the developer contact details. Then search that company name plus "VPN ownership." If the listing, website, and privacy policy will not name a company and a country, stop there.
Read the privacy label. Apple's "App Privacy" section lists data "Linked to You" and data "Used to Track You." A VPN that tracks you for advertising is working against its own purpose.
Check the trackers and permissions (Android). Search the app on Exodus Privacy, a free nonprofit service that lists the tracking libraries and permissions inside Android apps. A VPN needs network access. It does not need your contacts, precise location, camera, or microphone.
Look for evidence behind "no logs." Every VPN says it keeps no logs. Look for specifics: exactly what is and is not recorded, RAM-only servers, and published technical documentation. A slogan with no details is not evidence.
Ask how it pays for itself. "We sell premium plans" is a real answer. Silence is also an answer.
Test it once it is on. Connect, then run a DNS leak test from a site like dnsleaktest.com. If your own internet provider's servers show up, the VPN is leaking the list of sites you visit.
Walk away from bandwidth sharing and injected ads. If the terms mention "peer" networks or sharing your connection, your IP address may carry other people's traffic.

When is a free VPN fine?

When it is a limited free plan from a company that sells a paid one, names its owners, and backs its no-logs claim with specifics you can check. For low-stakes moments, like a café Wi-Fi session or a quick blocked site, a free tier like that is a reasonable tool. Just keep the two promises separate: "safe on this network" is not the same as "private from the VPN company."

What a paid VPN should give you instead

If you pay, pay for the design, not the slogan. The question to ask is whether the operator is able to profit from your traffic in the first place.

That is the standard Secria VPN is built to. It keeps no activity logs: we do not record browsing, DNS queries, or traffic contents. While a session is live we hold the account and device it belongs to, the server in use, and the time it started, and that record goes when the session ends. Servers keep their state in RAM, not on disk. Every WireGuard tunnel adds an ML-KEM-1024 post-quantum key, so traffic captured today stays sealed even against a future quantum computer. It is $7.99 a month, or included with Pro (see pricing), with a 30-day money-back guarantee, which is the honest way to try something before you trust it.

FAQ

Do free VPNs sell your data? Many do, directly or through the advertising and tracking SDKs built into the app. In the 2026 NDSS study, 246 of 281 free Android VPNs contacted known ad and tracking servers.

Are any free VPNs safe? A few. The safer ones are limited free tiers from established paid providers that publish their ownership and back their no-logs policy with checkable detail. Anonymous, unlimited, "totally free" apps are the ones to avoid.

Are free VPNs safe on iPhone? The App Store review process does not verify what a VPN does with your traffic. The Tech Transparency Project found hidden Chinese ownership in one in five top free VPNs on the US App Store. Check the Seller field and the App Privacy label before installing.

Are free VPN extensions for Chrome safe? Treat them with the same suspicion. A browser extension can read the pages you visit, and FreeVPN.One kept a "Featured" badge while capturing screenshots of users' browsing.

Can my ISP see what I do with a VPN on? It sees that you are connected to a VPN and how much data moves, not which sites you visit. If the VPN leaks DNS, your ISP can still see the site names.

A free VPN costs something. The only question is whether the price is written on the pricing page or hidden in the privacy policy.