By 
Free VPNs are not free. The bill lands in your data, your speed or your server choice. This page compares, it never ranks.
I test on a Tecno Spark 40, HiOS and Android 15. Sources and read-dates ride with the claims. Rankings live in our best free VPN guide, and our VPN decision guide says whether you need one.
The short version
- Free costs data, choice or privacy; the audited two cost choice only.
- CSIRO 2017, 283 apps: tracking libraries in 67%. PETS 2025: 18 apps, 700M+ downloads, three families.
- Proton: unlimited allowance, ten random countries. Windscribe: 10 GB monthly, ten countries you pick.
- Nigeria math: 10 GB is one MTN bundle, ₦4,500.
- Paid wins for streaming, P2P and faster servers.
The price tag nobody prints
No VPN is free to run. Servers and engineers cost money, so four models cover the Play Store.
| The model | How it pays | What you feel |
|---|---|---|
| Data-selling | Your profile is the product | Ads that know too much |
| Adware-funded | Ads pushed into your traffic | Pop-ups, silent scripts |
| Breach-leaky | No security budget, then the dump | Logs surface in plain sight |
| Freemium-audited | You upgrade, or paying users cover | Caps, but audited claims |
The newest academic finding: the 2025 PETS paper, Hidden Links (Mixon-Baca, Knockel of Citizen Lab, Crandall), on the top 100 free VPNs on Play. Three families, 18 apps, 700M+ combined downloads, near-identical code, hard-coded Shadowsocks passwords. ZDNet carried the study on 12 September 2025. A hard-coded key lets an attacker decrypt your traffic. The researchers asked Play to demand a security-audit badge and verified developer identities.
The older finding: a 2017 study of 283 apps (Ikram et al., CSIRO, ICSI, UC Berkeley, UNSW). Printed by bitlaunch, 24 September 2025, read 12 November 2026: 67% carried tracking libraries, 16% ran proxies injecting JavaScript. Then 84% failed to tunnel IPv6, and 66% failed to tunnel DNS. One VirusTotal detection hit 38%; scanners flag false positives.
2020: seven linked Hong Kong free VPNs leaked 1.2TB. In 2023, SuperVPN leaked 360M records. Paid is not immune either: bitlaunch names a 2018 Nord incident and an ExpressVPN RDP bug.
The graded table
Bitdefender's free tier states 500 MB a day (17 March 2026): the daily-cap model.
| Axis | Free category | The audited two | Paid category |
|---|---|---|---|
| Logging | Sold, or unclear | Published no-logs, audited | Published no-logs, audited |
| Data cap | Megabytes a day | Proton: unlimited · Windscribe: 10 GB | Unlimited |
| Servers | Few, random | Proton: ten, random · Windscribe: ten, your pick | 100+ countries |
| Speed | Throttled at peak | Proton managed · Windscribe full to 10 GB | Fast, 10 Gbps class |
| P2P, streaming | Blocked or throttled | Proton: no · Windscribe: not promised | Offered and expected |
| Audits | Rare to none | Both audited, stated publicly | Usually audited |
| Support | None worth naming | Help pages and guides | Priority support |
The rule: a cell passes when a named source prints it. Free fails; the audited two pass on quoted audits; paid passes with money attached.
Antivirus suites bundle VPNs too; our antivirus guide grades it.
The two worth trusting, honestly
Proton's own page, read 12 November 2026, leads with these words:
- "the only free VPN that doesn't limit your bandwidth, spy on you, show you privacy-invading ads, or sell your data."
Windscribe publishes audits too: no logs, open-source code, unlimited devices.
Proton's server list, read 12 November 2026, lists ten free countries, from the Netherlands to Japan, Canada and the United States. Its words: "We will randomly choose your next server." First change cools down 45 seconds; then ten minutes between changes.
Tom's Guide, 14 July 2026: speeds fell to around 8 Mbps under heavy load. After a wait, they returned near 1,000 Mbps. The review calls that likely throttling for too much data. No P2P, no streaming, no server choice. Unlimited describes the allowance, not the speed.
Windscribe's page, read 12 November 2026, prints:
- "Give us an email and get 10 GB a month, or don't and get 2 GB."
Same page: 10 country servers, unlimited devices, no card. Confirm the email or you drop to 2 GB.
Both tiers install from Play: Proton VPN, 100M+ downloads, and Windscribe, 10M+, read 12 November 2026.
Limits drift. Five countries on 30 September 2026, ten today. Check the vendor page on install day.
