How Do Free VPNs Make Money?

Six models cover almost all of them: freemium, advertising, data brokerage, bandwidth resale, nonprofit funding, and bundling. Working out which one a service uses tells you more than any review, because the funding model determines the incentives, and the incentives determine everything else.

Start from the cost. Running a VPN means paying for server capacity, bandwidth, and IP address space — all of which scale up with users and usage rather than down. There’s no economy of scale that makes a large free user base cheap. So the money is coming from somewhere, and it’s a fair question to ask where.

1. Freemium

How it works. A paid subscription business offers a limited free tier — capped data, limited server choice, one device, lower priority. Paying customers cover the cost of free users, who function as a marketing channel.

What it implies. The incentives point the right way. The company’s revenue comes from subscriptions, so its interest is in you upgrading, which requires you to trust it. Collecting and selling your data would directly undermine the product it’s selling.

How to spot it. There’s a clear paid tier and the free one has explicit, prominently stated limits. The limits are the point — they’re how the funnel works.

Caveat. The limits are usually restrictive by design. That’s honest, not stingy: an unlimited free tier would consume the revenue that funds it.

2. Advertising

How it works. The app shows ads, often through a third-party ad network.

What it implies. Depends heavily on the ad implementation. Basic display ads served without targeting are relatively benign. Targeted advertising requires data about you, and ad SDKs embedded in an app frequently collect device identifiers, location, and usage data on the ad network’s behalf — not necessarily on the VPN provider’s.

That second point is worth sitting with. An app can be honest about its own practices while embedding a third-party SDK with its own separate data collection.

How to spot it. Obvious — you’ll see ads. Less obvious is what the ad SDK does, which is in the privacy policy’s third-party section rather than the headline claims.

3. Data brokerage

How it works. The service collects data about users and monetises it — browsing patterns, app usage, device information, aggregated behavioural data — by selling or licensing it to third parties.

What it implies. This is the model most at odds with the point of using a VPN, since it means the service is doing what you installed it to prevent. It’s also worth stating clearly: this is a real model that exists in the market, and it is generally disclosed — buried in a privacy policy, described in careful language, but disclosed.

How to spot it. Read the privacy policy for what is collected and who it’s shared with. Language about “aggregated and anonymised data”, “marketing partners”, “affiliates”, or “business purposes” in a service with no other visible revenue source is the signal. If there’s no paid tier, no ads, and no donation model, the revenue is coming from somewhere.

4. Bandwidth resale / peer-to-peer routing

How it works. Your device’s spare bandwidth and IP address are used to route other people’s traffic, and that capacity is sold as a residential proxy service to commercial customers.

What it implies. You’re not the customer or the product — you’re the infrastructure. The significant consideration is that traffic from other parties may exit the internet from your IP address, which means activity you have nothing to do with can be attributed to your connection.

How to spot it. Terms about “sharing your resources”, “peer-to-peer network”, or “contributing bandwidth”. Often presented as the price of the free tier, and sometimes it’s genuinely upfront about it. Look for it specifically, because the implications are unusual.

5. Nonprofit and grant-funded

How it works. Funded by donations, grants, or a parent organisation with a mission. Typically built for people in circumstances where paying isn’t possible — journalists, activists, users under censorship.

What it implies. Generally the most aligned incentives available, since there’s no commercial pressure on user data at all. Capacity is usually limited by funding.

How to spot it. Explicit nonprofit or foundation status, published funding sources, and often open-source code.

6. Bundled

How it works. A VPN included with something else you already pay for — a security suite, a browser, a hardware purchase, a mobile plan.

What it implies. The VPN is a retention feature for the main product, so the economics are usually straightforward. The relevant question is what the parent company’s data practices are, since those govern.

How to spot it. It arrived with something else.

How to work out which one you’re using

In order of usefulness:

1. Look for a paid tier. Its existence points at freemium. Its absence means the revenue is elsewhere.
2. Read the privacy policy’s collection and sharing sections. Not the marketing page. Look specifically at what is shared, with whom, and for what purpose.
3. Check the app’s stated permissions and data-collection disclosures in the app store listing. Compare that against what a VPN actually requires.
4. Search for who owns it. Corporate ownership is often public and often informative — particularly if the parent’s main business is advertising or data analytics.
5. Ask what limits exist. Genuinely unlimited free service with no visible revenue is the configuration that most warrants a closer look, because the costs are real and continuous.

None of this requires technical skill, and it takes about ten minutes.

What to do with the answer

Not all of these models are problems, and the point isn’t to frighten you off free services. Freemium and nonprofit funding are honest arrangements. Bundled is usually fine. Advertising is a spectrum.

The models worth understanding before you accept them are data brokerage and bandwidth resale, because in both cases the thing you’re giving up is not obvious from the app.

What each model means in practice for whether you should use it is covered in is a free VPN safe?, and the cases where free is genuinely the right choice are in when a free VPN is actually fine.