In 2024, the U.S. Federal Trade Commission took action against Avast over allegations that it sold consumers’ browsing data through a subsidiary — data that had been collected by security products people installed to protect themselves. The lesson lands hard for anyone shopping for a free VPN: the word “free” is not a price tag. It is a business model, and you need to know who is paying for it.
This guide explains how to separate a genuinely safe free VPN from one that quietly monetizes you, which services have earned a reasonable level of trust, and the practical checks that take about ten minutes before you install anything.
Why “Free” Is the Most Important Word to Scrutinize
A VPN runs servers, buys bandwidth, and pays engineers. None of that is free. So when a provider offers a no-cost tier, the money comes from somewhere. In practice, there are only a handful of models:
- Ads and upsells. The free tier exists to push you toward a paid plan. This is the most benign model.
- Data collection and sale. Browsing data, DNS queries, or app usage get packaged and sold to brokers. This is the model regulators have started punishing.
- Bandwidth resale. Your device becomes an exit node for other users, so strangers’ traffic leaves the internet through your IP address. Hola VPN’s free tier became the textbook example of this around 2015, and it is the single most dangerous free-VPN design.
- Freemium limits. Free users get fewer servers, slower speeds, and a data cap, but the provider’s paid subscribers fund the infrastructure.
Only the first and last models are compatible with a VPN that is actually safe. Your first job is figuring out which one you are looking at.
The Red Flags That Should End the Conversation
Before downloading anything, run through this screen. If a provider trips more than one of these, walk away.
- No named company or physical address. A legitimate VPN operator has a registered business entity and a jurisdiction you can look up.
- A vague or missing logging policy. “We respect your privacy” is marketing. You want a written policy that states exactly what is collected, what is not, and for how long.
- Free tiers that request unusual permissions. A VPN needs network access. It does not need your contacts, SMS, or accessibility controls.
- “Military-grade encryption” with zero technical detail. Real providers publish their protocols: WireGuard, OpenVPN, IKEv2. Marketing-only language is a tell.
- No transparency report and no audit history. Serious operators publish both.
- Peer-to-peer or “shared bandwidth” language buried in the terms. Read the fine print on how the free tier is subsidized.
If you are installing on Android and want a structured safety check for the installer file itself, there is a solid walkthrough on how to check whether an apk file is safe that covers signature verification and permission review — worth reading before you sideload anything from outside an official app store.
What Independent Audits Actually Prove
The phrase “no-logs VPN” is self-reported. Anyone can type it on a website. What changes the equation is an independent audit — a third-party firm inspecting the provider’s servers and code to confirm that logging claims match reality.
Two caveats matter enormously here:
Audit dates matter more than audit existence. An audit from four years ago does not cover infrastructure built last year. Look for the most recent report and check what was in scope.
Scope matters. Many audits cover only one product (say, the Windows app) or one claim (say, the server configuration). A provider that is transparent will tell you exactly what was and was not examined.
Firms like Cure53 and Deloitte are commonly named in these reports. When a provider links its audit directly from its own site, that is a good sign. When it merely mentions “audited” in a blog post with no document attached, treat the claim as unverified.
Jurisdiction and Ownership: The Quiet Risk
Where a VPN company is based determines which laws can compel it to hand over data. Switzerland, Panama, and the British Virgin Islands are popular for a reason: they sit outside major intelligence-sharing agreements. That does not make a provider trustworthy on its own, but it removes one category of risk.
Ownership is the other half. VPN companies get acquired, and acquisitions can silently change logging practices. A service that published a strict no-logs policy in 2019 may have a different parent company today. Before you commit, check who owns the service now and whether the privacy policy has been revised since the last audit. This is the kind of diligence most users skip, and it is exactly where trouble hides.
Free VPN Options With a Defensible Track Record
No free VPN should be treated as a guarantee of anonymity. But a few have earned a reasonable reputation based on published policies, independent audits, and transparent business models. Terms change frequently, so verify current limits on each provider’s site before relying on any figure below.
| Provider | Free Tier Model | Notable Strength | Watch Out For |
|---|---|---|---|
| Proton VPN | Unlimited data, limited servers and speed | Swiss jurisdiction, no ads, published no-logs audit history | Few free server locations; speed throttled |
| TunnelBear | Monthly data cap (historically ~500 MB) | Published third-party audits, simple interface | Cap is tiny for streaming |
| Windscribe | Monthly data cap (historically ~10 GB with email) | Generous cap, Canada-based, published transparency reporting | Fewer free locations; account required |
The common thread: all three fund the free tier through paid subscriptions, not data sales. None of them route your traffic through other users’ devices. That combination is the baseline for “actually safe.”
Proton VPN has offered a free tier since 2017 and is frequently cited as the strongest free option because it imposes no data cap and runs no ads. TunnelBear and Windscribe cap data instead. Which trade-off is better depends on whether you need volume or discretion.
What a Free VPN Can and Cannot Do
This is where expectations go badly wrong. A safe free VPN changes your IP address and encrypts traffic between your device and the VPN server. That is it. It does not:
- Stop browser fingerprinting, which can identify you without any IP address
- Protect you from malware you install yourself
- Hide your identity when you log into accounts tied to your real name
- Make you anonymous to the VPN provider itself
Understanding the boundary between a VPN and a proxy helps too — they are frequently confused, and the difference affects what protection you actually get. A clear breakdown of VPN vs proxy and what the difference is is worth five minutes if you are unsure which one you need.
