What an Ad-Funded VPN Is Actually Selling
An ad-funded VPN sells two things: your attention, and usually the data that makes your attention worth more. The first is visible and mostly harmless. The second happens inside a third-party advertising component that has its own business, its own data collection, and its own privacy policy — which is the part worth understanding before you decide the trade is fine.
And it can be fine. Advertising is a spectrum rather than a verdict, and where a particular app sits on it is usually discoverable.
Why ad revenue struggles against a metered bill
Display advertising in a mobile app pays per thousand impressions, and the rate depends on the market, the ad format, and how well targeted the ad is. Untargeted banner inventory is cheap.
Set that against the cost structure from why a VPN’s costs rise with every user: a recurring, volume-driven bill. An ad-funded VPN therefore has to solve a hard arithmetic problem — revenue that arrives per impression against costs that arrive per gigabyte. There are only a few ways out of it, and they are exactly the patterns you see in the market:
Serve more ads per session. Interstitials on connect, on disconnect, on server switch. Annoying, but the honest end of the range.
Gate the product on ad views. “Watch a short ad for another hour of connection” ties revenue directly to usage, which is the only structure that actually matches the cost curve.
Cap usage hard. An ad-funded tier still needs limits, for the same reason a freemium tier does.
Improve targeting. Targeted inventory pays substantially more than untargeted inventory. This is the lever that turns an advertising model into a data model, and it is where the interesting decisions get made.
The SDK is a third party in your app
Most apps do not sell their own advertising. They embed a software development kit from an ad network, and that component requests, renders, and measures the ads.
Two consequences follow, and they are the whole reason this model needs attention:
The SDK collects on its own behalf. Ad networks need identifiers to attribute impressions, cap frequency, and build audience segments. Depending on the network and the configuration, that can include an advertising identifier, device model, operating system version, coarse location, IP address, locale, and in-app events. The VPN provider may never receive or want any of it.
Its policy is not the app’s policy. An app developer can be entirely truthful about its own practices while shipping a component governed by someone else’s terms. This is why “we don’t log your traffic” and “an ad network is collecting device identifiers from this app” are both capable of being true at once.
Sit with that, because it explains a lot of the confusion in this category. The question is not only “is this provider honest” but “what else is in the app”.
What an ad-funded VPN is not doing
Being fair here matters. An ad-supported app is not automatically inspecting your traffic, and it is not the same as a data-brokerage model. Those are different arrangements with different signals, and conflating them is the sloppy version of this argument.
The relevant distinction: an ad SDK collects the kind of data ad networks generally collect from any app — device and usage signals. A data-monetisation business collects data whose value comes from what it says about your behaviour over time, and it does not need to show you anything at all. See do free VPNs sell your data for how those look different from the outside.
Where on the spectrum a given app sits
Rough ordering, least to most extractive:
- Static house ads or upsell prompts for the provider’s own paid tier. Not really third-party advertising at all; this is a freemium funnel with a louder voice.
- Untargeted or contextually targeted third-party ads. An SDK is present, but the inventory does not depend on knowing much about you.
- Behaviourally targeted ads. The SDK is building or contributing to a profile. Still an ordinary and widespread arrangement, and still a trade you might accept knowingly.
- Ads plus separate data sharing for non-advertising purposes. At this point advertising is one of at least two revenue lines, and the second one is the one to read carefully.
How to place an app on that scale
You can do this in a few minutes, without technical tools:
Look at whose ads they are. Ads for the provider’s own paid plan indicate freemium. Ads for unrelated products mean a third-party network is involved.
Read the privacy policy’s third-party section, not its headline claims. Look for named categories of partner — advertising networks, analytics providers, attribution services — and for what is shared with them.
Check the store’s data disclosures, particularly any category along the lines of “data used to track you”. That category exists specifically to describe cross-app advertising linkage. How to read those labels is in reading app store data labels.
Check whether opting out is offered. Your device’s advertising identifier can usually be limited or reset at the OS level, and some apps also offer a paid ad-free tier. The existence of that paid tier is itself informative: it means the provider has a subscription business too.
Notice whether ads are the only revenue. Ads plus a paid tier is a recognisable freemium-with-advertising hybrid. Ads with no paid tier means the ad revenue alone has to cover a metered bill, which is the case where the targeting incentive is strongest.
The honest summary
Ad funding is a legitimate way to pay for a free service, and for someone who cannot pay, an ad-supported tier from an identifiable company is a reasonable option. The trade is not abstract, though: you are accepting an additional party in the app whose business is knowing things about you.
If that trade is acceptable to you, the practical steps are to limit your device’s advertising identifier, prefer apps that also sell subscriptions, and read the third-party section of the policy once. If it is not, the models with no third-party component are freemium and nonprofit — see how donation- and grant-funded VPNs stay free.