Are Chinese-Owned Free VPNs Safe? What the Research Actually Found

Whether a Chinese-owned free VPN is safe depends on how much you trust that its owner can resist a government demand for your data — and for the apps in question, that trust is hard to justify, mostly because the ownership is hidden in the first place. The core issue is not nationality for its own sake; it is that a wave of popular free VPNs conceal who runs them, and independent investigators have repeatedly traced some of the most downloaded ones to Chinese companies operating under laws that can compel cooperation with the state. If you cannot tell who owns the VPN routing all of your traffic, you cannot assess the risk — and that uncertainty is the real problem.

What the Technology Transparency Project found

In an April 2025 report, the Technology Transparency Project (TTP) found that one in five of the top 100 free VPNs on the US App Store were surreptitiously owned by Chinese companies. Those apps had been downloaded more than 70 million times, and several were tied to a cybersecurity firm the US Commerce Department sanctioned in 2020. A follow-up spot check reported that many of the named apps remained available — around 13 still on Apple's store and 11 on Google's — months after the findings were publicised (TTP; The Register, June 2025; Forbes, June 2025). The point of citing the exact figures is that this is documented investigative work, not rumour: the ownership was hidden, and researchers had to dig to surface it.

Why Chinese ownership is a specific risk

The concern is legal, not ethnic. China's national intelligence legislation can require domestic companies to assist state intelligence work and to keep such assistance secret, which means a VPN operated by a Chinese company could, in principle, be compelled to hand over user data without disclosing it. Because a VPN sees all of the traffic you route through it, that is a uniquely sensitive position for a compelled entity to hold. This is why security researchers single out hidden Chinese ownership of traffic-carrying apps — the combination of total traffic visibility and a legal duty to cooperate is the risk, and the secrecy around it removes your ability to opt out knowingly.

The apps named in the report

The TTP's reporting named several widely downloaded free apps — including Turbo VPN, VPN Proxy Master, Snap VPN and Signal Secure VPN — among those it linked to Chinese ownership, some via the sanctioned firm Qihoo 360. We repeat those names as the investigators' documented findings, not as our own laboratory verdict, and ownership structures can change over time; anyone relying on this should check the current situation for a specific app. The broader lesson is what matters: these were popular, high-rated apps whose ownership was not obvious from the store listing. A good rating and a slick app icon told users nothing about who was behind them — which is exactly the no-findable-owner red flag in action.

The bigger problem: hidden VPN ownership

Chinese ownership is one sharp example of a wider issue: the VPN market is heavily consolidated and often opaque. Reporting by Tom's Guide in 2025 noted that at least 105 VPN services are owned by just 24 companies, with many apps giving no obvious hint of their parent on the store page. That means a lot of 'independent-looking' free VPNs share owners, and some of those owners are not who a user would guess. The takeaway is not that every consolidated brand is dangerous — plenty are fine — but that ownership is frequently hidden, so 'who runs this?' is a question you have to actively ask rather than assume the store answers.

How to check who owns your free VPN

Spend two minutes on provenance before you install. Read the developer name and country on the app-store listing, then open the provider's website and privacy policy and look for the legal entity, its jurisdiction and a real address. Search the app's name alongside words like 'owner', 'parent company' or 'investigation'. Reputable providers make this easy — Proton is openly Proton AG in Switzerland; Mullvad is Amagicom AB in Sweden. If the ownership is buried, contradictory, or simply absent, treat that opacity as the answer, regardless of the star rating. You are deciding who gets to see your traffic; you are entitled to know their name.

The safe alternative

The way to avoid this whole category of risk is to choose a free VPN whose owner, jurisdiction and audit record are all in plain sight. That is exactly the filter our ranking applies: the best free VPNs are led by Proton and Windscribe precisely because you can name who runs them and check their claims. Transparency is not a nice-to-have here; on a free VPN it is the whole safety case.

What to do if you already installed one

If you recognise an app you already use on one of these lists, do not panic, but do act. Uninstall it, then treat any password you entered while it was connected as potentially exposed and change the important ones — email, banking, anything reused across sites — using a device that is not running the app. Revoke its permissions before or after removal so it cannot keep collecting in the background, and on mobile check whether it installed a configuration profile that needs removing separately. Then switch to a free VPN whose owner and audit record are transparent, so you are not simply trading one unknown for another. The exposure from a period of using a questionable free VPN is usually about metadata and browsing patterns rather than an immediate account takeover, but the sensible assumption is that whatever the app could see, it may have kept — and to close that window promptly.