Free VPNs Aren't Free — Somebody's Paying, and It's Not the Customer

There's a joke that writes itself whenever a free VPN ad plays on a YouTube video: you're not the customer, you're the product. It's become such a reflex that we've stopped actually checking whether it's true. So I checked. Eight of the most popular free VPNs in the App Store, their privacy policies read line by line, their ownership structures traced through corporate registries, and their traffic claims run through public data sources.

The results range from "mildly sketchy" to "why is this app not in jail."

The Basic Math Doesn't Work — So Follow the Money

Running a VPN is expensive. Servers, bandwidth, engineering staff, app store fees — a legitimate operation costs real money per user, every month. When a company offers unlimited free service to millions of users, one of two things is happening: they're burning venture capital hoping you'll upgrade, or the data you generate while connected is worth more than the cost of serving you.

Spoiler: for most of the eight, it's the second one.

The Ownership Shell Game

Here's the part nobody puts on their landing page. Several of the biggest free VPN brands trace back to the same small cluster of parent companies, some of which also operate ad networks or data analytics firms. That's not a conspiracy theory — it's in Delaware and Hong Kong corporate filings, and it's been documented by researchers at places like CSI (the Canadian nonprofit that maintains a VPN trust index).

When the company selling you privacy also owns the infrastructure that monetizes your browsing habits, the privacy policy starts reading like a confession. One popular service's policy — I'm keeping names soft here since this is my read of the documents, not legal advice — permits sharing "de-identified" data with "advertising partners." De-identified location data plus your app inventory plus your browsing patterns is, per pretty much every study on re-identification, not especially de-identified.

The Logging Policy Bingo Card

I made a spreadsheet — because of course I did — with a column for each claim: no logs, no third-party sharing, independent audit, open-source client, jurisdiction outside surveillance alliances. Most of the eight scored one or two checkmarks and fumbled the rest.

The tells to watch for:

• "Anonymous analytics" — a phrase that means nothing and is doing everything
• Audits conducted by the company itself or by a firm you've never heard of
• Headquarters in a country with mandatory data retention while claiming a "privacy-friendly jurisdiction"
• A free tier that mysteriously serves you ads inside a supposedly encrypted tunnel

That last one is the big one. If your VPN app shows you advertisements, the encryption is protecting you from your ISP, not from the company you're paying nothing to.

The Two Worth Your Time

It's not all grift. Two services on my list operate on models that actually make sense.

Proton VPN Free is subsidized by the paid tiers of a company whose entire brand is privacy, headquartered in Switzerland, with published audits and a genuinely unlimited free tier that's deliberately slow enough to nudge you toward paying. That's an honest business model.

Cloudflare's WARP (1.1.1.1) isn't a full VPN in the classic sense — it doesn't hide your IP from every site — but Cloudflare's business is selling infrastructure to websites, not selling your data to advertisers, and their track record on transparency reports is publicly documented.

Both have real limitations, and I'd still tell most people that a paid plan from a reputable provider costs less than two coffees a month. But if "free" is a hard requirement, these are the two I'd hand to a family member.

The Uncomfortable Takeaway

The free VPN economy works because privacy feels abstract until it isn't. Nobody reads the privacy policy — I barely wanted to, and it's literally my job this week. But the pattern is consistent enough to state plainly: if a service is free, unlimited, and heavily advertised, the business model is you.

Check the parent company. Check who audited the no-logs claim. And if the app shows you an ad for a mobile game while it's supposed to be encrypting your traffic, maybe ask who's really on your side of the tunnel.