Are Free VPNs Safe? What Security Research Reveals in 2026

Key Takeaway

• ⚖️ The evidence-based answer: a free VPN app can be safe when a reputable, audited provider runs it as a limited funnel to a paid service — but security research keeps documenting that many free apps fail basic tests. The 2026 academic study MVPNalyzer (NDSS Symposium 2026), which audited 281 popular Android VPN apps from the Google Play Store, found 61 transmitting data without encryption, 29 leaking user traffic (including DNS queries) outside the tunnel, and 76 sending the device’s Advertising ID. The safety of a specific app depends on the provider’s practices, not the price tag, so the decision comes down to evaluation, not the free-vs-paid label alone.
• 🔒 What a VPN actually does: it encrypts traffic between your device and the VPN server, and it moves that server’s operator from the position of local network or ISP visibility to a position of trust. A VPN cannot stop phishing, malware, account compromise, or the website tracking that rides on cookies and advertising identifiers — those protections come from HTTPS, updated devices, and account security, which the research and government guidance treat as the real first line.
• 📊 What the numbers really say (and their provenance): the “40% of Android free VPN apps leak data” figure comes from ProPrivacy’s September 2020 study of top free Google Play apps, not from the security firm Zimperium; the “about 60%” figure is Zimperium zLabs’ own October 2025 analysis of roughly 800 free Android and iOS apps, reported by CNET. Both are point-in-time studies of the apps they sampled, not permanent properties of today’s entire market.
• 🛡️ What separates safer providers: a precise published privacy policy, third-party audits with dates and findings, a paid business behind any free tier, a clean permission list, current cryptographic libraries, and independent verification of infrastructure claims. Consumer Reports’ VPN testing ranked Mullvad, IVPN, and Mozilla VPN highest on these operational criteria.
• 🧭 The practical decision: use an unvetted free app for nothing sensitive, ever; prefer the free tier of a provider whose paid service is audited; pay when the stakes justify it; consider self-hosting (for example WireGuard on a server you control) only if you will maintain it — it moves rather than removes the trust question.

Table of Contents

Free VPNs sit in a range that runs from legitimately privacy-protecting software to applications that behave like the surveillance they claim to block. That range is exactly why the free VPN risks debate keeps producing dueling headlines: the risks are real and repeated across the research, and so are the exceptions. The research record supports both ends of that sentence, which is why the direct answer to “are free VPNs safe?” is a procedure rather than a slogan: some are, many are not, and the tools for telling them apart are public. This guide covers what the documented studies measured among the free vpn risks — ProPrivacy’s 2020 leak testing of Android apps, Zimperium zLabs’ 2025 analysis of roughly 800 free mobile apps, and the NDSS 2026 study MVPNalyzer that audited 281 popular Android VPN apps — and then explains what a VPN can and cannot protect, how to evaluate a provider, and what to do if an app you installed turns out to deserve suspicion.

Are Free VPNs Safe? The Evidence-Based Answer

A VPN encrypts the traffic between your device and the VPN operator’s server. Everything about the safety question follows from what that relationship actually is: you are not buying encryption alone, you are accepting a new party into the path of nearly everything your device transmits. The operator of a paid VPN answers to subscribers. The operator of a free app answers to whatever funds the app — advertisements, data collection, a paid tier upfunnel by design, or, in documented cases, data itself sold as inventory. The technology carries no inherent safety either way; implementation and incentives carry the actual weight of the decision.

Three studies with three different designs form the current evidence base. ProPrivacy, a VPN review site, tested top free Android apps for leaks in 2020 and found more than 40% leaking. Zimperium zLabs, a mobile security firm, analyzed about 800 free VPN apps across Android and iOS in 2025 and found problems concentrated in code quality, permissions, and data exposure. A University of Michigan and University of New Mexico team published MVPNalyzer at NDSS 2026, auditing 281 popular Android VPN apps with a systematic framework and documenting encryption, leakage, tracking, and configuration failures. None of these studies measured “every free VPN in 2026”; each measured the apps in its own sample at its own time. Read together, they turn the free VPN risks question from folklore into a documented pattern set you can check app by app.

What Security Research Reveals

ProPrivacy, September 2020. ProPrivacy’s leak report found more than 40% of the free Android VPN apps it analyzed in the Google Play Store were leaking personally identifiable information — mostly IPv6 traffic outside the tunnel (about 87% of the observed leaks) — with the affected apps representing around 81.4 million downloads at the time and an estimated 39 million users potentially exposed through IPv6 or WebRTC leaks. It was a point-in-time measurement of the top free apps then on the store, built on leak testing rather than malware analysis. The finding is historical: it does not describe today’s catalog, and it should not be quoted as a current market-wide rate. Its method, automated IPv4/IPv6 and WebRTC leak testing, became a public tool any reader can still apply to their own connection.

