How free VPNs make money, and which ways should worry you

A free VPN is paid for in one of four ways: by a paid tier that the free one leads to, by advertising, by collecting and selling data about what you do, or by renting out your phone's internet connection to other people. The first is an ordinary business. The second is tolerable when the ads stay on the app's own screens. The third and fourth are why free VPNs have a poor reputation, and you can usually tell which one you are looking at from the Play Store listing before you install anything.

What a VPN costs to run

A VPN provider rents servers in data centres and pays for the bandwidth that flows through them. Bandwidth is the cost that grows with every user: a server carrying ten people's video streams costs more to run than one carrying ten people's email. On top of that come the people who patch the servers, answer support email and handle abuse complaints, and the certificates, domains and store accounts that keep the thing working.

None of that stops when the user is not paying. So the question for any free VPN is not whether it is being paid for but by whom, and what they get in return.

Model one: a paid tier pays for the free one

The straightforward model. The provider sells a subscription with more locations, more devices or no session limits, and offers a smaller free tier alongside it. The free tier costs the provider money and is expected to pay for itself because a fraction of the people who use it later buy the full plan.

You can recognise this model because the free tier is visibly limited (a few locations, a session timer, one device) and the paid tier is clearly advertised, usually through the store's own billing. The limits are the price. A provider running this model has every reason to keep the free tier clean, because a free user who has a bad experience will not upgrade. The free versus premium comparison explains what the paid tier typically adds.

Model two: advertising

Ads on the app's own screens, a banner under the connect button or a full-screen ad before connecting, pay a small amount per view. This is honest as long as the ads stay inside the app. The ad network learns that a device with a certain advertising ID opened a VPN app; it does not learn what you did through the tunnel.

The line is crossed when ads appear inside the pages you visit. A VPN sits in the path of all your traffic, and one that rewrites web pages to insert its own advertising is reading those pages to do it. HTTPS makes this hard on most sites, which is why some apps go further and ask you to install a certificate or an "accelerator" that lets them see inside encrypted connections. Never do that for a VPN.

Model three: your data

This is the model that gives free VPNs their reputation. The app records which sites and apps you connect to, when, and from where, and sells the aggregate to data brokers, advertisers or "analytics partners". Sometimes the selling is done by an analytics kit the developer bundled without much thought; sometimes it is the whole business.

The tell is in the Data safety section of the Play listing, which asks developers to declare what data is shared with third parties. "Web browsing history" or "app activity" under shared data is disqualifying for a VPN. So is a privacy policy that talks about "partners" and "improving our services" at length while never listing a single data item or retention period. How to read a VPN privacy policy covers what a specific policy looks like.

Model four: your connection

The quietest model and, for you, the riskiest. Some free VPN apps include software that lets other people route their traffic through your phone, using your home or mobile IP address as an exit point. The provider sells access to those addresses to companies that want to look like ordinary home users, for price scraping, ad verification, or things you would not choose to be associated with.

Two things follow. Your data allowance and battery are spent carrying strangers' traffic, and whatever that traffic does is done from your address. The listing rarely says this plainly; it is buried in the terms as "peer-to-peer" or "sharing idle resources". If a free VPN's terms mention your device being used as a node, an endpoint or a relay for others, that is this model.

How to tell which one you have

The question to keep asking

When something is free, ask what the provider gets. If the answer is "some users upgrade", the model is aligned with you: the provider wants you to have a good experience. If the answer involves what you do through the tunnel, the model is against you, because the provider profits from seeing more. Everything a VPN server can see is laid out in what a VPN server is, and what it can see; a free provider's business model decides what it does with that view.

Culvert VPN's free tier is funded by its Premium tier and shows no ads in the tunnel; it does not log the sites you visit, your DNS queries or your traffic contents, its servers see only an opaque connection id, it keeps your IP address for up to 30 days for abuse handling as set out in its privacy policy, and it is on Google Play.