7 Free VPN Red Flags: How to Spot a Dangerous App Before You Install It

The dangerous free VPNs share a handful of tells, and once you know them you can filter out most bad apps in under two minutes. These seven free VPN red flags are the same signals independent researchers keep tying to malware, tracking and data leaks — and they are the exact criteria behind our free VPN safety checklist. None is proof on its own, but three or more together is the profile of an app to skip.

1. You can't find out who owns it

No findable owner is the single biggest red flag. A VPN routes all of your traffic, so the company behind it holds real power over your privacy — and if you cannot learn its name, country and a real address from the store listing or privacy policy, no one is accountable for what happens to your data. Trustworthy providers make ownership obvious: Proton is Proton AG in Switzerland, Windscribe is a named Canadian company. An app whose 'developer' is a generic name with no corporate trail is telling you something. When you cannot answer 'who runs this?', treat that as a no by itself.

2. Its no-logs claim has no independent audit

A 'no-logs' promise with nothing behind it is marketing, not evidence. Almost every VPN claims not to keep logs; the ones you can trust hire an outside firm to inspect their servers and configuration and publish the result. Proton VPN's no-logs setup, for instance, has been verified by the security firm Securitum in consecutive annual audits with public reports. A free app that says 'we never log' but points to no dated, independent audit is asking you to take its word for the one thing you most need proven. The absence of an audit does not prove wrongdoing, but it removes your only real assurance.

3. It's 'free and unlimited' with no paid plan

Running a global server network costs real money, so a service that is free, unlimited and has no paid tier has to earn its keep some other way — and that way is usually you. Legitimate free VPNs are freemium: the free plan is a limited sample funnelling users toward a paid subscription, which is why safe free tiers cap data or devices. An app marketed as 'completely free, unlimited, forever' by a brand with no paid plan and no name inverts that logic. We explain the economics in how free VPNs make money — the short version is that unlimited-free-from-nobody means your data is paying the bill.

4. It asks for permissions a VPN doesn't need

A VPN needs permission to create a network connection, and essentially nothing else. If a mobile VPN app asks for your contacts, your text messages, your call logs or your precise location, that is a data-collection signal, not a feature. The concern is grounded in research: the 2016 CSIRO/Data61 study of 283 Android VPN apps found that 82% requested permissions to sensitive data such as user accounts and text messages, and 67% embedded at least one third-party tracking library. Before installing, read the permission list on the store page and ask what a VPN could possibly need it for.

5. It shows ads or bundles other software

In-app ads and bundled extras are how an ad-funded free app monetises you, and both come with tracking. Advertising SDKs collect device and usage data to target ads; software bundled into the installer can add browser toolbars or other unwanted programs. None of this is compatible with the privacy a VPN is supposed to provide. A safe free tier is quiet: no ad banners inside the app, no 'recommended' extra downloads during setup. If the free VPN feels like an ad delivery vehicle, it probably is one.

6. The privacy policy is vague about what it collects

A trustworthy privacy policy is specific; a dangerous one is deliberately fuzzy. Look for plain answers to three questions: what is logged, for how long is it kept, and who is it shared with. A good policy names the data (or states that connection logs are not kept), gives a retention period, and lists the categories of third parties. A policy that leans on phrases like 'we may collect certain information to improve our services' and 'we may share data with partners' is hiding the answer in vagueness. If the document is hard to pin down, assume the collection is broad.

7. It has a documented history of trouble

A quick search for the app's name plus 'breach' or 'data' often surfaces the deciding evidence. The record for free VPNs includes serious incidents: in 2023 a researcher found an exposed database of roughly 360 million records tied to the free app SuperVPN, including email addresses and records of visited sites (CPO Magazine, 2023). Years earlier, a 2017 complaint to the US Federal Trade Commission by the Center for Democracy and Technology alleged undisclosed data sharing in the free Hotspot Shield app; its then-parent AnchorFree denied wrongdoing (CDT; The Register, 2017). And an April 2025 Technology Transparency Project report tied one in five of the top free VPNs on the US App Store to Chinese ownership — the subject of our guide to Chinese-owned free VPNs. A documented history does not condemn a company forever, but it is a reason to demand more assurance, not less.

Put the flags together

Score the app across all seven flags rather than fixating on one. A single flag (say, in-app ads on an otherwise reputable service) is worth caution; three or more is the signature of a free VPN to avoid. If you would rather skip the vetting, the shortlist that clears every flag is on our ranking of the best free VPNs, led by Proton and Windscribe. And when you cannot even find out who owns a free VPN, you already have your answer.