Zimperium zLabs, October 2025. Zimperium’s zLabs analyzed approximately 800 unique free VPN apps drawn from the official Android and iOS stores and reported a substantial share exhibiting security or privacy issues; CNET’s report of the study described that share as “nearly two-thirds.” It is Zimperium’s research that CNET reported, worth naming correctly, because the technical detail lives in the firm’s own write-up. Its five documented categories: outdated third-party libraries (three apps still shipped a legacy OpenSSL version vulnerable to Heartbleed, CVE-2014-0160, a nine-year-old bug at publication), communications-channel weaknesses (about 1% of the apps accepted invalid certificates, exposing them to man-in-the-middle interception), misleading or missing privacy labels (on iOS, 25% of the analyzed apps had no valid privacy manifest at all), permission abuse (VPN apps requesting account-management permissions far beyond their function), and ordinary data exposure through those channels.

MVPNalyzer, NDSS 2026, the peer-reviewed academic study, published with its full paper online, by researchers at the University of Michigan and the University of New Mexico, built an extensible auditing framework and applied it to 281 popular Android VPN apps from the Google Play Store. The findings, each a separate category rather than one failure rate: 61 apps transmitted data unencrypted; 5 sent their VPN configuration files in cleartext, which on an attacker-positioned network allows the tunnel connection itself to be hijacked; 29 apps leaked user traffic, including DNS queries, outside the tunnel; 169 apps failed to obfuscate their traffic, making them trivial to block on networks that restrict VPN use; 76 apps transmitted the Advertising ID, the device-unique identifier that ad networks use to track users across apps; and 107 apps fell short of best-practice settings in their configuration files. Collectively the sampled apps represented hundreds of millions of installs. The authors’ conclusion names the structural problem: a VPN app sits in a privileged position, so weak maintenance and poor transparency there move failures from a nuisance class into a trust problem, the same delegated-trust structure our managed-service breach guide examines from the enterprise side.

Earlier context. Academic measurement of Android VPN apps long predates these: a 2016 IMC study by CSIRO researchers analyzed 283 apps and found 18% using tunneling protocols without encryption at all, 38% of the apps using tracking, and frequent IPv6 and DNS leakage, a reminder that the pattern MVPNalyzer documents in 2026 is a decade old and persistent, not a one-year anomaly. Limitations worth stating plainly: these studies sample popular apps on one or two platforms at a point in time; they cannot certify any specific app’s current behavior; and “popular” is a popularity measure, not a quality measure.

The Free VPN Risks the Studies Document

Each documented category translates into a concrete exposure:

• Traffic leaves the tunnel. Apps whose tunnel implementation leaks IPv6 or DNS traffic send some or all requests by the normal network path, visible to the local network and the internet provider the VPN was installed to hide from. ProPrivacy’s 2020 sample and MVPNalyzer’s 2026 sample both documented the class.
• Data travels unencrypted, or the tunnel can be hijacked. MVPNalyzer’s 61 unencrypted-transmission apps and 5 cleartext-configuration apps show implementations where the confidentiality promise fails in transit. A configuration file fetched over an unencrypted channel lets an attacker on the same network replace the server your app connects to.
• Vulnerable libraries ride along. Zimperium’s finding of Heartbleed-vulnerable OpenSSL versions inside shipping apps in 2025 signals absent maintenance; the vulnerabilities those libraries carry are remote-code or memory-disclosure classes.
• Invalid certificates pass. About 1% of Zimperium’s sample accepted self-signed or invalid certificates, the exact failure that lets an attacker sit between the app and its real server and read the supposedly secure channel.
• Permissions exceed function. A VPN needs network access; Zimperium documented apps requesting AUTHENTICATE_ACCOUNTS and similar Android permissions that can add or remove accounts, change passwords, and harvest authentication tokens, capabilities a privacy tool has no reason to hold.
• Identifiers and tracking servers. MVPNalyzer found 76 apps transmitting the device’s Advertising ID, 246 contacting known advertising or tracking servers, and routine collection of phone model, OS version, and screen size, data points that combine into precise fingerprints.
• Misleading labels. On iOS, a quarter of Zimperium’s sample lacked a valid privacy manifest, meaning the store-level description of data use could not be verified against the app’s actual behavior.
• Commercial data plumbing beyond the app. Where app telemetry is aggregated or resold, it feeds the same broker infrastructure the FTC has acted against, in 2024 the agency settled with Gravy Analytics and Venntel and sued Kochava over location-data sales that could trace visits to health clinics and places of worship. Documented cases put brokers in this position; that is the market free app data plausibly feeds, not proof about any specific provider.

