Free VPNs leak your data while claiming privacy


Free VPNs leak your data while claiming privacy

Pierluigi Paganini
April 01, 2026

Most free Android VPNs track users, request dangerous permissions, and connect to risky servers, privacy comes at a hidden cost.

Free VPN apps are some of the most popular downloads on Android, promising privacy at no cost. But the reality is far from what they advertise. Most users tap “install” without a second thought, unaware that many of these apps collect and share personal data rather than protecting it. Mysterium VPN’s research provides concrete evidence of the risks hidden inside free VPNs, revealing how they operate behind the scenes and why “free” often comes with a high price for your privacy.

The research focused on 18 of the most popular free Android VPN apps from the Google Play Store. Each app was analyzed using MobSF, an open-source mobile security framework. This static analysis examined four main areas: the permissions requested by the app, any embedded third-party trackers, hardcoded network endpoints, and developer or third-party email addresses within the code. While static analysis cannot reveal real-time activity, the presence of these elements alone shows what the app is capable of and the potential dangers to users.

A major finding is the sheer number of embedded trackers. Trackers are pieces of software that collect data on user behavior, often for advertising or analytics. Out of the 18 apps tested, 17 contained at least one tracker, and the average app included nearly five. Some apps contained more than a dozen trackers, including platforms from the U.S., China, and Russia. Google’s advertising and analytics tools, like AdMob and Firebase Analytics, were present in nearly every app, and Facebook integration appeared in several, enabling cross-platform tracking. Apps such as Turbo VPN and VPN Proxy Master included Chinese platforms like Umeng and Mobvista, as well as Russian trackers like Yandex Ad. This means users attempting to avoid tracking are often exposed to extensive monitoring by multiple third-party companies.

Permissions requested by these apps revealed another layer of concern. A legitimate VPN needs only a few permissions: network access, the ability to create a VPN tunnel, and the ability to run in the foreground. Yet many apps requested far more, often with no relationship to VPN functionality. FreeVPN, for instance, requested 21 permissions, 12 of which are considered “dangerous” under Android rules. These included camera, microphone, contacts, call logs, precise location, and device storage access. Essentially, the app could record audio or video, read your call history, track your movements, and access your photos and files. This permission set resembles spyware more than a privacy tool. Other apps like VPN Proxy Master, VPN 360, and Secure VPN also requested a high number of dangerous permissions, some including the ability to modify system settings or display overlays, techniques that could enable clickjacking or other malicious behavior.

Network connections were another significant concern. Many apps connected to a large number of hardcoded domains, sometimes over 100 for a single app, far more than necessary for a VPN. Some of these domains were located in countries with strict state surveillance or subject to U.S. OFAC sanctions, such as China and Russia.

“Beyond trackers and permissions, perhaps the most alarming finding is the number of free VPN apps that contain hardcoded connections to servers in countries subject to OFAC sanctions or with documented state surveillance programs.” reads the report published by MysteriumVpn. “Routing VPN traffic through these jurisdictions exposes users to risks that no tracker policy or permission review can address.”

Using servers in these jurisdictions exposes users to additional risks, as local laws may require companies to log user traffic or provide access to government agencies. For example, Turbo VPN connects to Chinese servers on Alibaba’s network and includes multiple Chinese trackers. VPN Proxy Master communicates with both Chinese and Russian infrastructure while also embedding trackers from these countries. VPN 360 connected to 105 unique domains, combining multiple trackers with potentially risky server locations.

Other alarming behaviors include apps using plaintext HTTP connections instead of encrypted HTTPS, exposing data in transit. Some apps also included embedded emails, which could indicate a lack of professionalism or potential avenues for phishing and other attacks.

The research identifies the apps with the most concerning risk profiles. FreeVPN stands out for its extreme permissions, despite having no trackers. VPN Proxy Master combines high permissions, numerous trackers, and connections to risky infrastructure, making it the most comprehensive data collector. Turbo VPN is the “tracker king,” embedding platforms from three national advertising ecosystems. VPN 360 has the largest network footprint, with over 100 hardcoded domains. Secure VPN combines dangerous permissions with extensive tracking, including Facebook’s full suite.

