Free vs paid VPNs: what "you are the product" actually means

Why "free" VPNs need to pay their bills somehow

Free VPN services require servers, bandwidth, developers, and infrastructure. A single high-capacity server capable of handling thousands of simultaneous connections costs hundreds to thousands of dollars monthly. Multiply that across dozens of server locations, add staff salaries, customer support, software maintenance, and security audits, and you're looking at millions in annual operating costs for even a modest VPN network.

When you're not paying with money, the service pays its bills by monetizing you. That's not philosophy—it's accounting. The question isn't whether free VPNs monetize users, but how aggressively, how transparently, and whether those methods undermine the privacy you downloaded the VPN to protect in the first place.

The real business models behind "free"

Data harvesting and sale is the most common monetization method. Free VPNs collect browsing history, connection timestamps, websites visited, app usage data, and device identifiers. This data gets aggregated, anonymized (supposedly), and sold to advertising networks, data brokers, or market research firms. You install the VPN to hide your activity from your ISP, but you've simply transferred that visibility to a company with weaker privacy incentives and often zero regulatory oversight.

A 2020 study from CSIRO analyzed 283 Android VPN apps. They found 75% contained tracking libraries from third-party advertising and analytics companies. Many logged DNS queries, HTTP headers, and full URLs despite claiming "no-logs" policies. Several apps contained malware. The free tier wasn't just subsidized—it was the product pipeline.

Aggressive advertising injection goes beyond normal app ads. Some free VPNs inject additional advertisements into websites you visit or replace existing ads with their own affiliate links. They're performing man-in-the-middle attacks on your HTTPS connections—the exact threat VPNs are supposed to prevent. Others redirect search queries through affiliate-laden intermediary pages before showing results.

Upsell funnels represent the least harmful approach. The free tier works as intended but with limitations: slower speeds, data caps (typically 500MB-10GB monthly), limited server selection, or queue-based connections during peak times. The goal is demonstrating value before converting you to a paid subscriber. Services like ProtonVPN use this model—the free tier is genuinely private but functionally limited.

Bandwidth resale turns your device into an exit node for other users' traffic. Your internet connection becomes part of the VPN's infrastructure. You're essentially paying with your bandwidth, electricity, and potentially your IP reputation if another user routes malicious traffic through your connection. Hola VPN openly operated this peer-to-peer model until researchers discovered it was also reselling user bandwidth through a separate company called Luminati.

What data collection looks like in practice

When a free VPN claims "no logs," examine what they're actually promising. Legitimate no-logs policies specify they don't record IP addresses, connection timestamps, traffic destinations, or DNS queries. Many free VPNs hide behind vague language: "We don't log your browsing history" (but we log everything needed to reconstruct it), or "We don't sell personal information" (but we sell anonymized behavioral data).

Check the actual permissions the app requests. Does a VPN need access to your contacts, camera, microphone, or SMS messages? No. Yet many free VPN apps request extensive permissions unrelated to establishing an encrypted tunnel. These permissions enable data collection far beyond your browsing activity.

Look at the privacy policy—specifically who owns the company and where they're incorporated. Multiple free VPN services trace back to Chinese data companies or marketing conglomerates. Several popular free VPNs are owned by Innovative Connecting, a Chinese company that operates approximately 30 different VPN brands. Their privacy policies, when examined closely, reserve extensive rights to collect and share user data.

Jurisdiction matters intensely here. A free VPN operated from a country with weak privacy laws and strong government surveillance has both the motive (monetization pressure) and the means (no legal barrier) to collect and share your data broadly. When you can't identify who actually owns and operates the service, assume the worst.

The technical compromises nobody mentions

Free VPNs operate on razor-thin margins, which creates technical shortcuts that undermine security.

Outdated encryption protocols are common. Modern paid VPNs have migrated to WireGuard or maintain properly configured OpenVPN implementations. Free services often use PPTP or L2TP—protocols with known vulnerabilities that can be broken in minutes by anyone with moderate technical skills. They market "military-grade encryption" while implementing protocols that actual militaries abandoned years ago.

Overcrowded servers mean your traffic shares infrastructure with thousands of simultaneous users. This degrades speeds (often to unusable levels) and creates privacy risks. When hundreds of users share the same exit IP address with insufficient server resources, traffic correlation becomes easier. Paid services typically maintain a user-to-server ratio designed to preserve both speed and anonymity. Free services cram as many users as possible onto minimal infrastructure.

DNS leaks are rarely patched quickly. When your VPN connection drops, does your traffic automatically route through your ISP unencrypted, exposing your real IP address? Quality VPNs implement kill switches and DNS leak protection as standard features. Free VPNs frequently skip these safeguards because proper implementation requires engineering resources they haven't allocated.

Test this yourself: connect to a free VPN, then visit dnsleaktest.com. If you see your ISP's DNS servers instead of the VPN's, your DNS queries are leaking outside the encrypted tunnel. Your ISP can see every website you visit, defeating the entire purpose of using a VPN.

No independent audits means you're trusting the provider's claims without verification. Paid services like Mullvad and ProtonVPN commission independent security firms to audit their infrastructure and verify their no-logs claims. These audits cost $15,000-$50,000+, which free VPNs won't spend. You're accepting their privacy promises on faith.

