Is a Free VPN Safe? What They're Not Telling You

The Business Model Problem

Running a VPN costs real money. Servers in 60+ countries, bandwidth for millions of users, engineering teams, security audits — none of this is free. So when a VPN offers you unlimited privacy for $0, you have to ask: where is the money coming from?

The answer, in most cases, is you.

How Free VPNs Actually Make Money

After years of reviewing security tools, Øyvind has identified five primary monetisation models for free VPNs:

1. Selling your browsing data. This is the most common. Your browsing history is packaged and sold to data brokers and advertisers. The VPN encrypts your connection from your ISP — then sells what they collect themselves.

2. Injecting ads into your traffic. Some free VPNs modify your HTTP traffic to inject advertisements into websites you visit. This is not theoretical — it has been documented in multiple apps.

3. Using your device as an exit node. HolaVPN, one of the most downloaded free VPNs in history, was found to be routing other users' traffic through their subscribers' connections. Your IP address was being used by strangers.

4. Malware bundling. A 2020 study found that 38% of free VPN apps on the Google Play Store contained malware. The VPN itself is the attack vector.

5. Upselling to paid plans. This is the only acceptable model. ProtonVPN free and Windscribe free are genuine — they offer a limited service and hope you upgrade. These are the only free VPNs we consider trustworthy.

The CSIRO Study

In 2016, the Commonwealth Scientific and Industrial Research Organisation studied 283 free VPN apps. Their findings: 75% contained tracking libraries, 82% requested access to sensitive data like contacts and text messages, and 38% contained malware.

The landscape has not significantly improved. Free VPN apps continue to be among the most dangerous software you can install on your device.

The Only Free VPNs Worth Using

Two free VPNs have passed our scrutiny:

ProtonVPN Free — No data cap. No ads. No data selling. Servers in 3 countries (US, Netherlands, Japan). Slower speeds than paid. Run by the same Swiss team behind ProtonMail. The business model is honest: they want you to upgrade.

Windscribe Free — 10GB per month (15GB if you confirm your email). Servers in 11 countries. Clean privacy policy. Canadian company with a transparent business model.

Both are usable for light use. Neither is a replacement for a paid VPN if you care about speed and full server access.

What a Paid VPN Actually Costs

NordVPN's 2-year plan works out to roughly 30 Norwegian kroner per month. That is less than a single coffee. For that, you get military-grade encryption, a verified no-logs policy, servers in 60+ countries, and a kill switch that actually works.

The question is not whether a paid VPN is worth it. The question is why you are still considering giving your browsing data to a company whose business model depends on selling it.

Reviewed by Øyvind — NorwegianSpark SA. Affiliate links disclosed.