“Free VPN” advertises itself as a way to avoid paying for privacy. But running VPN servers costs real money (bandwidth, infrastructure, staff), so a free VPN is paying for itself somehow. The question worth asking before you install one is: how?
Some providers answer that honestly: a limited free tier funds a paid product that shares the same privacy policy. Others answer it by logging your traffic, selling usage data to ad brokers, or bundling tracking code into the app itself. Independent research keeps finding that most free VPN apps fall into the second group.
This article separates the honest free tiers from the ones researchers would flag, and asks the question most VPN reviews skip entirely: do you actually need a VPN, and how often?
How we compared
We read the providers’ own pricing and policy pages in July 2026, and we lean on one large piece of academic work rather than our own speed tests. Speed numbers from a single location on a single day tell you almost nothing anyway. What a VPN does with your traffic matters more, and that has actually been measured at scale.
Where a claim is a provider’s own promise, we say so. Where an outside party checked it, we name the party. Both are in the sources.
How free VPNs actually make money
Running a server network isn’t free, so a “free forever” VPN with no catch is rare. There are a few honest business models, and one dishonest one.
The honest versions: a free tier that funnels users toward a paid upgrade (Proton VPN, Windscribe), a free tier subsidized by a company’s other paid products, or a donation-supported nonprofit VPN. The dishonest version is the app that pays its bills by logging your browsing and selling access to that data, sometimes to the exact ad-tech industry a VPN is supposed to protect you from.
Researchers at the University of Michigan, the University of New Mexico and IIT Delhi built a tool called MVPNalyzer and pointed it at 281 free Android VPN apps, presenting the results at the NDSS security conference in February 2026. Apps flagged with at least one problem had been installed more than 2.4 billion times between them.
The findings: 246 of the 281 contacted known advertising and tracking servers, and 76 sent the device advertising identifier used to track people across apps. Twenty-nine let user traffic escape the encrypted tunnel. Sixty-one sent unencrypted data readable on the local network. Of the 108 apps whose OpenVPN configuration files the team examined, nearly one in five used weak or outdated ciphers, including Blowfish and triple DES.
That’s not a fringe result. It describes the majority of the free VPN category sitting in app stores right now.
The underlying trick isn’t unique to VPNs, either: something “free” quietly pays for itself through your data or a renewal you forgot about. See AI subscriptions most people don’t need for the same audit applied to software you’re already paying for.
The honest free tiers
Proton VPN’s free plan page. Unlimited data with no ads is rare enough among free VPNs that it’s worth a screenshot.
Proton VPN’s free plan is the most commonly cited exception: unlimited data, no ads, and (per Proton’s published policy) the same no-logs commitment that applies to its paid plan. The tradeoffs are real: one device, no choice of server location, and most streaming services block Proton’s free-tier IP ranges. That’s a fair trade for occasional use, not a hidden cost.
Windscribe’s free tier works on the same principle: a hard 10 GB monthly cap, but the same underlying privacy claims as its paid service, rather than a separately monetized “free” product wearing the same logo.
The pattern that separates a trustworthy free VPN from a data-harvesting one: the free tier is a smaller version of the paid product, not a different business using the same brand name.
Red flags before you install any VPN
A few checks take less time than the install itself and catch most of the bad actors before you hand over your traffic.
Look up who owns the company and where it’s legally based. A VPN based in a jurisdiction with weak data-protection law, or owned by a holding company that also runs ad-tech businesses, has less incentive to keep a no-logs promise than one that publishes its ownership openly.
Check the permissions the app requests. A VPN needs to create a network tunnel. It does not need contacts, SMS, location history, or camera access. If a “VPN” app asks for those, that’s the actual product being built, and your traffic data is a bonus.
Search for whether the no-logs claim has ever been independently audited, and by whom. “No logs” printed on a marketing page is a promise. “No logs, confirmed by Cure53’s [year] audit” is a promise with someone else checking the homework. Providers with nothing to hide tend to publish the audits; providers with something to hide tend to just repeat the slogan.
Finally, check how the company survives if it’s genuinely free with no upsell in sight. If you can’t find a plausible answer (no paid tier, no parent company, no investors, no ads in the app), that’s usually because the answer is your data, and it just isn’t stated that plainly on the download page.
