Free VPN apps get installed by the millions, and nobody asks who pays for the servers. A team from the University of Michigan, the University of New Mexico, and IIT Delhi decided to check. They tested 281 of the most popular free Android VPNs and presented the findings at the NDSS security conference in February 2026.
Some 88% had at least one security or privacy failure. 29 leaked DNS and browser traffic outside the tunnel. 61 sent data in plain text. And 246 of them talked to advertising or tracking domains. Those apps account for more than 2.4 billion installs between them.
The VPN App Sees Everything You Do
That’s how the technology works. Your traffic goes to the app instead of your internet provider, and the company behind the app decides what happens to it next. A store rating tells you nothing about that decision. A separate study of 18 popular free apps found trackers in 17 of them, five per app on average.
Several were reporting to ad networks in countries you would not choose to send your browsing to. Free plans from companies that also sell subscriptions are a different case. The standalone apps have no paid product behind them. They earn money some other way, and your traffic is all they have to sell.
$3.49 Buys Speed and an Audit
Deloitte has now audited NordVPN’s no-logs policy six times, the last one in February 2026. Nothing on that list of 281 apps comes close to that kind of scrutiny. The speed difference shows up every day. I tested on a 190 Mbps connection, and NordVPN averaged 7.8% below it across UK, US, and Japan servers.
Tokyo still returned 160 Mbps. That was the smallest loss of any provider I tested this year, and 4K never stalled on me. Every major streaming platform opened, usually on the first server I picked. Nothing meters you either, so there’s no rationing in the last week of the month.
One Dollar Apart, Very Different Plans
All three add 3 extra months on top of the 2-year term, so you’re billed once for 27 months.
- Basic, $3.49/mo. The VPN by itself, 69% off, $94.23 for the full term. Fine if you want speed and a clean privacy record and nothing else.
- Complete, $4.49/mo. The biggest discount of the three at 75% off, $121.23. Adds malware and browsing protection, an ad blocker, a password manager, ID and scam call monitoring, and 1 TB of cloud storage. A dollar more than Basic for all of that.
- Prime, $7.49/mo. $202.23 for the term, 69% off. Everything above plus Coveron identity protection, with monitoring, alerts, and insurance coverage.
Set a calendar reminder for the renewal: Basic goes to $139.08 a year once the 27 months finish. For the first 30 days, you can ask for your money back; no reason needed.