The takeaway for users is clear: most free VPN apps are not primarily privacy tools. They are advertising and data collection platforms disguised as security apps. To protect yourself, review requested permissions carefully, audit apps for trackers using tools like Exodus Privacy, and be skeptical of free apps. Open-source and independently audited VPNs are safer, as are decentralized VPN networks, which reduce the risk of a single entity collecting or monetizing your data. Until app stores enforce privacy standards, users bear the responsibility of verifying the safety of any VPN they install.

In short, “free” often comes at a steep cost. Instead of privacy, many free VPNs deliver extensive surveillance, heavy tracking, and connections to potentially dangerous jurisdictions. Investing in a reputable, secure VPN is worth the cost for the protection and peace of mind it provides. Your digital privacy is valuable, and safeguarding it requires informed choices rather than relying on a zero-cost lure.

“The central finding of this research is straightforward: the overwhelming majority of popular free VPN apps on Android are not primarily privacy tools. They are data collection and advertising platforms that provide VPN functionality as a lure.” concludes the report. “The business model is clear, and the mechanisms for executing it are built into the app before a user ever opens it.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, VPNs)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Modularity was one of the most exciting phone trends of the 2010s. It promised phones that would work like desktop PCs, allowing owners to upgrade individual components, add new functionalities, and replace broken parts with ease, improving longevity and ushering in a new, sustainable smartphone era.

While its early days looked promising thanks to pioneers like Modu, which launched the first modular phone in 2008, Google’s Project Ara, and Motorola’s Moto Z lineup, the modularity dream ultimately fizzled out. But not before begetting a few exciting modular phones that captured our attention, if nothing else.

1

Google Project Ara

Google Project Ara prototype modular phone with various modules placed around it. Credit: Google

After Google acquired modular phone-related patents from Modu, which closed its doors in 2011, Google and Motorola, which Google bought in 2011, began exploring the modular phone concept in 2012. Google Project Ara officially kicked off in 2013, with the design philosophy based on Dave Hakkens’ Phonebloks concept.

The original idea was for Google/Motorola to produce the phone’s base, the so-called “Endo” (exoskeleton) frame, with third-party vendors providing everything else, from displays to cameras to batteries. Modules would attach to the phone via an innovative magnetic mechanism with hot swap support.

A Google Project Ara prototype along with a bunch of modules around it. Credit: Google

The dream was to provide a modular phone where almost everything would be easily replaceable and upgradable. Google had to walk back some of the original design choices, such as the ability to replace the screen and the SoC, due to hardware limitations, but the project didn’t abandon its promise of modularity.

Sadly, after three years of development, Google pulled the plug on Project Ara in September 2016, citing high costs and manufacturing issues. Project Ara (kind of) lived on in Motorola’s Moto Mods, but we’ve never gotten a proper Project Ara modular smartphone.

A crying shame because the college me had his mind blown by the whole modular phone movement of the 2010s. Even today, I’d love nothing more than to play around with Project Ara prototypes, if only for a few minutes.

2

LG G5

A hand holding the LG G5 phone. Credit: LG Mobile

LG had a few Android hits back in the early 2010s. The LG G2 is still one of the prettiest Android phones ever, and it sold quite well. The G3 ironed out its predecessor’s kinks while keeping up its sales momentum. But the upward trajectory stalled with the LG G4, so the Korean giant decided to shake up its flagship series.

Enter the LG G5, one of LG’s most ambitious phones ever. The phone’s bottom segment was removable, allowing owners to quickly install modules LG touted as “Friends,” which included various extra functionalities. You had a high-end DAC and Amp, a module that packed extra battery capacity and additional camera controls, and a module with a replaceable battery, allowing you to swap in a new one in a jiff.

LG G5 with a camera module attached to it and another module lying next to it Credit: LG

While the phone piqued the attention of smartphone enthusiasts, myself included, sales showed that the mainstream audience wasn’t exactly engrossed by the concept. Ultimately, the LG G5 had disappointing sales numbers, and LG abandoned its “friends” modular add-ons ecosystem shortly after, with the G5 staying the only modular phone in LG’s lineup.

LG Wing.


The 10 Weirdest Android Phones Ever

Phones weren’t always boring slabs.

