Most free VPNs are not as safe as they look. Running a VPN network is expensive, so a service that charges nothing often earns its income from you instead: by logging and selling your browsing data, showing intrusive ads, or bundling tracking code into the app. Some free VPNs are run by honest companies as a limited taster for a premium plan, but many are not, and telling them apart takes a few minutes of checking.
Here are the seven biggest hidden risks of free VPN apps, followed by simple checks you can use to choose a VPN you can actually trust.
1. Your browsing data may be the product
A VPN can see every website you visit. That makes VPN traffic data valuable to advertisers and data brokers. When a free provider says it keeps "no logs" but has no audit or clear business model, there is a real chance your activity is being recorded and sold. Remember the old rule: if you are not the customer, you are the product.
2. Malware and hidden tracking code
Researchers at Australia's CSIRO studied 283 Android VPN apps and found that more than 38% contained some form of malware, while 75% used third-party tracking libraries. Many of those apps promised to protect privacy at the same time. Even if the study is several years old, it shows why an unknown free VPN app deserves suspicion.
3. Weak or missing encryption
The same CSIRO research found that 18% of the apps did not encrypt traffic at all. A VPN without proper encryption gives you a false sense of security: you think you are protected on public Wi-Fi, but your data is travelling in the clear.
4. Unclear ownership
Who runs your VPN matters, because that company can see your traffic. In 2025, the Tech Transparency Project reported that 20 of the top 100 free VPN apps on Apple's US App Store had undisclosed Chinese ownership, and those apps had been downloaded more than 70 million times. If you cannot find out who owns a VPN and where it is based, do not trust it with your data.
5. Data leaks and exposed databases
Several free and low-cost VPN providers have leaked user data through badly secured servers. In 2020, researchers found that seven Hong Kong-based VPN services that claimed to keep no logs had exposed more than a terabyte of user records, including activity logs and email addresses. A "no logs" promise means little if the logs exist and are left unprotected.
6. Your connection may be shared with strangers
Some free VPNs route other people's traffic through your device to build their network. The best-known case was Hola, which in 2015 was found to be reselling its users' bandwidth through a separate business. If someone else's activity passes through your connection, it can be traced back to your IP address.
7. Slow speeds, data caps and pushy ads
Even honest free plans usually come with strict data limits, crowded servers and only a few locations. That leads many people to switch the VPN off when it gets slow, which defeats the point. Ad-supported apps can also open pop-ups and redirect pages, which is a security risk in its own right.
How to choose a trustworthy VPN: 6 easy checks
Look for an independent audit. Reputable providers hire outside security firms to verify their no-logs claims and publish the results.
Check who owns it. The company name, country and leadership should be easy to find on the website and in the app store listing.
Read the privacy policy. It should say clearly what is logged, for how long, and whether any data is shared. Vague wording is a warning sign.
Test for leaks. After connecting, use a DNS and IP leak test website to confirm that your real IP address and DNS requests are hidden.
Make sure it has a kill switch. A kill switch cuts your internet connection if the VPN drops, so your real IP is never exposed by accident.
Check what it asks for at sign-up. Privacy-focused services ask for as little personal information as possible. Some let you create an account with just a random account number and no email address.
If anonymous sign-up matters to you, it helps to compare providers that are known for it. Privacy directories such as XMRList keep lists of VPN services that support private, low-information sign-up, which makes it easier to shortlist providers before you read their audits and policies.
When is a free VPN good enough?
A free plan from a well-known provider with a published audit can be fine for light, occasional use, such as checking email on hotel Wi-Fi. For everyday browsing, streaming or anything sensitive, a reputable paid service with a clear no-logs record is the safer choice. Many paid VPNs also offer a refund guarantee, so you can try them without long-term commitment.
Frequently asked questions
Are free VPNs safe to use?
Some are, but many are not. Free VPNs from unknown developers may log and sell data, contain tracking code or offer weak encryption. Stick to free plans from established providers with independent audits.
Can a free VPN steal my data?
Yes. A VPN can see the sites you visit, and a dishonest provider can record that activity, sell it or leak it through poor security. That is why ownership and audits matter so much.
How do I know if my VPN is leaking?
Connect to the VPN, then visit an IP and DNS leak test site. If it shows your real IP address or your internet provider's DNS servers, your VPN is leaking.
Is a VPN enough to keep me anonymous online?
No. A VPN hides your IP address from websites and your traffic from your internet provider, but cookies, logged-in accounts and browser fingerprinting can still identify you. Combine a VPN with a privacy-focused browser and good habits.
Should I delete a free VPN app I already use?
If you cannot confirm who owns it, whether it has been audited and what it logs, it is wise to uninstall it, change any passwords you used while connected, and switch to a provider you have checked.
Final thoughts
A VPN is only as trustworthy as the company behind it. Free apps can cost you more than a subscription ever would, in the form of your data and your security. Take a few minutes to check ownership, audits, privacy policies and leak test results, and you will end up with a VPN that genuinely protects you.