KovraThe question is usually framed as a matter of trust, which makes it unanswerable from the outside. Reframe it as arithmetic and it becomes tractable: a VPN with a million users moves petabytes of traffic per month, and someone pays for that. If it is not the user, the money comes from somewhere else, and there are only a few possible somewheres.
The four ways a free VPN pays its bills
1. Selling usage data
The most direct. Connection logs, visited domains and app usage are valuable to analytics and advertising brokers. Privacy policies describe it as sharing "aggregated" or "de-identified" data with partners — language that has been used to cover the sale of browsing histories, and which is difficult to distinguish from the real thing without an audit.
2. Advertising and injection
Ads inside the app are the honest version. The dishonest version is modifying traffic in transit: injecting scripts into pages, or rewriting affiliate links so the operator earns the commission on purchases you make. HTTPS blocks most of this, which is why apps doing it have historically pushed users toward permissions that weaken that protection.
3. Reselling your bandwidth
The model people find most surprising: the app enrolls your device as an exit node in a commercial proxy network, and someone else's traffic leaves the internet through your home connection. It is disclosed in the terms of service of several free apps. It also means activity you know nothing about is attributed to your IP address.
4. Free tier as a funnel
The legitimate model. A paid provider offers a limited free tier to demonstrate the product. Revenue comes from subscriptions, so there is no incentive to monetize traffic, and the limits are the point: modest data cap, fewer locations, lower priority.
How to tell which one you are looking at
| Signal | Reassuring | Warning |
|---|---|---|
| Business model | Paid plans exist and are prominent | Free with no paid tier at all |
| Company identity | Named entity, jurisdiction, address | Anonymous developer, no legal entity |
| Privacy policy | Specific about what is not collected | Reserves rights to share with "partners" |
| Permissions requested | VPN configuration only | Contacts, storage, accessibility services |
| Audit | Published report with readable scope | "Independently verified" with no document |
| Data limits | Explicit and modest | Unlimited everything, free, forever |
The last row is the most reliable single heuristic. Unlimited free bandwidth is the one promise that cannot be kept without a second revenue stream. The full verification method — audits, jurisdiction, court records — is in how to verify no-logs claims.
The threat model actually matters
A free VPN is not uniformly wrong. Watching a geo-restricted video on a device with nothing sensitive on it is a different situation from routing your logged-in life through an unknown operator. Sort by stakes:
- Acceptable: one-off geo checks, casual browsing on a spare device, testing whether a site is region-locked.
- Not acceptable: banking, work email, messengers, anything on public Wi-Fi, anything on a censored network where being flagged has consequences, and peer-to-peer traffic where a wrong attribution is a legal letter.
Free VPNs on censored networks
Beyond the privacy question, they usually do not work. Free apps run the most heavily fingerprinted protocols on the best-known address ranges, so they are blocked first. If the network is doing protocol inspection, the choice is not free versus paid but recognizable versus camouflaged — see what works in China and Shadowsocks versus VLESS Reality.
What paying actually removes
A subscription does not automatically buy honesty; it removes the structural need for dishonesty. Combine that with signup that collects nothing and payment that carries no identity, and the provider ends up holding very little about you even if it wanted to sell something. The practical routes are signing up without an email and paying in crypto. On what it should cost, see the cheapest private VPN in 2026.
The one-line test
Ask who pays for the bandwidth. If the honest answer is not "the users, through subscriptions", the second answer is always your traffic — and a VPN is precisely the piece of software with the most complete view of it.