Free VPNs leak your data: 29 of 281 Android apps found exposing traffic

Free VPN services often turn out to be more dangerous than using no protection at all: instead of hiding user activity from the ISP, they pass data on to third parties. The latest MVPNalyzer study found that out of 281 free Android VPNs, 29 apps leak traffic, 61 send data in plaintext, and over 80% contact known advertising and tracking domains. That is a noticeable improvement over a decade ago, but the problem is far from solved.

Back in 2016, a CSIRO study tested 283 Android VPNs and found that 84% allowed IPv6 traffic to bypass the encrypted tunnel, 66% leaked DNS queries, and 18% did not encrypt the connection at all. That was a massive breach of trust, yet today a significant share of free services still operate with serious security flaws.

Even when a VPN works correctly, the operator sees the user's real IP address, the addresses of all visited websites, DNS lookups, and plaintext hostnames from HTTPS handshakes. This metadata is enough to reconstruct a person's browsing habits in painstaking detail without ever looking into encrypted page content. Some apps even deliberately break HTTPS to gain access to the data.

A free VPN without a paid tier raises immediate suspicion: servers and bandwidth cost money, so the service must be earning somehow. For instance, Hotspot Shield's free version was caught injecting JavaScript and redirecting shopping traffic through affiliate links. Facebook bought Onavo to watch which apps people used, and analytics firm Sensor Tower hid its VPN and ad-blocking apps behind shell companies.

The recent Urban VPN case showed the service collected AI chat content and sold it as marketing analysis, and it kept gathering data even after the VPN was turned off. The only fix was uninstalling the app. Users should remember that "free" often comes at the cost of privacy, and before installing such software, it is better to check who stands behind the service and what data it collects.