Two claims deserve caution rather than repetition. “Free VPNs are insecure” is a generalization the studies support only as a frequency observation, the same NDSS audit includes apps that pass its checks, and providers behind strong paid services run free tiers on shared infrastructure. And resale of browsing data as a business model is documented at specific companies (the FTC’s 2024 settlement ordering Avast to stop selling browsing data without consent is a proven example), it is a documented practice, not something every free app does.

What a VPN Can and Cannot Protect

The clearest framing comes from the MVPNalyzer authors themselves: running a VPN executes a transfer of trust from network intermediaries, your home router, the coffee-shop Wi-Fi, your mobile carrier, to the VPN provider. Encryption moves with the tunnel; trust has to live somewhere.

What a correctly built VPN protects: the content and destination of your traffic as seen by the local network and the ISP; your public IP address; your traffic’s readability on untrusted Wi-Fi; and, on networks that block VPN protocols, its visibility into which service you reach when the tunnel obfuscates its own traffic.

What it does not protect, the list matters more than the marketing: phishing (a fake login page works identically through a tunnel), malware (infections arrive through downloads and exploits regardless of routing), account compromise (a stolen password defeats encryption the account owner holds), website and advertising tracking (cookies, sessions, and advertising identifiers operate inside the tunnel, MVPNalyzer’s Advertising-ID findings show VPN apps themselves transmitting them), and data you hand to services (a site sees whatever you submit once the traffic reaches it). This is why the same traffic that a VPN protects in transit is still largely protected in transit by HTTPS anyway: most websites already encrypt end-to-end, and a VPN adds network-level privacy to that, not encryption where none existed. Banking stays risky on an unvetted tunnel not because the tunnel breaks HTTPS but because a compromised or malicious tunnel operator can observe, redirect, or hijack configuration, and because the operator choice itself is unverifiable exactly when the app fails every other audit test.

How to Evaluate a VPN Provider

The assessment checklist below applies to any provider at any price. None of it requires advanced technical skill except the last item.

1. Ownership and jurisdiction. Who operates the service, under which legal regime, and what is their stated handling of government requests? A named company with a public track record beats an anonymous publisher with a slick app.
2. Privacy policy in specifics. A credible policy names what is logged (connection metadata, bandwidth counters, crash reports), for how long, and what is never recorded. A policy that says only “we never log” without describing the dataset qualifies as marketing.
3. Independent audits. Look for third-party audits or published penetration tests with dates, scope, and the auditor’s name. No-single-audit ≠ malicious; a complete absence of verification across years is a reasonable signal to weigh against claims.
4. Application permissions. On Android, a VPN needs networking and VPN-service permissions; anything like contacts, accounts-management, SMS, or accessibility access demands justification. On iOS, compare the privacy label against the app’s stated function.
5. Business model honesty. For a free tier: what funds it? An obvious paid product, a capped free plan, or anonymous ownership with aggressive ad delivery are very different risk profiles.
6. Technical disclosures. Named protocols (WireGuard, OpenVPN, IKEv2) and documented DNS handling signal a maintained product; legacy protocols alone are a dated implementation.
7. Verification of claims. For a high-stakes decision, test your own connection with the public leak-testing tools ProPrivacy’s report made available, and check independent reviews (Consumer Reports’ VPN testing is the best consumer-level example) rather than the provider’s own comparison tables.

These criteria mirror the NSA and CISA joint guidance on choosing remote-access VPN solutions, standards-based implementations from vendors with a proven track record, even though that guidance targets enterprises. Government guidance, academic audits, and consumer testing converge on the same signal set: who runs it, what they document, and whether anyone independent checked.

Free vs Paid vs Self-Hosted VPNs

Weighing free VPN risks against the alternatives is easier once the three options stop pretending to be the same product. Free tiers from established providers are the legitimate zero-cost option. They are deliberately limited, server count, speed, or data volume, precisely because the company’s revenue arrives from paid subscribers, not from reselling free users. Use them for the low-stakes work (general browsing on untrusted Wi-Fi, location-apparent services) and keep the credential-heavy work inside the same audit checks you applied to the provider. Unvetted free apps, the ones whose only visible business is the free download, are the population every study sampled, and the studies’ findings describe them, not every app with a free plan.

Paid services remove the business-model pressure toward data monetization but carry no automatic privacy. Subscription revenue and an audited no-logs policy are two different properties; a paid subscription changes incentives, not implementations. Consumer Reports’ VPN testing, which ranked Mullvad, IVPN, and Mozilla VPN at the top on documentation quality, data-sharing limits, and research-friendly policies, is the working demonstration that paid providers differentiate on practices, and the same report’s methodology is a template for evaluating whichever service you already use.

Self-hosting, WireGuard on a small server, for instance, changes the trust question rather than ending it. You stop trusting a commercial operator’s policy and start trusting your own configuration, patching, and server provider’s physical security; the server’s IP address identifies you everywhere it appears, and no operator’s audit covers your discipline. Disclosure note: WorldNgayon’s self-hosting walkthroughs are part of a sponsored hosting series; the setup itself works on any server you control. For readers who want the technical route, our WireGuard setup guide documents the process and its maintenance burden end-to-end.

