Why Free VPNs Are Often More Dangerous Than No VPN at All
Patrick Bushe
December 6, 2024 · 5 min read
Running a VPN costs real money: servers, bandwidth and staff. When a VPN is free with no paid plan behind it, the money usually comes from somewhere else, and often that's you. A bad VPN can see all your traffic, which can leave you worse off than using none.
How free VPNs make money
- Selling data: logging the sites you visit and selling it to advertisers or data brokers.
- Ads: showing ads in the app, or injecting them into web pages.
- Selling your bandwidth: in 2015, Hola VPN was found to be using its free users' connections as exit points for a paid network sold to other customers.
- Upselling: the honest model, where a limited free plan leads to a paid one.
What researchers have found
A 2016 study by Australia's national science agency, CSIRO, examined 283 Android VPN apps. It found signs of malware in 38% of them, and 18% didn't encrypt traffic at all. Many free apps also included third-party tracking code.
The risks
- Your browsing history in the hands of an unknown company.
- Malware or adware on your device.
- Weak or no encryption, so the protection you expect isn't there.
- Leaks that expose your real IP address anyway. See WebRTC leaks.
- "No logs" promises that turn out to be false.
Safer free options
- Free plans from paid VPNs: Proton VPN's free plan, for example, has no data cap or ads, but fewer servers and slower speeds. It's available on Mac, Windows and phones.
- Browser "VPNs": some browsers include a free proxy. These usually protect only browser traffic, not the rest of your device. See browser VPNs vs full VPNs.
How to judge any VPN
- Who owns it, and where is it based?
- Has an independent audit checked its no-logs claims?
- How does it make money?
- Does the app ask for permissions it doesn't need?
- Does it pass leak tests? See verifying a VPN.
Do you need one at all?
Most sites use HTTPS, which already encrypts what you send. A VPN mainly hides which sites you visit from your network and provider, and your IP address from sites. See whether you need a VPN.
Close the WebRTC gap
Even good VPNs can be bypassed by WebRTC, a browser feature used for video calls that can reveal your IP. WebRTC Privacy Shield sets Chrome's WebRTC policy to stop that, with a balanced mode for sites where calls break.
