The Free VPN Trap - Which Free VPNs Are Honest
Most free VPNs are the product: Chinese-owned app families harvest data, Urban VPN's parent is a self-declared data broker, and Hola sold users' bandwidth. The honest free options are Proton VPN Free, Windscribe Free, RiseupVPN, CalyxVPN and Tor - each with documented limits.
Free is the most expensive price in the VPN market. The apps with half a billion installs do not run on goodwill - they monetize attention, data or bandwidth, and several have leaked the data they harvested at industrial scale [3][4]. This guide sorts the market into the three business models that exist, the documented incidents, and the short list of free options that can survive an honest look.
The three business models of "free"
Model 1: You are the inventory. The app shows ads, injects tracking SDKs and collects device identifiers to sell or to fuel an ad network. The 2016 CSIRO study of free Android VPNs found most embedded tracking libraries and a large share manipulable traffic or injected JavaScript [1]. Nothing about the modern app stores has changed the underlying economics.
Model 2: You are the product. The parent company is a data broker. Urban VPN's own privacy policy describes selling browsing-derived "marketing insights and behavior segments" to advertisers [5] - free because the traffic data is the revenue. The Urban family spans dozens of cross-branded proxy extensions that all funnel into the same engine.
Model 3: You are the infrastructure. Hola's free desktop client turned users' machines into exit nodes for its paid proxy network (Luminati, now Bright Data) - other customers' traffic left through your connection, attributed to your line [1]. Bandwidth resale as a business model survived; the free app is the supply side of it.
The ownership problem
The Play Store giants - SuperVPN, Turbo VPN, Thunder VPN, Snap VPN, VPN Proxy Master and friends - trace through Singapore and Hong Kong shells to a network of Chinese developers, with documented links to Qihoo 360, a company designated by the US Department of Defense and sanctioned by the Commerce Department [2]. A VPN owned through that chain sees and can reroute the traffic of users who believe they are "hiding" - the exact opposite of the product's promise.
Ownership is not a moral judgment; it is a data-access fact. A tunnel operator in a jurisdiction with compelled-assistance powers and no independent audit is a metadata collector with extra steps.
The documented failures
- UFO VPN (2020): a "zero-log" Chinese app left an Elasticsearch database open - 1.2 TB, about 23 million users, plaintext passwords, connection logs [3]. The same summer exposed sibling clusters.
- SuperVPN (2021): records of roughly 10 million users - including payment data - offered for sale on a dark-web forum [4]. Google had already pulled the app in 2020 over unpatched flaws.
- VPN Proxy Master (100M+ installs): named in the NDSS 2026 MVPNalyzer audit in three failure lists at once - unencrypted traffic outside the tunnel, DNS leaks, and Advertising-ID tracking - with ownership tracing to the same Qihoo 360 network [2].
The pattern is consistent: the apps that advertise loudest protect worst. A "zero-log" banner in an app store listing is marketing; an audit report or a court record is evidence.
The honest free options
Proton VPN Free - no data cap, one device, Swiss operator with multiple published audits, no ads. The default for a real free tunnel [4].
Windscribe Free - 10 GB/month with an email confirmation, more locations than Proton Free, same company logic: the free tier advertises the paid one.
RiseupVPN and CalyxVPN - run by nonprofit collectives, donation-funded, no accounts, minimal data retention by design. Less polished, fewer locations, structurally the most trustworthy business model in the category.
Tor - when the goal is anonymity rather than convenience, the free option with the strongest threat model. Slower by design; bridges for censored networks.
Cloudflare WARP - free, zero-config, and honestly scoped: it encrypts transport to Cloudflare but is not anonymity and not a VPN in the marketing sense. Fine for hostile Wi-Fi, wrong for everything else.
What we would actually do
For a laptop that travels: Proton Free or WARP covers hostile Wi-Fi. For 10 GB of general use: Windscribe Free. For principle and privacy-first: RiseupVPN. For anything involving journalism, activism or circumvention in a censored country: Tor, or a properly configured self-hosted server with obfuscation - not a Play Store app with 100M installs.
Compare the free options side by side in the free section, check any paid upgrade against proven no-logs, and if you keep hitting the data cap, the true-cost calculator will tell you what the paid tier really costs per year.
// FAQ
Is any free VPN actually safe?
A few, with honest limits - Proton VPN Free (no data cap, audited, Swiss), Windscribe Free (10 GB/month) and the nonprofit tunnels RiseupVPN and CalyxVPN. Everything else deserves a hard look at its business model.
How do free VPNs make money?
Advertising SDKs and data collection mostly, upsell funnels sometimes, bandwidth resale in Hola's case. Running servers is not free - the money comes from somewhere, and with free apps it usually comes from you.
Are the big Play Store VPNs safe?
The largest ones trace to Chinese developer networks through Singapore and Hong Kong shells, and several have documented breach histories. Ownership alone is disqualifying for privacy-critical use.
What about free tiers of paid VPNs?
Different category - a marketing budget, not a data business. Proton Free and Windscribe Free sell you a taste of the paid product and are run by companies whose paid business depends on not being caught selling data.