Are Free VPNs Safe? What the Research Actually Found

By the VPNUncovered team · Checked 26 August 2026

Short answer. Are free VPNs safe? For most of the apps sitting at the top of the free charts, the published research says no. Testers keep finding malware flags, leaked data and owners who do not want to be named. There is one real exception, and it is the last section of this page.

A VPN app sees every site you visit. That is how it works. So the only question that matters is whether you trust the company running it. With a free app, you usually cannot even find out who that company is.

We are not going to hand-wave at that. Below are the actual studies, with the numbers and the dates, so you can check them yourself.

A 2024 test of the 100 most popular free Android VPNs

Top10VPN ran the 100 most popular free VPN apps on Google Play through a lab test. The results page was last updated on 5 June 2024. Apps were installed on clean Android devices, traffic was captured with Wireshark and mitmproxy, files were scanned through VirusTotal, and source code was reviewed.

What they found:

• 71 of the 100 apps shared personal data with at least one third party.
• Almost one in five (19%) were flagged as malware by anti-virus scanners.
• 83 leaked DNS requests. Around 90% suffered a leak of some kind.
• 23 apps exposed users' real IP addresses. 61 shared the Google Advertising ID. 37 shared device fingerprints.
• More than one in ten had encryption failures. 36% used weaker encryption. 53 had unstable tunnels.
• 93 apps had Google Play Data Safety labels that did not match their own privacy policies.
• Nearly 70% asked for at least one permission that puts privacy at risk: 46 wanted to scan the other apps on your phone, 20 wanted location, 10 wanted the camera.

Read the DNS number again. A leaked DNS request tells your network which sites you asked for. That is the exact thing you installed the app to hide. Most of these apps failed at the one job.

The same pattern showed up in 2016

This is not a new problem, and it is not a scare story invented by people who sell paid VPNs. A peer-reviewed paper by Ikram, Vallina-Rodriguez, Seneviratne, Kaafar and Paxson was presented at the ACM Internet Measurement Conference in November 2016. The team pulled 283 VPN-permission apps out of a corpus of 1.4 million Play Store apps and took them apart.

• Over 38% were flagged for malware presence by VirusTotal.
• 75% used third-party tracking libraries.
• 82% asked for permission to reach sensitive things like accounts and SMS.
• 67% marketed themselves as privacy or security tools.
• The authors also found insecure tunnelling, IPv6 and DNS leaks, and some apps actively intercepting encrypted TLS traffic.

Say the year out loud when you quote that study: 2016. It is old data. The reason it still matters is the 2024 test above found the same shape of problem eight years later. Nothing got fixed. The market just got bigger.

You often cannot tell who owns the app

On 1 April 2025 the Tech Transparency Project published an investigation into the US App Store. It found that 20 of the top 100 free VPN apps during 2024 had Chinese ownership ties that were not disclosed to users. Those apps had been downloaded more than 70 million times from US app stores.

Several traced back to Qihoo 360 through shell companies named Lemon Seed, Lemon Clove and Autumn Breeze. The apps included Turbo VPN (ranked 13th at the time), VPN Proxy Master (12th) and Thunder VPN (60th). Qihoo 360 was sanctioned by the US Commerce Department in June 2020 and designated a "Chinese Military Company" by the Defense Department.

You would not have learned any of that from the App Store listing. Hidden ownership is not a free-app problem only, either. Some of the biggest paid brands share a parent company you have never heard of. We map that out in who owns your VPN.

If you are not paying, what is being sold?

Running VPN servers costs real money. Bandwidth is not free. So a free app has to make money somewhere, and there is an old, well-documented example of where.

In May 2015 The Register reported that Hola, then claiming 9.7 million users, was reselling its free users' idle bandwidth as exit nodes under the Luminati brand, reportedly at $20 per gigabyte. It came to light because a flood of attack traffic aimed at the site 8chan had been routed through the machines of ordinary Hola users. Hola's founder said the arrangement had always been clear. The disclosure in the FAQ was reportedly expanded only after the story broke.

Again: 2015. Old. But it is the cleanest illustration of the trade. Free apps sell something, and it is usually something of yours.

The honest exception: a free tier from a company that sells paid plans

Here is the nuance most articles on this topic skip, because "all free VPNs are bad" is an easier sale.

There is a difference between a free VPN app and a free tier offered by a company whose business is selling paid subscriptions. In the second case the free plan is a sample of the paid product. The company makes money when you upgrade, not when it sells your traffic. That changes the incentive completely.

Proton VPN is the example we checked ourselves. Its free plan costs $0, needs no card, covers one device, and offers ten country locations (checked 26 Aug 2026). The paid plan covers 10 devices and carries a 30-day money-back guarantee (checked 26 Aug 2026).

One honest caveat: we have not independently tested the free plan's data limits or speeds, so treat it as a genuinely free tier, not as unlimited free data. Confirm the current terms on Proton's own page before you sign up, because plans change.

We earn a commission if you sign up through our links, at no extra cost to you. It never changes what we say about a product.

See Proton VPN's current plans →   Read our Proton VPN review

Five checks before you install any free VPN

1. Find the company name and country. If the App Store listing, the website footer and the privacy policy do not agree, stop.
2. Check the support email. A free Gmail address instead of a company domain is a bad sign.
3. Read the Data Safety label against the privacy policy. 93 of 100 apps in the 2024 test did not match.
4. Look at the permissions. A VPN does not need your camera, and it does not need to scan the other apps on your phone.
5. Ask how they make money. If there is no paid plan anywhere, the money is coming from somewhere else.

What we would actually do

If your budget is zero, use a free tier from a company that also sells paid plans, and accept the device and location limits. If you want a paid plan, look at the cheap end properly rather than grabbing the first free app: our cheap VPN picks lay out the terms with the dates we checked them.

And before you buy anything, work out whether you need a VPN for the thing you have in mind. A lot of people install one for public Wi-Fi and get less protection than they expect. We wrote an honest answer on public Wi-Fi that explains what a VPN does and does not stop.

We make money on the links above, and we say so on every page. Our full affiliate disclosure explains the arrangement.

Not sure which one fits you?

Five questions, no email required. It asks what you actually want a VPN for and gives you a pick plus a runner-up, with the dates we checked the terms.

Take the 60-second VPN quiz →