Why a Free VPN App Can Be a Privacy Risk
A VPN app sends your phone's internet traffic through a server run by the VPN company. That can help in some situations, but it also means the company sits in the middle of everything you do online. With a free VPN, the question to ask is how the company pays for that server, because the answer is sometimes your data or your attention.
- A VPN does not remove trust; it moves it from your network to the VPN company.
- On Android a VPN app uses the system's VpnService, which lets it handle your traffic once you approve it.
- Free VPNs have to be paid for somehow: ads, data or a paid upsell. Read what they say about logging.
- For children, a VPN can also get around content filters and parental controls.
How a VPN app works on Android
Android lets an app set up a virtual network connection through the VpnService class. Once you approve the connection, the app can send your traffic through its own tunnel.[1] That is how legitimate VPNs work, and it is also how a content filter or a security tool can inspect traffic. The key point is that whoever runs the app can see where your traffic goes, even if the contents of secure connections stay encrypted.
What a VPN does and does not do
| A VPN can | A VPN cannot |
|---|---|
| Hide your traffic from the local network, such as a cafe's Wi-Fi | Make you anonymous; the VPN company still sees your activity |
| Hide your IP address from sites you visit | Protect you from a phishing page or a fake app |
| Make traffic appear to come from another country | Stop an app from collecting data on your phone |
Most websites already encrypt traffic, so the cafe-Wi-Fi benefit is smaller than it used to be. See our public Wi-Fi guide.
The problem with "free"
Running servers costs money, so a free service is paid for in some other way. That is not always bad, but it deserves a look:
- Advertising and trackers. The app may carry ad code. See what ad SDKs can collect.
- Logging and selling data. Some services keep records of what you visit. Read the privacy policy for how long and for what.
- A paid upsell. The free tier may be slow or limited to push you to pay.
- Unknown owners. Look for a named company, a real website and clear contact details.
Questions to ask before installing
- Who owns it, and where is the company based?
- What does the privacy policy say about logs?
- Does the app ask for more permissions than a VPN needs?
- How does it make money?
- Does it have a long, steady history and independent reviews, not just five-star ratings?
Use App Checker to see the listing details and permissions in one place, and watch for look-alike names; see how clone apps work.
VPNs and children
A VPN on a child's phone can hide their traffic from a home router or a filter and bypass DNS-based blocks. Many parental-control tools use a VPN themselves to filter content, so a second VPN can clash with or defeat them. If you see an unfamiliar VPN on a child's phone, talk about why it is there. Keep "Install unknown apps" off, and review which apps can set up a VPN connection.
Frequently asked questions
Is a free VPN safe?
It depends on the company. Some free VPNs are run by reputable firms as a trial of a paid service, while others make money from ads or data. Read the privacy policy and check who runs it.
Do I need a VPN on my phone?
Most people do not need one for everyday use, since most sites use encryption. A VPN can help on untrusted networks or for privacy from a network owner, but it is not a general security tool.
Can a VPN app see what I do online?
It can see where your traffic goes and when, and, depending on the setup, can see more. The contents of secure connections remain encrypted, but the metadata is visible to the VPN company.
Can my child use a VPN to get around parental controls?
It can bypass some filters, especially DNS-based ones. Keep installs under parental approval and talk about why the rules exist.
How do I remove a VPN from my phone?
Uninstall the app and check the VPN section in your Android network settings to make sure no connection remains configured.
- VpnService — Android Developers — how Android apps create a VPN connection.
- Google Play Protect — Google Play Help — scanning apps for harmful behaviour.