Your browsing metadata — IP address, connection times, sites visited, device fingerprints — is collected and sold to data brokers and advertisers. Even when your traffic itself is encrypted, the metadata remains commercially valuable. Top10VPN audits found advertising SDKs present in nearly half of these apps, and the SDK integration is intentional, not accidental. The privacy policy usually discloses it as “sharing with partners”.

Your device and internet connection become an exit node in a commercial proxy network. Paying enterprise clients — often scraping companies, ad-fraud researchers, or worse — route their traffic through your IP address. Hola VPN used this model with 152 million users, monetized through its sister company Luminati (now Bright Data). In 2015, Hola users unknowingly participated in a DDoS attack against 8chan, and the fallout ended with users learning that illegal activity routed through their home IP could appear in law enforcement logs as coming from them.

Some of these apps modify your web traffic to inject advertisements that weren’t originally on the page. This requires breaking HTTPS encryption — actively making your connection less secure than if you had used no VPN at all. The injected code frequently includes tracking scripts and affiliate links, so you’re not just seeing ads: you’re also being tracked by the same VPN you installed to prevent tracking. Security researchers have documented this pattern in dozens of apps.

A CSIRO study found that 38% of free Android VPN apps contain malware signatures — a mix of adware, trojans, riskware, and cryptominers that mine cryptocurrency using your device’s CPU. Zimperium’s 2025 Mobile Threat Report found VPN apps requesting permissions to access device accounts and system logs, which enables keylogging across every installed app. Some exported app activities without proper permission checks, allowing external attackers to inject malicious configuration profiles remotely.

Over 6% of audited iOS VPN apps sought persistent GPS tracking and deep OS access far beyond what a tunnel application justifies. On Android, apps requested permission to add and alter device accounts — enabling hijacking of authentication tokens for banking apps. The goal is not just tracking. It’s account takeover. Some VPNs also exported app activities without permission checks, so a separate malicious app already on your phone could pipe commands through the VPN and gain access to your banking sessions.

Google blocked 1.75 billion malicious apps from the Play Store in 2025 and permanently banned 80,000 developer accounts, scanning 350 billion apps daily. And the problem persists — because the economics haven’t changed. The “Free Unlimited VPN” Chrome extension was removed in May 2025 after years of documented data theft. By July 2025, a rebuilt version — described by LayerX Security as “notably more advanced and evasive” — was back on the Chrome Web Store.

One high-speed VPN node in a major market costs $400/month. Bandwidth for ten thousand users adds another $1,200. Staff, security audits, and cross-platform development push annual costs into the millions. NordVPN reportedly spends over $50 million per year on infrastructure alone. Better app store reviews don’t change that math. Only a legitimate business model does — and the only legitimate free VPN model is a loss leader funded by paying premium subscribers.

Turns your device into a residential proxy exit node, monetized via Luminati / Bright Data. Traffic from paying enterprise clients (including scrapers and, historically, DDoS operators) routes through your home IP. The 2015 8chan DDoS incident remains the canonical warning.

The CSIRO Android VPN study found Betternet embedded 14 different tracking libraries — the highest count in the sample. Even with the app functioning as advertised, the tracker payload is doing more work than the tunnel.

Psiphon explicitly states data sharing with advertisers in its privacy policy. TouchVPN logs IP, location, and visited sites via cookies and tracking pixels. Any VPN from a developer with no listed team, no jurisdiction, and no independent audit falls into the “assume worst-case” category by default.

If you have a free VPN installed that you can’t verify — no known company behind it, no audited privacy policy, no clear business model — delete it now. The data collection may already be complete, but stopping ongoing collection is the first priority. Then check the app’s permissions and revoke anything excessive.

Before installing any VPN, find the pricing page. If there’s no paid tier — or if the free tier is “unlimited everything” with zero visible revenue source — that service’s revenue is coming from your data. No legitimate company operates high-bandwidth global server infrastructure for free out of goodwill.

ProtonVPN’s free tier is the only legitimately safe free VPN in 2026. Swiss jurisdiction, no ads, no data caps, funded by premium subscribers. Same WireGuard-based infrastructure as paid plans, multiple independent audits. Speeds are limited, but the privacy is real and the business model is honest.

A VPN needs network access. It does not need access to your contacts, camera, microphone, phone call logs, location when the app is closed, or device account management. On Android: Settings → Apps → [VPN name] → Permissions. On iOS: Settings → Privacy. Revoke anything that isn’t directly tunnel-related.

Surfshark runs roughly $2.19/month on a two-year plan with unlimited simultaneous devices — one subscription covers your entire household. NordVPN is around $3/month with Deloitte-audited no-logs verification and RAM-only server infrastructure. The cost of a paid VPN is less than one coffee. The cost of your data being sold to brokers is incalculable.