- The business model question
- Data collection and tracking
- Security and app quality
The business model question
A free VPN can be legitimate when it is a limited tier of a paid service, a nonprofit project, or a clearly funded privacy tool. It becomes risky when ownership is unclear, the app is stuffed with ads, the privacy policy permits broad data sharing, or the company refuses to explain how the service is funded. A VPN sits in a powerful position because it can see connection metadata and can influence where your traffic goes.
I split free VPNs into three buckets: reputable limited free tiers, unclear ad-funded apps, and high-risk apps with vague ownership or invasive permissions. The first can be useful. The second needs caution. The third is where I would rather use no VPN than route sensitive traffic through an unknown company.
Data collection and tracking
The worst free VPNs do not just show ads. They may collect device identifiers, approximate location, usage metadata, app events, or browsing-related data. Even when contents are encrypted by HTTPS, metadata can still be valuable. Read the privacy policy before installing. If the policy is vague about logs, affiliates, analytics partners, or data sharing, that is not a small paperwork problem. It is the product telling you how it thinks about users.
At minimum, assume a VPN provider can see your source IP, the VPN server you used, connection timing, bandwidth, destination IP metadata, and DNS requests if it handles DNS. HTTPS still protects page contents, but it does not erase every signal.
Security and app quality
Free VPN apps can lag on updates, leak DNS, mishandle IPv6, ship weak kill switches, or use confusing permissions. Some free browser extensions are not full VPNs at all. They may proxy browser traffic while leaving other apps untouched. If you need protection on public Wi-Fi, travel, banking, or sensitive browsing, do not assume the word VPN means the whole device is protected.
Browser extension VPNs deserve special suspicion. A browser proxy may not protect torrent clients, email apps, game launchers, system updates, command-line tools, or DNS outside the browser. That can be fine if it is clearly labeled, but it is not the same as a device-level VPN tunnel.
When free can be acceptable
A limited free tier from a reputable paid provider can be fine for low-risk use, especially if it has a clear no-logs policy, sensible limits, no sketchy ad model, and a path to paid plans. Proton VPN is a common example of a provider with a serious free tier, although free servers and features are naturally limited. Treat free as a trial or basic privacy layer, not as a substitute for a full privacy strategy.
Free VPN checklist
Before installing a free VPN, check ownership, privacy policy, logging claims, audit history, app permissions, DNS leak behavior, IPv6 behavior, ad model, support quality, and whether the app explains its limits clearly. On mobile, also check whether the app asks for location, contacts, notification, or background permissions that do not match the product. If you cannot answer those questions in ten minutes, use a reputable paid VPN or a trusted limited free tier instead.
Sources and further reading
VPNs to compare next
FAQ
Are all free VPNs unsafe?
No. Some limited free tiers from reputable providers are reasonable. The risky category is unclear ownership, aggressive ads, vague logging, and no credible funding model.
Can a free VPN sell my data?
A provider can only do what its policy and local law allow, but many policies permit analytics, advertising, or data sharing that privacy-conscious users would not expect.
What is safer than a random free VPN?
Use a reputable limited free tier, a paid VPN with clear audits, or a self-hosted remote access VPN when your goal is reaching your own network.