When "free" actually makes sense

Not all free VPN services are scams or privacy disasters. A few scenarios where free tiers serve legitimate purposes:

Trusted paid VPNs offering limited free tiers operate transparently. ProtonVPN provides a genuinely no-logs free tier funded by paid subscribers. It's slower and limited to three countries, but the privacy guarantees match their paid service. The business model is clear: demonstrate value to convert free users.

Short-term specific needs where you genuinely need temporary VPN access and understand the tradeoffs. Connecting to public WiFi at an airport once while traveling might justify a free VPN, assuming you're not transmitting sensitive data. You're making a conscious risk decision for a limited use case.

Testing before paying allows evaluating whether VPN technology suits your needs before committing to a subscription. Use the free tier to understand the performance impact and workflow integration, then make an informed purchase decision. Don't use a free VPN for actual privacy-sensitive activities during this testing period.

How to evaluate what you're actually trading

Before installing any free VPN, invest twenty minutes in due diligence:

Read the actual privacy policy, not the marketing page. Search for phrases like "may collect," "share with partners," "advertising," "analytics," and "aggregate." Note what data they explicitly reserve the right to collect. If the policy is vague, assume maximum collection.

Identify ownership and jurisdiction. Who operates this service? Where are they incorporated? If you can't find clear answers on their website, check their app store listings, domain registration records, or search "[VPN name] owner company." Opacity suggests something worth hiding.

Check independent reviews from security researchers, not affiliate marketing sites. Search Google Scholar or security blogs for analyses of the specific VPN. If security researchers have examined it, they've likely documented concerning findings.

Test for DNS leaks and tracking yourself. Connect to the VPN, then use dnsleaktest.com and browserleaks.com to verify your IP address and DNS queries are properly masked. Install the app on a test device if possible and use something like Wireshark or Charles Proxy to observe what data it transmits.

Compare stated features against paid alternatives. Look at what NordVPN or other paid services cost—typically $3-5/month on annual plans. If you value your privacy enough to use a VPN at all, is that cost unreasonable compared to other monthly subscriptions you pay without hesitation?

The paid VPN counter-argument: are you just the product more slowly?

Paid VPNs aren't immune to perverse incentives. A subscription model aligns interests better than advertising, but you should still verify claims:

Independent audits matter. Services like ExpressVPN and Surfshark publish third-party security audits verifying their no-logs infrastructure. These audits examine server configurations, code, and data retention practices. Request a copy or check the provider's website for the most recent audit report.

Jurisdiction and legal structure affect privacy even for paid services. A VPN operated from a Fourteen Eyes country faces different legal obligations than one in Switzerland or Panama. Neither is automatically better, but understand what data retention laws and intelligence-sharing agreements apply.

No-logs policies should specify exactly what isn't logged: originating IP addresses, connection timestamps, traffic destinations, DNS queries, and bandwidth usage. Vague policies leave room for extensive logging while technically claiming "no logs."

Payment methods reveal provider priorities. Services accepting Monero or allowing cash payments demonstrate serious privacy commitment. Those requiring credit cards and real names for account creation undermine privacy before you've connected to their first server.

Company history and transparency matter. Has the provider ever handed data to law enforcement? Have they published transparency reports documenting government requests? When servers have been seized, was user data actually absent? Mullvad has passed this test multiple times; several other providers have not.

Making the actual decision

For most people reading this, the honest answer is: pay for the VPN or don't use one.

The threat model that justifies using a VPN—hiding your activity from your ISP, protecting yourself on public WiFi, preventing tracking by websites—is completely undermined by using a free service that monetizes through the exact surveillance you're trying to avoid. You've shifted trust from your ISP (regulated, with legal obligations) to a free VPN provider (unregulated, with financial incentive to exploit you).

If $3-5/month for a privacy tool is genuinely unaffordable, ProtonVPN's free tier is the only option with a transparent business model and audited privacy guarantees. Accept the speed limitations and reduced server access as the real cost.

If you're considering a free VPN because "I'm just browsing, I have nothing to hide," then you don't need a VPN at all. Use HTTPS Everywhere and a privacy-focused browser like Firefox with tracking protection enabled. That's free, doesn't require trusting a third party, and addresses 80% of common threats.

If your threat model requires actually hiding your activity—avoiding government surveillance, protecting sensitive journalism, accessing blocked content in restrictive countries—free VPNs are categorically inappropriate. The consequences of a privacy failure are too severe to trust your protection to a service funded by monetizing the exact data you're trying to protect.

Key takeaways

• Free VPN services require millions in annual operating costs—if you're not paying, they're monetizing your data, attention, or bandwidth to stay operational
• Common monetization includes selling browsing history, injecting advertisements, using your device as an exit node, or operating as an upsell funnel to paid tiers
• Technical compromises in free VPNs frequently include outdated protocols, overcrowded servers, DNS leaks, and zero independent security audits
• Always read the actual privacy policy, identify service ownership and jurisdiction, and test for DNS leaks yourself before trusting any free VPN
• ProtonVPN's free tier is the only widely-recommended option with transparent funding and audited privacy protections, albeit with significant speed and server limitations
• For genuine privacy needs, paid VPNs costing $3-5/month provide aligned incentives—verify through independent audits, transparent no-logs policies, and privacy-friendly payment options