The free field tiering lives in our best free VPN guide.
Trial vs guarantee: the honesty box
A free plan is free forever. A trial is free until the clock runs out; the card stays on file. A money-back guarantee is a paid month with an exit door.
12 November 2026: ExpressVPN runs a 3-day trial on iOS and Android; Surfshark a 7-day trial plus a 30-day money-back guarantee. A card on file means a subscription with a deadline.
Proton and Windscribe carry no trial because their free tiers are real. Read the card line in the terms first.
Nigeria math: megabytes to months
Opera Mini's free data page, read 12 November 2026, gives Nigerian MTN and Airtel users 50 MB a day, 1.5 GB a month. Opera's daily drip needs 200 days to fill a 10 GB cap; its monthly grant, nearly seven months.
MTN's data page, read 12 November 2026: 10 GB plus ten minutes for ₦4,500, printing ₦0.35 per MB. My division gives ₦0.45. Windscribe's 10 GB is the same 10,000 MB, priced at zero.
Proton's unlimited allowance is the prize on a metered bundle, catch attached: random country, managed speed. Opera's grant is browser data, and Opera's own VPN is browser-only. Device-wide traffic needs the app or another provider.
No source I trust prints a per-hour WhatsApp or streaming rate; none prints here. Open Settings, then Data usage, and trust that counter.
Paid prices: I could not verify a vendor-page figure today, so none prints here.
When paid wins, stated plainly
Paid buys all three: data, choice and privacy. Streaming and P2P sit behind the paid door; neither free page promises them.
Ten countries is the free ceiling. Above it sits throughput, priority support and the 10 Gbps tier. Windscribe's unlimited devices on one free account is the exception.
Pay for a published no-logs policy you can audit, not a discount banner. Our NordVPN vs Surfshark and ExpressVPN vs Proton VPN comparisons run the paid bench.
Five install checks, five minutes
1. The audit badge. The paper's remedy: a Play security-audit badge and a verified developer identity. Look for both.
2. The developer. A verified organisation and a readable privacy policy. A hundred million downloads prove distribution, not safety; the families passed 700 million.
3. Permissions. A VPN needs network access. Contacts, SMS, microphone or location are not its job.
4. Kill switch. Turn it on in the app settings. It cuts traffic the moment the tunnel drops.
5. Leak test. After connecting, confirm the IP shown is the VPN's, not yours.
Five minutes, before the first connect.
What was checked on the Spark 40
This page is vendor-doc and lab-report form. No VPN was installed for it: no limits screen photographed, no permissions counted, no speed pair timed on this phone. The house device is a Tecno Spark 40 on HiOS and Android 15.
Verified live, 12 November 2026: Proton's two pages, Windscribe's free page, Opera's Nigeria page, MTN's data page, both Play listings.
HiOS labels move between builds; search the words, not the path. Anything this page could not verify is not printed. If screenshots land later, they will come from the Spark 40 with their own dates.
Questions readers ask
Is Proton's free plan really unlimited?
Bandwidth, yes; allowance is not metered. Congestion-managed speed; about 8 Mbps under load. Ten random countries, one device, no P2P, no streaming.
What does 10 GB buy you?
Ten thousand megabytes. One MTN bundle, ₦4,500 (read today). Nearly seven months of Opera's grant. It dies fast under streaming.
Do all free VPNs sell my data?
No. The audited pair does not, by their published audits. CSIRO: tracking libraries in 67% of 283 apps. PETS: hard-coded keys in three families. Choose by model, not brand.
Is a hundred-million-download free VPN safe?
Downloads measure distribution, not safety. The families passed 700M with shared code. Check the audit badge and developer first.
Trial or money-back: what is free?
Nothing billed up front, but a card is on file either way. ExpressVPN runs a three-day trial on iOS and Android; Surfshark runs seven days plus a 30-day money-back guarantee (read 12 November 2026). The second is a paid month with an exit door.
I am on Opera free data. Can I run a VPN on top?
The Opera grant is browser data, and Opera's own VPN is browser-only. Proton's unlimited allowance, or Windscribe with a confirmed email, fits the metered life.
The bottom line
Free costs data, choice or privacy. The two audited exceptions cost only choice. Paid buys all three.
Count your megabytes, check the audit badge, then install. The rest of the common Android faults sit in our Android problems hub.
Comments
New posts held for reviewCouldn't load comments - the thread service didn't answer. Nothing is being hidden: no approved comments are saved with this page.
No approved comments yet - the first one is yours. New posts are held for review before they appear.