For most people, the realistic use case for a free VPN is: securing traffic on public Wi-Fi, accessing a region-locked page occasionally, and adding a layer of privacy from your ISP. It is not a tool for evading a determined adversary.
Practical Setup: What Actually Works in Practice
The mistakes people make with free VPNs are remarkably consistent. Here is what experienced users do differently.
Install from the official source only. Third-party APK mirrors and “modded” VPN apps are a leading vector for malware. If you must sideload, verify the file first — the guide on what an apk file is and whether it is safe covers what to inspect.
Turn on the kill switch before you need it. A kill switch drops your internet connection if the VPN tunnel fails. Most users enable it after a leak, which is backwards.
Test for leaks once. Run a DNS leak test after connecting. If your real DNS servers show up, the VPN is not doing its job.
Check the privacy policy revision date. Compare it to the audit date. If the policy changed after the last audit, the audit no longer covers current practice.
Do not reuse a free VPN for banking. Free tiers often have shared IP addresses that trigger fraud flags. Use your normal connection for financial accounts.
Watch for the “free trial” trap. Some apps advertise a free tier but require a card and auto-enroll you in a subscription. Read the cancellation terms before entering payment details.
If you are comparing paid upgrades later, a broader roundup of best VPN services will save you from re-running this whole evaluation from scratch.
Regulatory Pressure Is Changing the Free VPN Market
The FTC’s action against Avast over the sale of browsing data collected by its security products signaled a shift: regulators are now treating “we protect your privacy” as a claim that can be tested in court. That matters for VPN shoppers because the same data-broker economics have long been suspected in the free VPN space. (Use Strong Passwords)
A provider’s willingness to publish a transparency report, submit to audits, and name its ownership now sets it apart; those steps are not a nice-to-have. Providers that operate on data sales tend to be the loudest about privacy and the quietest about specifics.
How to Evaluate Any Free VPN in Ten Minutes
Use this sequence whenever you are considering a new provider:
- Find the registered company name and jurisdiction on the provider’s site.
- Open the privacy policy and search for “log,” “collect,” and “share.” Read those paragraphs in full.
- Look for a linked audit report and check its date and scope.
- Search the terms of service for “peer,” “bandwidth,” and “exit node.”
- Check who owns the company today.
- Read recent user reports about speed and data caps.
If any step produces a dead end, that is your answer. A provider with nothing to hide makes all six steps easy.
For a wider comparison across paid and free options, the best vpn 2025 overview covers the current landscape, and if cost is the binding constraint, the best free vpn roundup focuses specifically on no-cost tiers. Readers who want to sanity-check a download link before clicking should also see how to check whether a link is safe.
Conclusion
There is no free VPN that is safe by default. Safety comes from a specific combination: a business model funded by paid subscribers rather than data sales, a jurisdiction that limits compelled disclosure, a recent independent audit that covers current infrastructure, and a provider that publishes its ownership and policies without being asked.
Proton VPN, TunnelBear, and Windscribe each meet that bar to varying degrees, with different trade-offs between data limits and server access. None of them makes you anonymous. All of them are dramatically safer than the free apps that route strangers’ traffic through your device or sell your browsing history to brokers.
The ten-minute evaluation is the whole game. Check the company, read the policy, find the audit, confirm the ownership. If a provider makes those four things hard to find, that difficulty is the answer to your question.
Frequently Asked Questions
Are free VPNs ever actually safe?
Yes, but only a narrow category: free tiers run by established providers that fund them through paid subscriptions. Proton VPN, TunnelBear, and Windscribe fit this description. The unsafe category is free apps that monetize through data sales or by routing other users’ traffic through your device. The difference is visible in the privacy policy and terms of service if you read them.
Can a free VPN see my browsing history?
Any VPN can technically see the traffic that passes through its servers, which is why the logging policy and independent audits matter. A provider that publishes a recent no-logs audit has submitted to outside verification that it does not retain that data. A provider with no audit and a vague policy is asking you to take its word.
Is a free VPN enough for public Wi-Fi?
For basic protection on public Wi-Fi, a reputable free VPN adds protection that an unencrypted connection does not provide. It encrypts traffic between your device and the VPN server, which blocks casual interception on the local network. It does not protect you from phishing pages or malicious downloads, so normal caution still applies. (Virtual private network)
What is the catch with unlimited free VPNs?
Unlimited data at zero cost has to be funded somehow. Common catches include aggressive ad injection, data collection and resale, bandwidth resale where your device becomes an exit node, or a free tier so slow it functions as an advertisement for the paid plan. Proton VPN’s unlimited free tier is the exception rather than the rule, and it limits server access and speed instead of data.
Do free VPNs work for streaming?
Usually poorly. Free tiers typically have few server locations, congested shared IPs, and data caps that a single video can exhaust. Streaming services also actively block known VPN IP ranges. If streaming is the goal, a paid tier from a reputable provider is the realistic path.
How often should I re-check a VPN’s safety?
At minimum once a year, and immediately after any news of an acquisition, a privacy policy revision, or a regulatory action involving the provider. Ownership changes and policy updates can alter logging practices without any visible change to the app, so the review has to be periodic rather than one-time.
