Why free VPNs are not free

Running a VPN costs real money. Servers, bandwidth, staff. A service with millions of free users is spending a fortune, so the money is coming from somewhere, and it is worth knowing where before you route everything you do through it.

We sell a paid VPN, so read this with that in mind. It is still true.

The four business models

Selling your browsing data. The thing you installed to stop people watching what you do, doing exactly that. This is not hypothetical: several large free VPNs have been caught at it, and at least one was quietly owned by an analytics company whose actual product was the data.

Selling your bandwidth. Some free VPNs enrol your device as an exit point for other people's traffic. That means strangers' activity comes from your home connection, with your name on it. One well-known free VPN did this for years, and part of that network ended up being used for a botnet.

Advertising, injected. Adverts inserted into pages you visit, which requires the ability to modify your traffic. Whoever can do that can do other things.

A loss-leader for a paid tier. The honest one. The free version is genuinely limited — a few gigabytes, a few countries — and exists to sell you the paid one.

The honest exceptions

Some free options are funded properly and are worth knowing about:

• Proton VPN's free tier. Funded by paid subscribers, no data selling, no bandwidth limit. Fewer

countries and slower. A genuinely reasonable free option.

• Your employer's VPN, for work things, on a work device.
• Tor, which is not a VPN and is funded by grants. Slow, and the right tool for a narrow set of

situations.

What to check before trusting any of them

• Who owns it. Follow the corporate ownership, not the marketing. A chain of holding companies

is itself an answer.

• What they earn from. If there is no paid tier and no advertising, the product is you.
• Where they are registered. It determines what they can be compelled to hand over.
• Whether anyone independent has looked. A published audit by a named firm is worth something.

"No logs" written on a homepage is worth nothing.

The honest summary

A free VPN is fine for the thing everyone actually uses it for: getting past a hotel network's nonsense for ten minutes. For anything you would mind a stranger reading, the question is not whether it is free, it is who is paying and for what.

And if you are only worried about the café network, remember that HTTPS already covers most of it. We would rather tell you that than sell you something on a fear that has half expired. There is more in is public Wi-Fi actually dangerous.