Why I Stopped Recommending Free VPNs to Anyone

A colleague asked me last month which free VPN she should download for a trip abroad, and I realised I didn't have a good answer, because I don't actually recommend any of them anymore. I used to think a free VPN was better than no VPN at all, a reasonable middle ground for someone who just wanted basic protection without paying for it. Then I actually looked into how most of them stay in business, and that assumption fell apart pretty quickly. It's not that every free option is malicious, it's that I couldn't reliably tell which ones were fine and which ones weren't, and a security tool I can't trust isn't really doing its job.

The Free VPN Business Model I Didn't Understand at First

A VPN costs real money to run. Servers in dozens of countries, bandwidth, engineering staff, none of that is free, so when a product costs nothing to use, something else is covering the bill. For a worrying number of free VPN apps, that something else is your data. Several free VPNs have been caught logging browsing activity and selling it to advertising and analytics firms, which is precisely the thing a VPN is supposed to stop happening. Some have also turned out to be owned by companies with no clear track record and registered in places with little obligation to disclose who's actually behind the app, which makes it even harder to know who's holding your browsing history. I'm not saying every free VPN does this, but I stopped being able to tell the trustworthy ones from the rest just by reading a privacy policy, and that uncertainty alone was enough to change my mind.

What a Free VPN Can See That a Paid One Can't Sell

The entire point of a VPN is that your traffic passes through the provider's servers before it reaches the wider internet, which means the provider is technically in a position to see everything you're doing unless they've committed to a genuine no-logs policy and had it independently audited. A reputable paid provider stakes its whole reputation on that audit, because getting caught logging data would be commercially fatal. A free provider with no real revenue model beyond your data has a much weaker incentive to resist the temptation, and audits of no-name free apps are far rarer than they should be. I'd rather pay a few pounds a month to a company whose business model doesn't depend on watching what I do.

The Speed and Server Limits That Come With Free

Even the free VPNs that are reasonably honest about privacy tend to make the experience painful enough that people give up on using it consistently. Bandwidth caps, a handful of overloaded server locations, and connection speeds that make video calls unusable are all common trade-offs. I've tested a few out of curiosity, and the pattern is consistent: whatever server you connect to is shared by far more free users than a paid server would be, so everything crawls at peak times. Daily data caps are common too, often just enough for browsing but nowhere near enough for a day of streaming or video calls, so people end up switching it off the moment it becomes inconvenient. A VPN you stop using because it's too slow isn't protecting you at all, it's just an app taking up space on your phone.

The One Free VPN Feature That's Sometimes Worth Using

I'll give credit where it's due: a handful of the well-known paid providers, NordVPN among them, offer limited free trials or a capped free tier as a way to let you test the service before committing. That's a genuinely different situation to a permanently free, ad-supported app, because the company's actual business model is still the paid subscription, and the free tier exists to build trust rather than to harvest data. If you want to try before you buy, that's the version of "free" worth using, not a standalone free VPN app with no obvious revenue source behind it.

The Browser Extension That Isn't Really a VPN at All

There's a related trap I didn't spot for a while: several "free VPN" browser extensions aren't a VPN in the proper sense at all, they're a proxy that only reroutes traffic from that one browser tab, leaving every other app on the device, email, messaging, background sync, completely unprotected. That's one of the mix-ups I keep having to correct when people ask me about VPNs generally, and it's a meaningfully weaker product than a genuine device-level VPN, with the naming making it easy to assume you're covered when you're not. If you're only after a quick way to appear as though you're browsing from a different country, that might be all you need, but it's worth knowing that's what you're actually getting rather than assuming it's protecting everything you do.

What I'd Actually Pay For Instead

When I'm actually comparing services rather than just checking a box, I look at the same handful of things every time: an independently audited no-logs policy, where the company is legally based (jurisdiction affects what it can be compelled to hand over), how many devices one subscription covers, and whether it includes a kill switch as standard. I've written before about the fuller checklist I use when choosing a VPN, and it holds up regardless of price point. NCSC has general guidance on evaluating tools like this too, worth a look if you want a second opinion beyond mine. What I've stopped doing is treating "free" as a legitimate category alongside paid options at all. A few pounds a month buys a company whose incentives are actually aligned with keeping your data private, and once I understood what free VPNs are usually funded by, that felt like an easy trade. I use NordVPN myself, and my free Safety Toolkit covers the rest of what I'd want anyone to check before they trust any provider with their traffic.