One pattern all three options share: the device and its software. An updated browser and operating system, current applications, and an edge-device security habit protect more daily risk than the tunnel does, the VPN is one control, not the firewall around your digital life.

What to Do If You Installed a Suspicious VPN

If an app shows the documented red flags, ads inside the app, permissions beyond networking, behavior you cannot reconcile with its promises, or its absence from every audit trail:

1. Disconnect it and uninstall it. Turn the VPN tunnel off first (an active suspicious tunnel is the exposure vector), then remove the app.
2. Revoke the permissions it could have used. Android’s Settings → Security & privacy → Permission manager and App battery/permissions; iOS Settings → Privacy & Security. Look specifically at account-related permissions, accessibility, and notification/posting rights.
3. Change passwords you handled while it ran. Priority order: banking and email first, then accounts sharing passwords, then services where you saved credentials in the browser during that period.
4. Check account activity. Review the linked devices and sessions on your most important accounts (email and platform account settings list active sessions) and sign out anything unfamiliar.
5. Reset the network layer. Forget and rejoin Wi-Fi networks to refresh DNS settings, and scan the device with its built-in security tools (Play Protect on Android, the device’s security check-up on iOS).
6. Report it. Google and Apple accept app reports from the store listing, the reports are how the samples of future studies get built.

Ordinary users complete all six steps. Advanced users can add one more: reset the device’s VPN configuration entirely (remove any installed profile or always-on VPN setting the app may have left), which is where persistent tunnels hide after uninstall.

Frequently Asked Questions

Are Free VPNs Safe to Use?

Some are, the documented cases are the free tiers of providers whose paid business is audited and whose policies are specific, and many are not. The NDSS 2026 study of 281 popular Android VPN apps found 61 transmitting data without encryption, 29 leaking traffic outside the tunnel, and 76 sending the Advertising ID, among other findings. Safety depends on the provider’s practices and the app’s implementation, so evaluate rather than assume: policy page, audit record, permission list, funding.

What Are the Biggest Free VPN Risks?

Documented in the research: traffic leaving the tunnel (IPv6 and DNS leaks), data sent unencrypted, cleartext configuration files that enable tunnel hijacking, outdated vulnerable libraries, acceptance of invalid certificates, permissions exceeding the app’s function, transmission of advertising identifiers, and misleading privacy labels. Plausible but app-dependent: telemetry aggregation into the data-broker market the FTC has acted against. The first set is measured; the second is a documented industry pattern to be aware of when a provider’s funding is unexplained.

What’s the Difference Between a DNS Leak and a WebRTC Leak?

A DNS leak sends domain-name lookups outside the VPN tunnel to the default resolver, typically the ISP’s, exposing which sites you visit even though the sites’ content is encrypted. A WebRTC leak exposes your IP address through the browser’s real-time-communication feature, which can reveal your real location to websites despite the tunnel. They fail differently, one leaks browsing destinations, the other leaks your address, and both are testable with public leak-testing tools.

Do Free VPNs Sell Your Data?

Selling browsing or location data is a documented practice in this industry, the FTC settled with Avast in 2024 over browsing-data sales, and its cases against Gravy Analytics, Venntel, and Kochava document the broker market for precisely this kind of data, but no study supports the claim that every free app sells data. The measurable behaviors the studies do document: transmission of advertising identifiers, contact with tracking servers, and privacy-label failures. What a provider does beyond that depends on its disclosures and funding; that is exactly what the evaluation checklist is for.

Are Paid VPNs Always Better Than Free Ones?

Not automatically. A subscription changes the funding pressure, not the engineering quality: paid services still vary on audits, logging disclosures, and configuration hygiene, and the best free tiers come from audited providers. Choose on the evaluation criteria; treat price as a business-model signal, not a security guarantee.

Is a Self-Hosted VPN More Private Than a Commercial One?

It removes the commercial operator from the trust chain and replaces that trust with your own maintenance discipline: you patch the server, you secure the configuration, your hosting provider still sees the server’s traffic patterns, and the server’s IP address follows your browsing unless you take further measures. For readers willing to carry that operational duty, it is a strong option; it is not a maintenance-free upgrade.

@online{agron2026freevpn,
  author       = {Agron, Edmon},
  title        = {{Are Free VPNs Safe? What Security Research Reveals in 2026}},
  year         = {2026},
  date         = {2026-11-08},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/free-vpn-risks/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - Are Free VPNs Safe? What Security Research Reveals in 2026
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/08/
UR  - https://worldngayon.com/free-vpn-risks/
Y2  - 
ER  -