3

Essential Phone (Essential PH-1)

Essential Phone PH-1 with Essential written in the foreground. Credit: Lucas Gouveia/How-To Geek | Essential Products

The Essential Phone had a lot going for it even before it hit the shelves. The brainchild of Andy Rubin, the father of Android, the phone created quite a buzz in the tech world back when it was announced in the spring of 2017. Its bold design, which debuted the notch, ditched the 3.5mm headphone jack, and made the two camera lenses flush with the phone’s slick ceramic back, was a head turner.

Early promotional photos showed the phone with a camera module attached. It was later revealed that the Essential PH-1 features a magnetic Click Connector on the upper right of its back. The connector allowed the PH-1 to be used with custom-made modules, and while Essential only provided one module at launch, the 360° camera, it promised more modules further down the road.

Essential Phone with its 360 camera module attached to it. Credit: Essential

Alas, the Essential PH-1 didn’t sell that well, even after receiving a $200 price reduction shortly after launch. This affected Essential’s promise of modularity. Ultimately, we only got one extra module that incorporated a headphone jack and a high-end DAC. While the PH-1 had a lot of promise (I loved its vanilla Android experience, modularity, and flush design), it didn’t pan out. Its successor, the Essential PH-2, was canceled, we never got new modules, and Karl Pei’s Nothing bought the Essential brand in 2021.

4

Motorola Moto Z

A Motorola Moto Z phone against a green background Credit: Motorola

Motorola’s Moto Mods modular ecosystem is, hands down, the most well-received, popular, and longest-lived modular phone undertaking in history. It all started in 2016 with the release of the Motorola Moto Z, one of the thinnest phones of all time and a real looker even by modern standards.

Drawing on experience from working on Google’s Project Ara, Motorola’s engineers developed a magnetic attachment system powered by pogo pins that used barely any space on the Moto Z’s slender body. The phone arrived with a wide selection of Moto Mods, including a power bank, a great-sounding JBL speaker, as well as more exotic add-ons such as a projector and a full-fledged point-and-shoot camera with a 10x zoom.

Various moto mods modules lying on a table Credit: Motorola

Unlike other modular phone projects, Motorola provided a wide selection of Moto Mods at launch and greatly expanded the offering over the years. The company supported Moto Mods across four generations of Moto Z devices, with a total of 7 phones compatible with modular add-ons. Even some community-developed Moto Mods projects saw the light of day, like the slide-out keyboard mod.

Unfortunately, the Moto Mods project was abandoned in 2019, with the Moto Z4 being the last modular handset from Motorola. Despite its demise, Moto Mods left the deepest mark on the promise of modularity in Android, which still (kind of) lives on.

Samsung Galaxy S25 Edge and Moto Z


Samsung’s “Thin” Galaxy S25 Edge Is Thicker Than a 9 Year Old Motorola Phone

Phones have gotten thicker.

5

Fairphone

Fairphone 5 front and back Credit: Corbin Davenport / Fairphone

While not as exciting as other phones on this list, the Fairphone series of Android smartphones is the closest thing we’ve gotten to Google’s Project Ara. Aside from the original Fairphone, every member of the Fairphone family is an easy-to-repair, modular Android phone.

Instead of extra features, modular parts in Fairphone devices are there to allow for a high degree of repairability. They include the display, camera module with interchangeable lenses, an easy-to-replace battery, the SoC module, and modular daughterboards and flex cables.

A Fairphone 6 with its back removed Credit: Fairphone

They’re straightforward to remove and reattach, allowing owners to repair their phones by themselves from the comfort of their home. All you need are some screwdrivers and tweezers, spare parts you can order directly from the Fairphone spare parts shop, and you’re off to the races.

Despite being one of the easiest phones to repair, the latest Fairphone offering—the Fairphone 6—is anything but popular. It’s a niche device that the mainstream audience, as well as many enthusiasts, aren’t interested in, because being fully modular entails certain compromises (a plastic body, a mid-range chipset, cameras that trail high-end options, and more) that most phone users don’t want to deal with.


While the promise of modularity was exciting in the 2010s, the cold, harsh truth is that most of us will always choose high-end features and hard-to-repair unibody designs over sustainable, repairable modular phones.

iPhone MagSafe and accessories


Apple Proved Modular Accessories Work, But Can Anyone Else Do It?

Apple succeeds where many have failed.



Source link