Free VPN apps are an easy yes. They cost nothing, install in seconds, and the Play Store has hundreds of them promising to hide your traffic from everyone. We’ve all used them from time to time, myself very much included.

Numerous bits of research suggest that we really shouldn’t be using them, though. Not just one or two security articles: multiple pieces of research over the course of a decade keep telling us that most free VPN apps, especially on Android, aren’t nearly as secure as they want you to think.

It’s all about data leaks from apps claiming to protect your privacy. And while “leak” is doing some heavy lifting in some places, in others, it’s undercooking the issue with free VPN apps.

Your free Android VPN is probably leaking your data

“Leak” is broad, mind

Android VPN apps have long come under huge scrutiny. With thousands of free VPN apps on Google Play, it’s almost inevitable that some won’t be up to scratch, but the severity is alarming across a huge number of apps.

Furthermore, many free VPN apps have shady ownership structures designed to hide the true owners and where they’re based, tying directly into these VPN apps playing fast and loose with your private data.

MVPNalyzer

A 2026 study [PDF] at the University of Michigan, the University of New Mexico, and IIT Delhi analyzed 281 free VPN apps using a testing rig called MVPNalyzer with devices running Android 14.

Of the 281 apps, 29 sent traffic outside the VPN’s encrypted tunnel, which is the one job a VPN has. Another 61 sent at least some data in plain text, readable by anyone watching the network. And 246 of them, more than 80%, contacted known advertising or tracking servers. Seventy-six sent the phone’s advertising ID, and one sent exact GPS coordinates.

The apps with problems have been installed more than 2.4 billion times combined.

Proton’s 7,000 app study

In August 2026, Proton announced the conclusion of a “months-long survey of over 7,000 mobile VPN apps around the world,” finding that 85 percent of all VPN apps downloaded in the US contain trackers, and a quarter actively track your physical location.

Furthermore, Proton found that 64 of the 390 VPNs downloaded from Google Play and the Apple App Store in the US have Chinese ownership. Given that Chinese companies are legally bound to share data with the government, this raises an additional security and privacy issue that many folks are unaware of.

On top of that, 31 of those companies actively attempt to hide that connection. Ownership structures route through various shell companies hosted in the UK, Hong Kong, Singapore, and others.

US-based VPN users downloaded the 64 Chinese-owned apps more than 3 million times in one month, with hundreds of millions of total downloads.

That’s absolutely not all, either

The MVPNalyzer and Proton research aren’t outliers, though.

• In 2024, VPN review site Top10VPN tested the top 100 free VPN apps on Google Play, and found 88 with some form of data leak.
• In 2025, Zimperium’s security team analyzed about 800 free VPN apps across Android and iOS in 2025 and found a substantial share with security and privacy problems, including permissions a VPN has no business asking for (it didn’t name the apps, which limits how useful that one is to you).
• Also in 2025, Citizen Lab and Arizona State University found three families of Android VPNs with more than 700 million combined downloads that looked like separate brands but shared code and hard-coded passwords, the kind that would let an attacker decrypt their users’ traffic.
• Back in 2016, a CSIRO, Berkeley, and UNSW study [PDF] of 283 VPN apps found about three-quarters used third-party tracking libraries.

There are many more examples and studies, and these are only the apps leaking data. Other free VPN apps are active malware campaigns designed to steal more than your location data.

Sometimes, the free VPN is malware

Way more than you bargained for

Credit: Google

Sometimes, the data leaks aren’t malicious. They’re down to poor programming practices, broken protocol implementations, and so on. But sometimes, free VPN apps are just straight-up malware, trying to steal your banking information, account logins, and so on.

In these cases, the free VPN app is bait. A prime example is IPIDEA, a huge residential proxy network that controlled millions of individual devices worldwide, most of which were used in botnet attacks.

Credit: Google

In late 2025, Google revealed it had acted to take down IPIDEA, counting hundreds of infected apps, while also acting as cover for other threat groups. Many of the devices were infected using malicious free VPN apps, though IPIDEA also paid developers to embed its code in their apps to further its reach.

IPIDEA is far from the first threat to use the allure of a free VPN to haul in victims.

For example, in 2024, HUMAN Security found 28 Google Play apps, most of them disguised as free VPNs, that turned phones into proxy nodes without the owner’s knowledge, with about 3 million downloads between them. The code came from a “monetization” kit called LumiApps, which lets anyone upload an existing app and get a proxy-enabled copy back.

Also in late 2025, we reported on an IPTV VPN app combo spreading malware. First reported by Cleafy, this free VPN and IPTV app was designed to steal your financials and other logins, then send them back to a control server for exploitation.

Not every leak is a leak

A consistent drip?

The definition of what qualifies as a leak has to be considered. The numbers above on face alone are fairly terrifying. But in many cases, it depends on what the study actively considers a leak, and the severity of that leak in general.

Case in point, many of the studies include DNS leaks in their data, as they should. Your data is still leaking, and the app isn’t performing as it should. But your VPN letting the sites you visit slip isn’t quite the same as having someone stealing your passwords and reading your messages.

Similarly, the ramifications of tracking significantly vary. MVPNalyzer saw more than 80% of apps contact ad or tracking servers, but contact isn’t a sale. Seventy-six sent the advertising ID, which is worth caring about, and one sent exact GPS coordinates, which is worth a lot more. Neither is the same as proof that your browsing history is being sold.

Then there’s the snapshot problem. These tests capture one app version on one phone at one moment. When MVPNalyzer’s researcher re-checked the five apps vulnerable to tunnel hijacking, a flaw that lets an attacker on the same network redirect your traffic, two had been fixed, and three had not.

So “probably leaking” holds up, and “probably harvesting your data” doesn’t, at least not from these studies alone. The apps that clearly deserve the stronger language are the ones sending plain-text traffic, shipping shared passwords, or renting out your connection.

Stick with the trusted names

There are good free VPN apps. The general advice around VPNs is that you should always pay for a VPN, because it’s someone you’re trusting with your data, and I largely subscribe to that.

Equally, if you’re using a free VPN app from one of the larger, better-trusted VPN companies, you should be fine. Proton VPN Free, Windscribe, and Surfshark are all good options and will keep you safe and private online without having to worry that you’re losing or leaking data.

Otherwise, be wary of free VPNs. That’s not “be wary of free VPNs that offer more than they should.” I mean, you absolutely should be wary, but free VPNs in general need closer scrutiny. Taking a minute or two to research the app you’re about to download and trust with your privacy can make all the difference.

Logging policy

No logs

Mobile app

Yes

Encryption

AES-256 or ChaCha20