How Do Free VPNs Make Money?

Every free VPN faces the same awkward fact: running a VPN is not free. Servers must be rented, traffic must be carried, engineers must be paid and apps must be updated whenever iOS, Android or Windows changes. If the person using the service pays nothing, the cost does not disappear. It moves to someone else, and that someone has a reason to be there.

This article is a field guide to those reasons. We start with the bill, then walk through eight revenue models, show what each one needs from you, and finish with practical clues for recognising the model behind an app you are about to install. The aim is not to frighten you away from every free tool. It is to replace the vague worry that "free is probably bad" with specific questions you can check. For a broader safety checklist, our guide on whether free VPNs are safe is a good companion.

Start with the bill

To see why the money has to come from somewhere, look at the arithmetic with invented numbers. Suppose carrying one gigabyte of traffic costs the provider one cent. That sounds tiny. Now imagine a free app with one million active users, and each person moves five gigabytes a month.

• Traffic: 1,000,000 users x 5 GB = 5,000,000 GB
• Cost at one cent per GB: 50,000 per month, before any other expense
• Add servers in many places, staff, support, legal fees and app-store developer accounts

The actual figures vary, and large providers negotiate better rates, but the shape is the same: cost rises with every extra user and every extra gigabyte. A free service that grows without bringing in money simply becomes a larger bill.

That is why the sensible question about a free VPN is not "is it generous?" but "what is the revenue model, and does it ask for something I am not willing to give?". The next section lists the models you are most likely to meet.

Eight ways a free VPN gets paid

1. Upgrade sales (freemium)

The service gives away a limited version and earns from the small share of users who pay for the full one. Typical free limits are a cap on data or time, fewer locations and slower speeds. Typical upgrade prompts appear after you hit the limit.

What it needs from you: nothing beyond the occasional purchase. How it feels: reminders to upgrade, a clear difference between free and paid. Risk level: lowest of the eight, but the free tier gets less attention than the paid product.

2. Advertising inside the app

The app displays banners, full-screen adverts or video ads, and the provider is paid by an advertising network.

What it needs from you: attention, and usually identifiers so that ads can be matched to you. How it feels: adverts on the connect screen, between sessions or whenever you open the app. Risk level: moderate to high. Ad software often communicates with outside servers and may collect device details. An app that runs ad software inside a privacy tool is in an awkward position.

3. Sharing or selling usage data

The provider records what users do, such as apps opened, sites reached or approximate location, and sells or shares that data in a bundled or "anonymised" form.

What it needs from you: your activity. How it feels: invisible. The app may look clean and well designed. Risk level: high. It is the model most directly opposed to the reason people install a VPN. Phrases such as "improving services", "analytics partners" and "aggregated data" in a policy sometimes cover this.

4. Reselling bandwidth or using your connection

Some free apps run a peer network. Your device or connection carries traffic for other users in exchange for the free service, or the provider sells access to that pool to third parties.

What it needs from you: your connection and your IP address. How it feels: a sentence in the terms, often buried, that allows the app to "share resources" or "participate in a network". You may notice higher battery or data use. Risk level: high. Your address may appear as the source of traffic you did not create, and you may not control what that traffic is.

5. Affiliate and referral commissions

The app is a marketing channel. It earns when you click through to a paid product, or when it recommends other services, including paid VPNs. Some review sites and "free VPN" pages exist mainly for this.

What it needs from you: your click. How it feels: recommendations that always lead to the same vendors, and lists that rank everything highly. Risk level: low to moderate for the app, but it makes the advice around it less neutral.

6. A parent company that earns elsewhere

A company with other products may run a free VPN to attract users, to support another product or to build brand recognition. The VPN is then a cost centre funded by profit from elsewhere.

What it needs from you: possibly cross-product data, depending on the terms. How it feels: the VPN is one item in a larger catalogue, and the privacy policy covers the whole company. Risk level: depends on the company. Read which entity is responsible and what the group-wide terms allow.

7. Investment or grants

Some free tools are funded by investors, sponsors or grants while they grow, or by volunteers and donations. For a small project, money comes from the operators' pockets.

What it needs from you: nothing now. How it feels: often an open-source project or a young company. Risk level: variable. Funding can end, and the model may change after a sale or a shortfall.

8. Malicious or deceptive models

At the far end are apps that exist to harm. They may carry adware, inject adverts or redirect affiliate links into your browsing, collect more than they declare, or install other software.

What it needs from you: access, and often permissions that do not fit a VPN. How it feels: pop-ups outside the app, unexplained settings changes, and demands for broad permissions. Risk level: severe. Remove the app, update your device and change any passwords you entered while it was installed.

