Why You Should Not Use a Free VPN (and Why Proton Is the Exception)
Why You Should Not Use a Free VPN (and Why Proton Is the Exception)
Most people should not use a free VPN, because the typical free VPN funds itself by monetising the browsing data it was hired to protect. Server capacity costs real money, so a provider charging nothing has to recover it from advertising, analytics partnerships or outright data brokerage, and academic scrutiny of free mobile VPN apps has repeatedly turned up malware signatures, absent encryption and traffic-modifying proxies. Proton’s free tier is the exception because it is cross-subsidised by paid subscribers instead of monetised through you. It carries no adverts, keeps no logs, and ships the same open source, independently audited apps as the paid plans. What you trade away is capacity and features, never privacy.
This page is part of the Proton VPN FAQ Hub.
How does a free VPN actually make money?
A free VPN carries the same costs as a paid one: bandwidth, server hire, app development, support staff. If nobody is paying the bill directly, the money arrives from somewhere less obvious, and the provider’s position in the middle of your connection makes several of those options unusually lucrative. A VPN sees every destination you visit, which is precisely the dataset advertising firms pay well for.
The common models are variations on a single idea, and none of them sit comfortably with what a VPN is sold as. Recognise any of these in a provider’s privacy policy and you have your answer about who the customer really is.
- Selling connection records or browsing data to brokers and advertising networks
- Injecting adverts, or rewriting pages to route shopping traffic through affiliate partners
- Bundling third-party tracking libraries into the mobile app itself
- Reselling your idle bandwidth as residential proxy capacity to other companies
- Running the free app purely as a sales funnel, with the tunnel barely maintained
What researchers found inside free VPN apps
The most cited work here is still the 2016 measurement study of 283 Android apps that requested the VPN permission, carried out by researchers at UNSW, CSIRO, Berkeley and Macquarie. Roughly 38% carried signatures that antivirus engines flagged as malware, around 18% did not encrypt the tunnel at all, and a meaningful share deployed non-transparent proxies that modified traffic in transit, including JavaScript injection for advertising and tracking.
The study is old enough to need caveats, and app store review has tightened since. The structural point has not aged, though. Nothing about publishing a VPN app obliges you to build a working VPN, and users have no practical way to analyse what the tunnel does with their packets once it leaves the handset. Investigations by security researchers and consumer press since have kept finding the same behaviour at the free end of the market.
Weak encryption is worse than no VPN at all
A leaking or unencrypted tunnel does more damage than no VPN, because it changes your behaviour. People connect to a free VPN and then do things on public WiFi they would otherwise avoid, on the assumption they are covered. If the app leaks DNS queries, or quietly falls back to an insecure protocol, that assumption causes real harm.
You have also moved your trust rather than removed it. Without a VPN, your internet provider sees where you go. With one, the VPN company does instead. That swap only makes sense when the provider is more trustworthy than your ISP, which is why what a VPN records about you is the first thing to check, and a business whose entire revenue depends on knowing where you go is a poor candidate for the job.
Why Proton’s free tier is structured differently
Proton’s free plan is paid for by people on Plus and Unlimited subscriptions, which is why it can be free without a catch, and Proton states as much directly on its own blog. There are no adverts in the apps, no third-party tracking libraries, no data sold and no separate weaker codebase for free users. Free and paid run identical clients, which are open source and have been through independent audits published by the company.
The corporate structure matters as well. Proton is Swiss, majority controlled by a non-profit foundation, and its commercial motive is to convert free users into paying ones instead of monetising their traffic. That is a business model and you should read it as one, but it points in the same direction as your privacy rather than against it. Anyone who eventually upgrades to Proton VPN Plus is funding the free tier for everybody else.
How to check a free VPN before you install it
The checks that separate an honest free VPN from the rest are boring and quick. None of them need technical skill, and all of them come back to who is behind the app and where the money comes from. Spend five minutes on this before you hand a company your entire browsing history.
If a provider cannot answer the funding question in one plain sentence, assume the answer is you. That single test clears out most of the free VPN market on its own. BAIZAAR puts every VPN it covers through the same five minutes.
- Find the funding model stated in plain English on the site, not buried in the privacy policy
- Check for a published independent audit of both the apps and the no-logs claim
- Check whether the client source code is public and actually maintained
- Look up who owns the company and which jurisdiction it answers to
- Search the privacy policy for the words advertising, partners and third parties
- Treat any free VPN that pushes adverts into your session as monetising your traffic
The exception costs £2.39 / $2.99 / €2.99 per month, and it pays for everyone else’s free plan.
Proton VPN Plus on the 2-year plan is 70% off the £7.99 / $9.99 / €9.99 monthly price, billed £57.36 / $71.76 / €71.76 for 24 months. 10 devices, 20,000+ servers, 140+ countries, 30-day money-back guarantee.
Get Proton VPN Plus for £2.39 / $2.99 / €2.99 per month on the two year plan, a saving of 70%. Prefer a shorter commitment? The one year plan runs £3.19 / $3.99 / €3.99 per month.
Pricing shown in GBP / USD / EUR, taken from Proton’s partner offer page on 23 August 2026. The two year plan is billed £57.36 / $71.76 / €71.76 up front and renews at the standard rate. Affiliate link: BAIZAAR may earn a commission at no extra cost to you.