Are Free VPNs Safe? What the Research Actually Shows

In brief

• 88% of the 100 most popular free Android VPNs leaked data in 2024 tests; 71% shared data with third parties. The freemium exceptions — and how to spot them.
• There are two kinds of free VPN, and the safety question has a different answer for each: totally-free apps funded by your data, and freemium tiers funded by paying subscribers of the same company.
• The research is consistent across a decade: a 2016 CSIRO study of 283 Android VPN apps found 38% contained malware and 84% leaked IPv6 traffic; a 2024 Top10VPN investigation of the 100 most popular free Android VPNs found 88% leaked data and 71% shared personal data with third parties.
• The freemium short list that survives both studies’ logic: Proton VPN Free, Windscribe Free, TunnelBear Free, hide.me Free, and PrivadoVPN Free — each with a hard limit (data, locations, or devices) that is the price of the free tier.
• Before installing any free VPN, check four things: who owns the company, whether a paid tier funds the free one, whether the privacy policy rules out data sales, and whether independent audits exist.

The short answer: most are not, a few are

A free VPN asks for an extraordinary level of trust: every byte of your internet traffic passes through its servers. When that trust is misplaced, the VPN does not merely fail to protect you — it becomes the party watching you. The research on free VPN apps, repeated across a decade, says that misplaced trust is the norm, not the exception.

But “free VPN” covers two very different businesses, and blurring them is how most advice on this topic goes wrong. A totally-free app with no paid product has to make money somehow, and the only asset it holds is its users. A freemium tier from a company with millions of paying subscribers is a different animal: the free tier is a marketing cost, paid for by the people who upgrade. The first group is where the horror stories live. The second group contains the only free VPNs worth installing.

Two kinds of free VPN — and how to tell them apart

Totally-free apps exist only as a free product. There is no upgrade path, no subscription revenue, and no other business. Their revenue comes from advertising inside the app, from selling or sharing user data, or from reselling users’ bandwidth. They are usually mobile-only, often have no real company website, and frequently hide their ownership behind shell companies. Top10VPN’s 2024 investigation found that 64% of the free VPN apps it examined had no dedicated website at all — several had no online footprint beyond their app-store listings.

Freemium tiers are the free plan of a paid VPN company: Proton, Windscribe, TunnelBear, hide.me, and PrivadoVPN all sell subscriptions, and their free plans are deliberately limited versions of the paid product. The limits are the tell. A freemium free plan caps your data, your server locations, or your simultaneous devices, because the company wants you to hit the limit and upgrade. A totally-free app has no reason to limit you — you are not the customer, you are the inventory.

The app-store test takes about two minutes: search the provider’s name plus “pricing.” If there is a paid plan with a real price, and the free plan is listed on the same pricing page with stated limits, you are looking at freemium. If there is no pricing page, no paid product, and no company address, you are looking at the other kind.

What the research actually found

Two large investigations anchor everything else written on this topic, and both measured free Android apps specifically — the category where the risk concentrates.

CSIRO / Data61, 2016. Researchers from CSIRO’s Data61, UNSW, the International Computer Science Institute, and UC Berkeley analyzed 283 free Android VPN apps on Google Play. The findings, published as “An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps,” were stark: 38% of the apps contained some malware presence when scanned through VirusTotal; 18% set up traffic tunnels without encryption at all; 84% leaked IPv6 traffic and 66% leaked DNS traffic, meaning the traffic the VPN existed to protect was exposed anyway; 75% used third-party tracking libraries; and 82% requested access to sensitive data such as user accounts and text messages. Two apps actively injected JavaScript into users’ traffic for advertising and tracking. The researchers’ own summary still stands: “in spite of the promises for privacy, security and anonymity given by the majority of VPN apps, millions of users may be unawarely subject to poor security guarantees and abusive practices.”

