Is a Free VPN Worse Than No VPN?

By Ken Hollow, who was asked why the free one and the paid one aren’t the same thing if they have the same picture of a shield

“Ken. I found a free VPN.”

“Which one?”

“It has four million downloads and a shield on the icon.”

“That’s not a name, Nana.”

“It’s a vibe, Ken, and the vibe is security.”

The Structural Problem, Before Any Research

Start with what a VPN actually does, because the marketing obscures it.

A VPN encrypts your traffic and routes it through someone else’s server. Your ISP then sees only an encrypted connection to that server. What it does not do is make your traffic invisible — it relocates visibility. The VPN provider now occupies exactly the position your ISP had, with the same view of every site you visit. We covered this in what your internet provider can see.

So choosing a VPN is choosing who to trust with that view. That framing makes the free-versus-paid question obvious.

Running a VPN is genuinely expensive — servers, bandwidth, and staff. A company giving that away to millions of people is covering those costs somehow. The realistic options are advertising, selling usage data, injecting trackers, or upselling to paid tiers. Only the last is harmless, and it can’t fund a large free user base alone.

This isn’t cynicism, it’s arithmetic. If you can’t identify how a service pays for expensive infrastructure, that’s the finding.

What the Research Actually Found

The most-cited study here is a 2016 analysis by researchers from CSIRO, UC Berkeley’s ICSI, and UNSW, which examined 283 Android VPN apps. Its published findings were poor across the board: around 38% contained something flagged as malware by antivirus engines, roughly 84% leaked traffic, about 18% didn’t meaningfully encrypt the tunnel at all, and roughly three-quarters embedded third-party tracking libraries.

One honest caveat, because it matters: that study is now a decade old, and the app stores have tightened review since. Treat the specific percentages as a snapshot of that period rather than a precise description of today’s market.

What hasn’t changed is the economics underneath it. The reason those apps behaved that way was that free VPNs need revenue, and traffic is the asset they hold. That incentive is identical today.

The other durable finding worth keeping: a meaningful share of those apps did not properly encrypt traffic while presenting themselves as privacy tools. An app that claims protection while providing none is genuinely worse than no VPN — because you behave as though you’re protected.

Why “Worse Than Nothing” Is Fair

Three reasons, in order of how much they matter.

False confidence changes behaviour. Someone who believes they’re protected will log into their bank on hotel WiFi. Without the VPN they might have waited. The tool caused the risky behaviour.

You’ve moved data to a less accountable party. Your ISP is a regulated company with a legal address and a reputation. An anonymous free VPN app is often none of those things and may be based somewhere with no meaningful privacy law. You swapped an imperfect known party for an unknown one.

The app has deep access to your device. A VPN app necessarily has permission to intercept all your network traffic. That’s an enormous amount of trust to grant something you downloaded because it had a shield icon.

When Free Is Genuinely Fine

Two real cases, and they share a trait: you’re not relying on it for privacy.

The free tier of a reputable paid provider. Several well-regarded VPN companies offer limited free tiers — capped data or fewer server locations — as a funnel toward subscriptions. The business model is legible: they want you to upgrade. Their privacy practices, audits, and reputation apply to free users too. This is a genuinely reasonable option, and the data cap is the honest price.

When privacy isn’t the point at all. If you’re using a VPN to appear in another country for something trivial, and you’d be entirely relaxed about that traffic being logged, the risk calculus is different. Just don’t do anything sensitive through it.

The rule that follows: if you’d be uncomfortable with the VPN company having a full list of what you did, don’t use a VPN you can’t identify and evaluate.

What to Do Instead, If You Don’t Want to Pay

Often the honest answer is that you don’t need one.

HTTPS already protects your content. Essentially the whole web is encrypted now, which is why the old advice about public WiFi being dangerous has softened considerably — as we covered in whether public WiFi is safe. On a coffee shop network, HTTPS is doing most of the work a VPN would.

Use cellular data. If you don’t trust a network, don’t use it. Your mobile connection is a reasonable default, free, and requires no third party.

Turn on encrypted DNS. Built into Chrome and Firefox, hides your domain lookups from the network, costs nothing.

Or pay for a good one. If you have a genuine need — avoiding ISP profiling, a hostile network, or travel in a country with heavy monitoring — a reputable paid VPN costs a few pounds a month. Our guide on whether you actually need a VPN covers how to evaluate one, and the short version is: independent audits, a clear jurisdiction, a named company, and a business model that’s obviously your subscription.

TL;DR

Usually yes, worse. A VPN doesn’t hide your traffic — it moves who can see it, from your ISP to the VPN company. Running one is expensive, so a free service is funding itself somehow, and your traffic is the asset it holds. A widely cited 2016 study of 283 free Android VPN apps found large shares containing malware, leaking traffic, or embedding trackers; the percentages are dated but the economics driving them aren’t. The real harm is false confidence: believing you’re protected changes what you’re willing to do. Free is fine in two cases — the limited free tier of a reputable paid provider, or when privacy genuinely isn’t your goal. Otherwise, rely on HTTPS and cellular data, or pay for an audited provider.