Are Free VPNs Safe in 2026? What You Should Know Before Using One

A free VPN is not one product. Safety depends on the operator and model. A 2026 measurement of 281 free Android Play apps found common leaks and tracking — inside that fence.

Updated August 2026Reviewed by StaySecureHub Editorial TeamEditorial review

“Free VPN” is not one product. Some apps run on ads or tracking, some share your connection with other people, and some are limited tiers funded by paid plans. In every model the operator still sits on your traffic path.

A 2026 measurement of 281 operational free Android Play VPN apps (November 2024, default settings on Android 14) found common cleartext, DNS and traffic leaks, Advertising ID transmission, and weak OpenVPN configs — inside that fence, not on every platform. Desktop research has found leaks in commercial software too, so paid is not leak-proof. A store listing is not an independent security audit. Named “VPN” apps have been used as proxy or botnet loaders; that is not the whole category. A paid-funded free tier with a published, scoped audit is a different object from an ad-supported or bandwidth-sharing app.

What “free” actually means

If the app costs you nothing, someone else is still paying for servers, bandwidth, and the company. The interesting question is who, and what they get in return.

Three economic models show up again and again:

  • Free-only, ads, or tracking. The product is the user. Revenue comes from advertising, identifiers, or other data uses — not from a subscription you declined.
  • Peer-to-peer or bandwidth-sharing. Other people’s traffic may exit through your connection, or yours through theirs. You are not only a customer; you are part of the network.
  • A limited free tier funded by paid plans. Capacity, server locations, or device limits are restricted so that paying customers subsidise a smaller free offer. The operator still sees the tunnel. The business model is different.

These are not the same product with different prices. Treating them as one “free VPN” category is how people end up applying a Play Store statistic to a subscriber-funded free plan, or a law-enforcement takedown of named botnet apps to every zero-euro download.

What a VPN actually does to your traffic

A VPN does not make you anonymous. It moves trust.

On an ordinary connection, your traffic is visible to the local network and to your internet provider in the usual ways. A VPN app creates a tunnel to the provider’s servers, so those parties see less of the destination — and the VPN operator can view, intercept, and handle the traffic instead. That is the point of the product, and it is also the risk. A VPN is a trust transfer, not a disappearing act.

The authors of the 2026 mobile study note a widespread belief that VPNs keep people anonymous — they cite a figure of 82%. Belief is not a technical guarantee. That matters on untrusted public Wi-Fi as much as on a home ISP: you have moved who can see the path, not deleted the observer.

What researchers found in free Android Play VPN apps

The most recent large measurement aimed at free consumer VPN apps is MVPNalyzer (NDSS 2026). The fence matters as much as the percentages.

Researchers collected 281 operational free Android VPN apps from Google Play in November 2024, using Play search plus the “VPN & Proxy Tools” listing. They tested each app in its default configuration on Android 14. This is not a census of all VPNs, not an iOS study, not a desktop study, and not a sample of paid-only clients.

In that corpus:

  • 61 of 281 apps sent some data in cleartext; 5 of those sent VPN configuration files unencrypted.
  • 29 leaked user traffic, including DNS. A DNS leak means lookups for domain names leave the tunnel, so the local network or ISP can still see which sites you resolve. The paper’s breakdown (some apps appear in more than one bucket) is 24 DNS leaks, 6 browser-traffic leaks, and 4 unencrypted tunnels.
  • 76 transmitted the device Advertising ID.
  • 246 of 281 contacted advertising or tracking URLs, using common filter lists.
  • 108 apps shipped OpenVPN configurations. 107 of those 108 failed at least one of the hardening checks the authors evaluated. One of 108 followed every check they applied.

Where the paper quotes install figures, those are Play Store install buckets (the ranges Google shows on a listing), not a count of unique people.

None of this says “every free VPN fails.” It says that among free Android apps that actually came up in Play search in late 2024, basic tunnel hygiene, encryption, and tracking exposure were common problems.

Leaks are not only a free-Android problem

DNS, IPv6, and tunnel-failure leaks are an implementation class. They show up in older Android work, in iOS apps, and in desktop clients — including commercial ones. The percentages are not interchangeable. Different years, platforms, and methods produced different rates.

On Android, a 2016 IMC study of 283 Play apps with the VPN permission found that about 84% did not tunnel IPv6 and about 66% did not tunnel DNS. That is a dated snapshot, useful as a baseline, not as 2026 prevalence.

On the desktop, VPNalyzer (NDSS 2022) tested 80 providers (paid and free mixed). 26 leaked traffic when the tunnel failed; 8 leaked DNS on failure. Five leaked IPv6 to the ISP by default: Astrill, Norton Secure VPN, Turbo VPN, SurfEasy, and one university VPN. 10 still leaked in a “most secure” custom configuration; 6 of those 10 did so with a kill switch enabled. A kill switch is meant to block traffic if the tunnel drops. It is worth having, and it is not a guarantee — see how a VPN kill switch is supposed to work.