Top10VPN, June 2024. Eight years later, Top10VPN spent months testing the 100 most popular free Android VPN apps — together carrying over 2.5 billion installs — capturing their network traffic and reviewing their source code. The results barely moved: 88% suffered some kind of data leak (IP, DNS, or WebRTC), with almost one in five affected by multiple leak types; 71% shared personal data with third parties, including social media companies and data brokers; 53% contained privacy-risking code with the permissions to run it; and almost one in five was flagged as suspected malware by antivirus scanners. The 2024 study is the more damning of the two, because its sample was not obscure apps — it was the apps people actually download.

Two caveats keep this honest. First, both studies tested Android apps, where the free-VPN problem is worst; desktop freemium products from established providers were not the subject of either investigation. Second, neither study says every free VPN is dangerous — they say the category is dangerous, and that the burden of proof sits with the individual app. That is exactly what the freemium distinction resolves: the safe list below consists of companies whose business model answers the study’s central question (who pays for this?) without involving your data.

How a free VPN pays its bills when you do not

If a VPN has no paying customers, the money comes from one of four places, and three of them cost you directly:

1. Data sales and sharing. The 71% figure from Top10VPN is the core finding: personal data flowing to third parties — social media companies, advertising networks, and data brokers. The SDKs embedded in these apps collect device identifiers, browsing patterns, installed-app lists, and sometimes location, packaged for sale.
2. Advertising and tracking inside the app. CSIRO found three-quarters of tested apps used third-party tracking libraries. The ads are not just annoying; the tracking code is how your behavior is monetized.
3. Bandwidth resale. The extreme version of this model was Hola VPN, which routed traffic through other users’ connections — meaning a stranger’s activity could appear to come from your IP address — and sold access to that network. The 911 S5 botnet case, which prosecutors say earned roughly $99 million by routing traffic through enrolled machines, is the criminal end of the same idea: your connection itself is the product.
4. Upselling to a paid tier. This is the only model that does not cost you your data, and it is the freemium model. The company’s incentive is to give you a good enough free experience that you eventually pay — not to extract value from you while you are free.

Red flags before you install

Run any free VPN through this check before it touches your traffic:

• No paid product. If the company sells nothing, ask what it sells instead. The answer is usually you.
• Hidden ownership. Ownership concealed behind shell companies, or a privacy policy that names no company at all, is a walk-away signal. In 2024, the Tech Transparency Project found 1 in 5 of the top 100 free VPN apps in the US App Store had undisclosed Chinese ownership, with 20 of those apps accumulating over 70 million US downloads.
• Excessive permissions. A VPN needs network permission. It does not need your contacts, text messages, location, or a list of your installed apps. Top10VPN found nearly 70% of tested apps requested permissions with no legitimate VPN use case.
• No audit, no transparency report, no open-source apps. Independent verification is the cheapest signal a provider can offer. Its absence, from a company asking to route all your traffic, is a choice.
• “Unlimited everything, free forever” with no business attached. Unlimited data, unlimited locations, unlimited devices, no account, no ads, no paid tier — that combination has no funding source except the one you cannot see.

The free VPNs that are actually safe

Each of these is a freemium tier from a company with a real paid product, a published privacy policy, and independent verification of some kind. Limits below were checked against September/October 2026 comparison roundups — re-check the provider’s own free-plan page before installing, because free tiers change.

• Proton VPN Free — best overall free plan. Unlimited data, no ads, 10 server countries assigned by the app, one device at a time. Swiss-based, open-source apps, regularly audited. The catch is the one that matters least for most people: you cannot pick your country.
• Windscribe Free — best for multiple devices. 10 GB per month with a confirmed email address (2 GB without), around 10 countries, unlimited simultaneous devices. Canadian-based, with transparency reports. The only free plan here without a device limit.
• hide.me Free — best unlimited-data alternative. Unlimited data, 8 locations you choose, one device, no account required. Malaysian-based, with a 2024 no-logs audit. Speeds are held low on the free tier rather than capped by data.
• PrivadoVPN Free — best for streaming on a free plan. 10 GB per month at full speed, then throttled to about 1 Mbps, 13 locations, one device. Swiss-based. The throttled-after-cap design means it keeps working after the allowance ends, slowly.
• TunnelBear Free — best for beginners. 2 GB per month, country assigned by the app, no strict device limit. Canadian-based, audited annually by Cure53 since 2017. The 2 GB allowance is the smallest here — enough for occasional public Wi-Fi use, not for daily driving.

