VPNInfobaseSome free VPNs are unsafe and some are not, and the kind of free matters. A free tier of a paid service is paid for by the paid tier. A free-only app has to be paid for some other way, and the published research and incident reports below show what that has cost users in specific cases. This page cites three; it does not claim they represent every free VPN.
The three cases
| Case | What was reported | Source and date |
|---|---|---|
| 283 Android VPN apps, analysed by academic researchers | the researchers report that 75% of the apps enabled third-party tracking, 18% used tunnelling without encryption, and 84% leaked IPv6 traffic and 66% DNS queries; some apps injected JavaScript into users’ traffic and four intercepted TLS (percentages as reported by Threatpost; the paper’s abstract gives the findings without numbers) | Ikram and co-authors, Internet Measurement Conference, 2016 (paper); the apps were Google Play apps using Android’s VPN permission; the study is not a test of free VPNs as such, and the sources we read do not split free from paid |
| Hola | Users’ idle devices served as exit points for Hola’s paid Luminati service; The Register reports that the 8chan operator said an attacker used a Luminati free trial against his site, and that Hola expanded its FAQ within a day and said its screening was adjusted | The Register, 29 May 2015 |
| UFO VPN | An unsecured database, reported as 894 GB and more than 20 million logs a day, exposed plain-text account passwords, IP addresses and connection times, despite a stated no-logs policy; the researchers found it on 1 July 2020 and it was secured on 15 July | Comparitech, July 2020, which says the exposure affected free and paid users; UFO VPN’s response (that the data was anonymous, which the researchers disputed) is in that article |
The numbers are the sources’ own, from 2015 to 2020. We did not repeat any measurement, and apps and policies have changed since. These are dated cases, not a current ranking.
How free VPNs pay for themselves
The business model is the question to ask. A vendor with a free tier and a paid tier says so on its pricing page; Proton’s free page, read on 29 September 2026, says its free plan has “no data or speed limits”, “no ads”, one device and a strict no-logs policy, and points to paid plans for more countries and devices. A free-only app that lists no paid plan and no owner has no visible income, which is why the Hola case is worth reading.
A checklist before installing one
- Who owns it? A named company with a contact address, not just a brand. See who owns your VPN.
- How does it earn money? A paid tier, or something else?
- Is there an audit report you can open? Read what kind it is: the audit tracker separates no-logs assurance from app testing.
- What did it say happened when something went wrong? The incidents timeline shows how providers answered.
- Would a paid plan cost you much? The cheap VPNs page lists the lowest published plans, each with its currency and renewal terms.
Where to go next
Privacy Guides lists Proton VPN, IVPN and Mullvad as its recommendations (read 29 Sep 2026); we compare them in Proton VPN vs Mullvad vs IVPN. Our criteria for privacy are on best VPN for privacy, and the register method is on how we pick VPNs. The Proton VPN review covers a free-tier vendor’s own audit record.
Researched from the cited studies and press reports; not a test. Reviewed every 180 days.