What paid actually buys you
Once you’re comparing the honest options, paying mostly buys convenience, not fundamentally better privacy. Mullvad charges a flat €5 a month no matter how long you commit, so there’s no renewal trap to navigate. It also publishes the outside audits rather than just claiming them: Cure53 reviewed its VPN infrastructure in 2024, Radically Open Security did the same in 2023, and NCC Group and Leviathan Security have since audited the Android app.
Mullvad’s homepage. The flat rate applies no matter how long you stay, so there’s no renewal trap to watch for.
NordVPN runs the classic intro-rate structure instead. Cybernews’s 2026 pricing tracker puts the cheapest 2-year Basic plan around $3.09 a month, and the rate climbs at renewal. Its higher tiers bundle a password manager and other apps, which is really a different purchase than “just a VPN.” Prices move with promotions and region, so treat that figure as a starting point and read your own checkout screen.
NordVPN’s pricing page, shown here with EU pricing. Check the page directly for the rate in your own region, and note the renewal price before you commit.
| Plan | Price | What you get | What you give up |
|---|---|---|---|
| Proton VPN Free | $0 | Unlimited data, no ads, stated no-logs policy | One device, no server choice, most streaming blocked |
| Mullvad | €5/mo flat, any term | Published outside audits, anonymous accounts | Fewer streaming unblocks than bigger brands |
| NordVPN Basic (2-yr) | Around $3.09/mo intro, renews higher | Large server network, fast speeds, streaming access | Price jumps once the intro term ends |
If your main frustration with a free VPN is speed or a blocked streaming library, paying fixes exactly that and nothing more mysterious. It does not make your browsing untraceable, and it doesn’t replace basic account security. A reused, leaked password beats any VPN protection, which is one reason a solid password manager matters more than a VPN subscription for most people’s actual risk profile.
Do you need a VPN at all?
For most everyday browsing at home, no. Home Wi-Fi is already encrypted (WPA2/WPA3), and nearly every site you use runs HTTPS, which encrypts the connection between your browser and the site regardless of any VPN. A VPN mainly hides your traffic’s destination from whoever controls the network you’re on: useful on public Wi-Fi, largely redundant at home.
The cases where a VPN earns its cost: logging into sensitive accounts (banking, work email) on hotel or airport Wi-Fi, or simply wanting your internet provider to see less of your browsing pattern. It is not a tool for becoming anonymous online. That requires operational habits no VPN provides on its own, and any marketing claim that says otherwise should be discounted on sight.
Worth it for
- Honest free tiers (Proton, Windscribe) are genuinely fine for occasional public Wi-Fi use
- Paying mainly buys speed, server choice, and streaming access: real but modest benefits
- Audited flat-rate options like Mullvad avoid the renewal price-hike trap
Skip it if
- Most free VPN apps in app stores monetize your data instead of protecting it
- A VPN does not make you anonymous, whatever the ad claimed
- Paid tiers with bundled extras (password managers, "antivirus") can cost more than buying each tool separately
Alternatives
- If your VPN research started as part of a broader privacy cleanup, the highest-value first step usually isn’t a VPN at all. See phone settings worth changing immediately.
- Considering a VPN because a browser extension asked for suspicious permissions? Check which AI browser extensions to avoid before adding anything else to your browser.
- Trying to cut recurring costs generally, VPN included? See tech subscriptions you can replace for free.
Verdict
WAIT. Most people should use a reputable free tier (Proton VPN or Windscribe) for occasional public Wi-Fi use, and pay only once a specific, recurring frustration shows up: streaming access, speed, or a job that requires it. Skip any “free” VPN outside the handful with a transparent, audited privacy policy. The research above says most of them are the product, not the protection.
Common questions
Is there a free VPN that doesn’t sell your data?
Yes, a small number. Proton VPN’s free plan carries no ads and, per Proton’s published policy, the same no-logs commitment as its paid tier, and Windscribe’s free 10 GB tier works the same way: a smaller version of the paid product, not a separate business monetizing the same brand name. Most other free VPN apps don’t work like this. A 2026 academic study of 281 free Android VPN apps found the large majority contacted ad-tracking servers, and some leaked traffic outside the encrypted tunnel entirely.
Is Proton VPN’s free version safe to use?
Based on Proton’s own published policy, yes for occasional use: unlimited data, no ads, and the same no-logs claim that applies to the paid product. The real limits are practical, not a privacy risk: one device, no choice of server location, and most streaming services block its free-tier IP ranges.