What none of these will do on a free plan: reliably unblock every streaming library, support torrenting (Proton, hide.me, and TunnelBear block it on free plans), or give you a choice of dozens of countries. Those are the paid features, and that is the point — the limits are visible, stated up front, and enforced by the product, not hidden in a privacy policy.

Already using a free VPN? Do this now

If the app on your phone is not one of the five above — or you cannot tell who owns it — treat it as untrusted and act in this order:

1. Disconnect and uninstall it. Every day it runs, it holds your traffic.
2. Change passwords for accounts you used while connected, starting with email and banking. A VPN that leaked DNS traffic or logged activity may have exposed session data; password rotation is cheap insurance.
3. Check what it could see. Review the permissions you granted (on Android: Settings → Apps → the VPN app → Permissions) and note anything beyond network access — contacts, SMS, location — as data that may already have been collected.
4. Replace it with a freemium tier from the list above, or with no VPN at all until you pick one. For public Wi-Fi, a reputable free tier beats a shady one by an order of magnitude; for everything else, browsing without a VPN is safer than browsing through an app that sells your traffic.

The bottom line

Free VPNs are not one thing. The research is brutal about the category — 88% leaking, 71% sharing, more than a third carrying malware flags — but it is brutal about totally-free apps, the ones with no paying customers and nothing to lose by exploiting you. Freemium tiers from Proton, Windscribe, TunnelBear, hide.me, and PrivadoVPN survive that research because their answer to “who pays for this?” is visible and benign: paying subscribers do.

So the question to ask is not “are free VPNs safe?” It is “who pays for this one?” If the answer is subscribers, and the limits are stated on a pricing page, install it. If there is no answer, do not.

Related reading

• VPN Statistics 2026 — the usage, privacy, and market numbers behind the VPN boom, including how many users choose free services.
• VPNs Explained: How They Work and How to Choose One — the threat-model framing: what a VPN does and does not protect, by scenario.
• Is a VPN Safe for Online Banking? — what a VPN does and does not protect during a banking session.

Sources

• CSIRO/Data61 — “An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps” (original paper, PDF) — 283 apps; 38% malware presence; 18% unencrypted tunnels; 84% IPv6 leak; 66% DNS leak; 75% tracking libraries; 82% sensitive permissions.
• ZDNet — “VPNs are not as private as the name suggests: CSIRO” — contemporaneous summary of the CSIRO findings.
• iTnews — “Many Android VPN-enabled apps do not protect user traffic” — CSIRO/Data61, UNSW, ICSI, UC Berkeley team; 38% malware; 84% IPv6 leak.
• Top10VPN — “Free VPN Security Investigations” (June 2024 research summary) — 100 most popular free Android VPNs, 2.5B installs; 88% data leaks; 71% shared personal data; 53% privacy-risking code; 64% no dedicated website.
• BetaNews — “88 percent of free Android VPNs leak data” — June 7, 2024; Top10VPN findings including ByteDance/Yandex tracking code and 17% multiple leaks.
• PCWorld — “Top 100 free Android VPNs puts 2.5 billion users at risk” — June 10, 2024; near-90% leak rate; almost one in five flagged as suspected malware.
• Gizmodo — “Best Free VPN 2026” — freemium limits cross-check (Proton/Hide.me unlimited; Windscribe/PrivadoVPN 10 GB; TunnelBear 2 GB; device limits).
• Listify — “Best Free VPNs in 2026: 6 Safe Picks” (figures current September 2026) — freemium comparison table: data, locations, devices, audits, jurisdictions.

Last verified: October 27, 2026.