Quick reference

Model	What it takes	Main sign	Concern
Upgrade sales	A purchase from some users	Clear free versus paid limits	Low
In-app advertising	Attention and identifiers	Ads on screens	Moderate to high
Usage data sharing	Your activity	Vague "analytics" language	High
Bandwidth resale	Your connection	"Share resources" in terms	High
Affiliate links	Your click	Recommendations that loop	Low to moderate
Parent company	Possible cross-product data	Group privacy terms	Depends
Investment or grants	Nothing now	Young company or open source	Variable
Malicious	Access and permissions	Odd pop-ups, extra permissions	Severe

What this means for your data

A VPN sits in a privileged place: it carries your traffic between your device and the internet. That is why the revenue model matters more here than for, say, a calculator app. A single provider can usually see the destinations you connect to (though not the content of encrypted connections), the times you are online, and your original address. How it handles that information is a business decision.

• If the money comes from you, the provider has a reason to keep you satisfied and no need to monetise your data.
• If the money comes from advertisers, the provider has a reason to know you well.
• If the money comes from data buyers, your activity is the product.

None of this means every free app is harmful, and it does not mean every paid one is trustworthy. It means the incentives are different, and incentives predict behaviour better than slogans. Our guide to what a VPN provider can see explains the technical side of that visibility.

Reading the clues in an app

You rarely need special tools to guess the model. Look for these clues in about ten minutes.

1. Count the ads. If adverts appear, model 2 is at work, and probably some data sharing with the ad network.
2. Read the store privacy label. Apple requires developers to declare data types collected and whether they are used for tracking. Lines such as "usage data", "identifiers" or "location" for a VPN deserve a question.
3. Search the policy for named sharing. Look for "partners", "advertisers", "affiliates" and "third parties", and whether they are named.
4. Check permissions. A VPN does not need your contacts, camera or microphone.
5. Look for a paid tier. A visible upgrade path suggests model 1, which is the least worrying.
6. Find the company. A named entity with an address and contact point is easier to hold accountable than an anonymous developer.
7. Read the terms for resource sharing. Words like "peer", "network participation" or "share your connection" signal model 4.
8. Check where you found it. An app promoted by a review page that links to many vendors may be part of an affiliate network.

When you are ready for a deeper check, the platform guides on checking a free VPN app on Android and on iPhone walk through the exact screens.

When free is honest

It would be unfair to say that every free option hides something. Two arrangements are generally straightforward.

A limited free tier of a paid service. The company says what the free version includes, shows the paid version clearly and does not need your data to make money. You get a sample; they hope you upgrade. It is useful for a short, low-risk task, though not designed for work you cannot afford to leak.

A transparent community project. Open-source code, a named maintainers group and public funding through donations make the model easy to see. The risks shift to reliability and support, not hidden revenue.

Between the two lie many apps whose revenue is simply unclear. Treat unclear as a reason to wait, not as a reason to hope.

Three short scenarios

A student on a data budget. Aom installs the first free app she sees. It works, but every time she connects, a full-screen advert plays. She realises the ads mean model 2 and checks the store label, which lists identifiers shared for advertising. She decides to keep the app for casual reading only and uses her phone's mobile data for anything involving her university account.

A traveller before a trip. Daniel wants a simple VPN for two weeks. He compares a limited free tier with a short prepaid pass. The free tier's revenue model is clear, since it exists to sell upgrades, but its data cap would run out within days. He chooses the pass, which is paid once, ends by itself and does not renew.

A family with a shared tablet. Mrs Sirikul notices that a free VPN on the kids' tablet asks for contacts access and shows odd adverts outside the app. She removes it, updates the tablet and changes the passwords used while it was installed. The lesson: unusual permissions plus unusual pop-ups point to model 8.

A short worksheet

Before installing any free VPN, finish this sentence: "This app pays its bills by ____, which means it needs ____ from me." If you cannot fill in the blanks from the app's own pages, the answer probably includes your data.

Then ask yourself:

• Am I comfortable giving that thing, whatever it is, to this company?
• Does the app need to be on my device at all, or would mobile data or a trusted network do?
• Could a short, clearly priced paid pass remove the question entirely?

Common mistakes

• Assuming no price means no cost to you.
• Judging an app by its star rating instead of its permissions and policy.
• Trusting a polished interface as proof of good intent.
• Ignoring terms that mention sharing resources or networks.
• Installing from a link in a comment or a pop-up instead of the official store.
• Keeping an unused free VPN installed after the task is done.

Summary

Free VPNs earn money through upgrade sales, advertising, data sharing, bandwidth resale, affiliate links, a parent company, outside funding or, in the worst case, malicious behaviour. Each model asks for something different from you, from nothing at all to your activity or your connection. Count the ads, read the store label and policy, check the permissions and find out who runs the app. If you cannot say how it pays its bills, plan as if your data is part of the payment.

If you would rather pay a clear price once and skip the guessing, the pricing page shows how a prepaid pass works, with a fixed number of days and no automatic renewal.