On iOS, a 2020 ARES study of 57 App Store VPN apps found that a majority failed to send DNS through the tunnel. That is a separate corpus. It is here to stop the Android Play numbers from being treated as “how VPNs work on phones.”

Paid software can leak. Free software can be built carefully. The leak literature does not support “paid = leak-proof.”

Tracking and advertising IDs

“Does a free VPN spy on me?” is the wrong shape of question if the expected answer is yes for every app or no for every app.

In the MVPNalyzer Android Play corpus, 76 of 281 free apps transmitted the Advertising ID — Android’s resettable identifier used to target ads. Many also sent device attributes that can support fingerprinting. 246 of 281 contacted tracker or ad URLs on the authors’ filter lists. That is evidence that some free-only Android products talk to the advertising and tracking ecosystem. It is not evidence that every free VPN sells your browsing history.

Transmitting an Advertising ID is not the same as selling a full browsing log. Contacting a tracker URL is not the same as a proven data-broker contract. Those distinctions matter. The honest statement is narrower: if the product is free-only and ad-supported, you should assume the operator has a reason to observe or share identifiers — and you should look for a documented business model rather than inferring one from the word “VPN.”

Unsafe can mean broken, not “malware”

A VPN can fail you without being a virus.

In the same 281-app Android study, 107 of 108 examined OpenVPN configs failed at least one of the authors’ hygiene checks. 61 apps sent some cleartext. In the authors’ tests, the 5 apps that shipped VPN configs in the clear were exposed to tunnel hijacking. That is incompetent or hostile engineering. It is not, by itself, a malware rate.

An older Android study (Ikram et al., IMC 2016) found 18% of VPN-permission apps tunnelling without encryption. On VirusTotal, 38% of those apps had at least one antivirus engine flag, but only 4% reached the authors’ conservative threshold of five or more engines. A single antivirus flag is not confirmed malware; that paper treated five engines as the conservative bar. “38% of free VPNs contain malware” is not what that paper showed, and MVPNalyzer did not re-measure 2026 Play search results as an AV-label malware rate. Its findings are leaks, cleartext, tracking, and configuration quality.

Criminals do ship fake VPN apps. Treat those as named products with named sources — not as a smear on the whole free category.

Being on Google Play is not a security audit

Play listing is a distribution channel with rules. It is not a pentest.

Google’s VpnService policy (Play Console Help) requires, among other things, that VPN be a core function of the app (with listed exceptions); that traffic be encrypted from the device to the tunnel endpoint; that VpnService use be documented in the Play listing; that there be prominent in-app disclosure and consent if the app collects personal or sensitive data via VpnService; and that the app must not redirect or manipulate other apps’ traffic for monetization. Since a 17 July 2024 policy announcement, VPN developers (among other sensitive categories) must register as an Organization.

Those rules are declarations plus a minimum encryption requirement. They do not mean Google independently audited the app for leaks, logging, or malware. Play Data Safety labels are self-reported. MVPNalyzer’s entire 281-app set was drawn from Play search results and still failed the tests above. If a listing were a security certificate, that measurement would have been a short paper.

When a “VPN” app is really someone else’s exit node

Some products branded as VPNs are built to put your device on someone else’s network path.

The FBI has published consumer guidance on VPN applications used as 911 S5 backdoors. It names MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN. Those are specific products in a law-enforcement notice, not a random sample of Play search and not a definition of “free VPN.”

A related pattern shows up in industry reporting: Google Threat Intelligence’s disruption of IPIDEA, summarised by BleepingComputer, describes free-VPN branding used to enrol devices as residential-proxy exits via trojanized Android apps and SDKs. That is evidence of a monetization method. It is not a prevalence rate for every free download.

Hola is the well-known peer-to-peer / bandwidth-sharing design: other users’ traffic can exit through your connection. Darktrace’s 2026 telemetry, in observed enterprise cases (February–March 2026), associated Hola-related traffic with later suspicious downloads and cryptomining. That does not prove Hola delivered malware in every case. It does illustrate the extra risk of a model where your device is an unmanaged egress point.

A popular Play search result is not on that FBI list unless the FBI (or an equivalent primary notice) named it.

A limited free tier is a different object — not a recommendation

Some providers sell paid plans and also offer a restricted free tier. That is still a VPN operator on your path. It is not the same economic object as a free-only, ad-supported, or bandwidth-sharing app.

Proton VPN’s published plan and “why free” pages (retrieved 19 August 2026) describe the free plan as servers in 10 named countries, one concurrent device, unlimited data, no ads on that plan, funded by paid subscriptions, and using the same encryption, DNS-leak protection, and kill-switch language as paid plans on those pages.

A no-logs audit is a named firm’s dated review of whether the operator stores connection logs — only as good as its scope. In 2026 Proton published a Securitum no-logs conclusion on its own site: as quoted there, the examined infrastructure did not indicate logging of browsing, DNS, destinations, traffic contents, or user-identifiable connection metadata, and Proton says the auditors asked whether that policy applies across subscription tiers. That language is Proton-published. The Securitum PDF was not independently re-opened for this article. Proton’s transparency report states 47 Swiss orders through June 2026, all denied for lack of logs — again, a vendor report of court outcomes. None of this is a finding that Proton cannot leak, cannot change, or is “the safest free VPN.” For a fuller product page, see the Proton VPN review. That page is a product review, not a ranking in this article.

