Free VPN: What You Actually Pay With

Nobody runs servers in thirty countries as a hobby. Here is what the money is, where it comes from, and how to read a free VPN's business model before you install it.

The most searched VPN query in Russian is a request to download the best free VPN, and the pattern repeats in every language. That instinct is reasonable. A VPN looks like software, software is often free, and the free tier of most things is merely a smaller version of the paid one. But a VPN is not software. It is a rented network with a permanent bill: servers in datacentres, transit bandwidth measured by the terabyte, blocks of IPv4 addresses that now cost real money to lease, and a support burden created by every abuse complaint your users generate. Somebody pays that bill every month. This article is about who.

The bill, in actual numbers

Start with the cost side, because the rest follows from it. A single mid-tier VPS in a European datacentre with unmetered gigabit runs roughly $10 to $40 a month. IPv4 addresses lease at a few dollars each per month and have been climbing since the address space ran out. Transit for a busy exit is billed on the 95th percentile of usage, not the average, so one heavy torrenting user sets the price for the whole box. Then add abuse: every copyright complaint, every scraping report, every fraud investigation arrives as an email that a human has to answer, and hosts drop providers who ignore them.

Divide that across users and the arithmetic is unforgiving. A provider with a hundred thousand free users on thirty locations is looking at five figures a month before anyone is paid a salary. There is no version of that sentence where the money appears by itself.

Model one: your bandwidth is the product

The most lucrative option is to resell the thing you already have: residential IP addresses. Commercial scraping operations pay well for traffic that exits through a home connection rather than a datacentre, because home addresses do not trip bot detection. A free VPN app sitting on a phone in a residential network is exactly that asset.

This is not a hypothetical. The Hola VPN case in 2015 is the canonical example: the service routed its free users' idle bandwidth into a sister company's paid proxy network, which was then used to run an attack against another site. Users learned they had been part of it from a security advisory, not from the app. The model did not disappear afterwards; it professionalised. Several proxy networks today are built on SDKs that developers embed in free apps in exchange for revenue share, with the consent buried in a paragraph most people scroll past.

What it costs you: your address is attached to whatever the buyer does with it. Scraping is the polite end. Credential stuffing and fraud traffic are the other end, and the abuse report arrives at your internet provider, not at the VPN's.

Model two: your browsing is the product

The second model is the one people intuitively expect, and it is real. A VPN sits in the single most valuable position in your network path: it sees every domain you visit, in order, with timestamps. That is a purer behavioural dataset than any advertising pixel, because it is not limited to sites that carry a tracker.

Regulators have documented it. In 2017 the US Federal Trade Commission brought a case against the operator of a widely installed free VPN that marketed itself on privacy while collecting and selling users' browsing data to third parties. Academic work found the same pattern at scale: a 2016 study of nearly three hundred free Android VPN apps found that a large share requested permissions unrelated to their function, and a meaningful minority embedded third-party tracking libraries in an app whose entire premise was preventing tracking.

What it costs you: the exact harm you installed the VPN to prevent, moved one hop down the wire and given a contract.

Model three: the pages you see are the product

The third model modifies traffic in flight. Because the VPN terminates your connection, it can rewrite what passes through it: inserting advertising into pages, replacing existing ad slots with its own, or appending affiliate codes to shopping links so the commission on your purchase is redirected. HTTPS limits the crudest versions of this, which is why the aggressive implementations ship a root certificate with the client and ask you to trust it.

That certificate is the thing to watch. A VPN needs no ability to read your encrypted traffic to move your packets. Any product that asks to install a root certificate on your device is asking for permission to decrypt everything you do, including your bank.

What it costs you: integrity of what you see, plus a decryption capability handed to a company whose funding you already could not explain.

Model four: the honest one

There is a legitimate free tier and it deserves saying plainly, because the point of this article is not that free means fraud. Proton VPN runs a free plan with no ads, no logs and no data sale, funded by paying subscribers of the same company, with published third-party audits. Riseup and similar activist projects run on donations and grants. In both cases the answer to 'who pays' is one sentence long and verifiable.

The trade in an honest free tier is capacity, not integrity: fewer locations, slower peak speeds, no P2P. That is what an honest constraint looks like. When a free service instead offers unlimited bandwidth across fifty countries with no visible funding, the constraint has been moved somewhere you cannot see.

• The useful question is never 'is it free'. It is 'who pays for this, and can they say so in one sentence'.

Reading a provider in five minutes

You can classify most services without technical tools. Work down this list:

• Find the funding statement. An honest free tier says who subsidises it, usually on the pricing page. Absence of an answer is an answer.
• Read the privacy policy for the word 'partners'. Data sale is rarely called data sale. It is called sharing with partners for analytics or service improvement.
• Check the permissions before installing. A VPN client needs the VPN permission and network access. Contacts, location and installed-app lists are not part of the job.
• Refuse root certificates. No legitimate VPN needs to decrypt your HTTPS to route it.
• Look for who is behind the company. Named operators in a stated jurisdiction can be held to their claims. A shell with no address cannot.
• Prefer an audit over an adjective. A published no-logs audit is evidence. The phrase 'military-grade encryption' is filler; every VPN uses the same ciphers.

What the bottom of the paid market looks like

The alternative to a free VPN is not a $12 subscription. The floor of the paid market is low enough that the comparison is rarely about affordability. Mullvad charges a flat €5 a month with no tiers. Cypher VPN sells a week for $1.99 and a month for $4.99, and the reason we mention our own price here is precisely the point of the article: once you pay, you can see the business model, and so can we. Money in, bandwidth out, no third party in the equation.

That is the whole structural difference. A paid provider that sells your data is committing fraud against a customer and can be sued for it. A free provider that sells your data is executing its plan.

When free is genuinely the right call

Three cases where a free VPN is the correct tool. Getting past a hotel network's port blocking. Watching a geo-restricted video you do not care about. Testing whether a VPN fixes a connectivity problem at all before you pay for one.

What these have in common: nothing sensitive is moving through the tunnel. Use a free VPN as a routing convenience and it is fine. Use it as a privacy tool and you have installed the opposite of one.

FAQ

Are all free VPNs dangerous?

No. Proton VPN's free tier is funded by its paying subscribers, published audits back its no-logs claim, and it carries no ads. The problem is not the price, it is the unexplained business model. If a provider states who pays and the answer holds up, the free tier is legitimate.

Why do free VPNs need so many app permissions?

Usually they do not. A VPN client needs the system VPN permission and network access. Requests for contacts, precise location, or the list of installed apps indicate a second business running alongside the first, and that business is advertising or data brokerage.

Is a free VPN enough to bypass censorship?

Rarely, and for a technical reason. Censorship systems fingerprint standard VPN protocols and block them, which is why circumvention needs obfuscated transports like AmneziaWG or VLESS/Reality. Free services almost never offer these, because obfuscated traffic costs more to carry. Our protocol comparison covers what actually gets through.

What about the free trial of a paid VPN?

Different thing, and generally fine. A trial is marketing spend by a company whose revenue comes from subscriptions, so the incentive during the trial is to impress you, not to monetise you.

Does paying make a VPN trustworthy?

No, it removes one specific incentive. Payment means you are the customer rather than the inventory, but you still need the operator to be honest. Check for a published audit, a stated jurisdiction, a warrant canary, and a policy that describes what is kept rather than only what is not.

So download the best free VPN, if the thing you are doing does not matter. If it does, spend two dollars and move yourself from the inventory column to the customer column. That is the entire transaction being described here.