The old line says that if a VPN is free, you are the product. That is catchy and only half true. Some free plans exist because a paid service wants you to try the app and upgrade later. Other free apps fund themselves with ads, data sharing, or revenue streams they will not describe. A free VPN can be worth using. The price tag is just the least useful fact on the page.
Engadget’s Novak Božović put that distinction at the center of a September 2026 explainer. The useful question is not “free or paid.” It is whether you can see how the company gets paid, what it collects, and what the free plan is quietly withholding.
What a VPN is actually doing
A virtual private network sends your traffic through an encrypted tunnel to a server you chose. Sites and services usually see that server’s address instead of yours. Your internet provider or the café Wi-Fi operator sees a scrambled stream instead of a list of destinations. That is useful. It is not anonymity.
Logged-in accounts, cookies, GPS, and browser fingerprints can still identify you. A VPN moves trust from your ISP to the VPN company. If that company is careful, you have improved the situation. If it is not, you have only changed who can watch.
Why free can get expensive in other ways
Every VPN can add latency or slow a connection. Free plans often make that worse with speed caps, smaller server lists, and hard data limits. Streaming sites, workplaces, and some banks already block VPN ranges. Fewer free servers means fewer ways around a block when one exit gets banned.
Privacy is harder to judge from the app icon. A VPN sits in a privileged place: your traffic passes through it. The Federal Trade Commission has warned for years that some free VPN apps make money through advertising or by sharing information with third parties. Hiding destinations from your ISP does little good if the VPN itself is the new observer.
That concern is not theoretical. A 2026 NDSS study of 281 Android VPN apps found serious gaps: 29 leaked traffic outside the tunnel, 61 sent some data unencrypted, and 76 transmitted Android Advertising IDs that can be used for tracking. The study covered Android only, so the numbers do not map cleanly to every platform. They do show that a green “connected” badge is not proof the connection is being handled honestly.
Sometimes the risk starts before any tunnel exists. Malware posing as a free VPN tool has become a recurring pattern. A real VPN also does not replace antivirus, a password manager, or common sense. Encryption protects the path to the server. It does not stop malware on the device or a phishing page you typed a password into.
How to tell if a free plan is worth the trade
Start with the business model. A limited free tier attached to a paid subscription has an obvious funding path. The company can restrict servers, speed, or monthly data and still survive without turning free users into inventory. Unlimited free usage from a provider that will not explain ownership or revenue is a louder warning than a data cap.
Next, look for things you can verify. Ownership should be clear. The privacy policy should say what is collected and why. A recent independent security audit is stronger than a “no logs” slogan on a pricing page. Guidance from groups like the Electronic Frontier Foundation keeps landing on the same checklist: data practices, ownership, and audits beat marketing claims.
Then check how the connection is secured. Established protocols such as WireGuard and OpenVPN give you something concrete to evaluate. A provider that will not name its technology leaves you guessing. A kill switch matters too. If the tunnel drops, traffic should stop instead of quietly leaking onto the open network.
Data caps, fewer locations, and paid-only extras are honest compromises. You can see what you are not getting. The risky kind of free is the one that promises everything while making ownership, logging, and revenue hard to find.
The practical answer
A free VPN can be worth using for light privacy on public Wi-Fi, for testing whether you even want a tunnel day to day, or for a short trip where a paid plan would be overkill. It is a poor fit if you need reliable streaming, high data volumes, a wide server map, or a company you can trust with everything you browse.
Treat free as a trial with limits, not as a permanent privacy strategy. Prefer a freemium brand that also sells subscriptions, names its protocols, publishes a readable privacy policy, and has been audited. Leave the unlimited mystery apps alone. “Connected” is easy. Knowing who is on the other end of the tunnel is the part that actually matters.