Mullvad is useful as a second contrast, and it is not a free product. Its June 2024 Cure53 infrastructure audit (3–14 June 2024) was scoped to staging servers configured like production. Cure53 reported Low and Medium findings that Mullvad says were fixed, and that no issues were found that would compromise VPN traffic anonymity or integrity. Audits are point-in-time and scoped. They are not perpetual safety certificates, and they do not cancel the desktop leak literature above.

Other providers can fund a limited free tier. Proton is an example of documented vendor claims plus a published audit quote, not the only possible shape of that model.

How to decide whether to use a given free VPN

You do not need a ranked shortlist. You need a few questions that survive marketing pages.

  1. Who pays? If you cannot tell whether the product is ad-supported, bandwidth-sharing, or a paid-funded free tier, you do not know whose incentives you joined.
  2. Is there a public independent audit with a named firm, a date, and a stated scope — and does it actually cover the claim you care about (for example no-logs infrastructure, not a privacy-policy rewrite)?
  3. Avoid peer-to-peer / bandwidth-sharing designs and unnamed APK “VPNs” from outside the official stores. Store listing is still not enough, but sideloaded mystery clients remove even that weak filter.
  4. A home leak test is not an academic measurement. It can still catch a kill switch that does nothing. VPNalyzer’s desktop work is the reminder that “kill switch on” and “no leak” are not the same statement.
  5. Match the threat to the operator. On hostile café Wi-Fi, a competent tunnel can reduce local exposure. If the VPN operator is sloppy or malicious, that operator can be a worse observer than a trusted home ISP. That is a trade-off, not a universal rule that “no VPN is always safer” or that “any free VPN is always worse.”

For choosing among known providers, use the VPN buying guide and whether a VPN is worth it as handoffs — they are not hidden rankings of free apps. Account security still sits above the tunnel: protecting online accounts is a different job from encrypting a path.

Frequently asked questions

Are free VPNs safe in 2026?

Some free VPNs can be reasonable in a specific context, but “free” by itself does not tell you a VPN is safe. Safety still depends on the business model, the implementation, and the operator. Measured problems were common in 281 free Android Play apps (November 2024, Android 14). That is not a verdict on every free tier or every platform.

Do all free VPNs sell my data?

No. Some free Android apps in the 2026 Play measurement transmitted Advertising IDs and contacted tracker URLs. That does not establish that every free SKU sells browsing history. Freemium, paid-funded free tiers are a different commercial claim.

If it’s on the Play Store or the App Store, is it safe?

No. Play’s VpnService rules require a declaration and encryption to the tunnel endpoint. They are not an independent security audit. The 281-app Android study was drawn from Play search results.

Are paid VPNs always safer?

No. Desktop research (VPNalyzer, 2022) found tunnel-failure, DNS, and IPv6 leaks in a mixed commercial corpus, including with a kill switch enabled in some configurations. Paying can change incentives. It does not certify the implementation.

What about Proton VPN Free and other freemium plans?

They are a different economic object from free-only or bandwidth-sharing apps: a limited tier funded by paid plans, with vendor-published audit language in Proton’s case. That is a contrast, not a recommendation, and not a forever certificate. Mullvad’s published Cure53 work is a paid-product audit, not a free plan.

Can a free VPN have malware?

Yes — as specific products. The FBI has named 911 S5 “VPN” apps. GTIG reporting describes free-VPN branding used to enrol proxy bots. Older 2016 VirusTotal figures are noisy: many single-engine flags, far fewer at the authors’ five-engine threshold. MVPNalyzer did not publish a 2026 malware-rate for Play search. Broken encryption is common in that study; “all free VPNs are malware” is not.

Bottom line

Free is not one thing. In a 2026 measurement of 281 free Android Play VPN apps (November 2024, Android 14), leaks, cleartext, tracking identifiers, and weak OpenVPN configs were common — inside that fence. Leaks also exist in desktop and commercial software, so paid is not leak-proof. A store listing is not an audit. Named criminal “VPN” apps are a separate, specific problem. A documented, paid-funded free tier with a scoped published audit is a different object, not a shopping-list winner.

Those figures can change. A later study of free Android Play VPNs could show different leak or tracking rates. As of 19 August 2026, Google Play Help pages do not show an official rule requiring independent no-logs audits. New FBI or Google Threat Intelligence notices can name additional consumer brands as proxy-botnet loaders, and a frequently cited provider’s audit can fail or be narrowed.

Before you use a given free VPN, judge who operates it, how the service is funded, and whether there is dated, scoped public evidence you can check. Do not assume “free” means unsafe, and do not assume “paid” means safe.

Sources

StaySecureHub Editorial Team

Editorial Team at StaySecureHub

StaySecureHub's editorial team researches privacy, cybersecurity and digital safety topics to help readers make informed decisions.