How Do Free VPNs Make Money? A Builder's Teardown
If a VPN costs you nothing, something else is paying for the servers, the bandwidth, and the engineers who keep it running. Bandwidth in particular is not free, and a VPN routes all of it. So the real question, how do free VPNs make money, is not rhetorical. It has a concrete answer, and you can read most of it directly in the app’s own code.
We build VPN apps and infrastructure, so to answer this properly we did what the consumer scare-listicles never do. We statically took apart a top-charting free Android VPN and read how its money machine is wired. Not to copy it, and not to name and shame it, which is why the app stays anonymous here. The goal is to show founders and product leads what a market-leading free VPN actually ships.
This is written for builders, not for someone shopping for a VPN to install. If you are weighing a free tier for your own product, it shows where the revenue really comes from, which parts are legitimate, and which parts cross a line you do not want to be on the wrong side of.
The short answer
Most free VPNs make money two ways at once. They show ads to the large majority of users who never pay, and they sell a subscription to the small minority who do. A smaller subset of free VPNs go further and monetize user data itself, which is where the bad reputation of the whole category comes from. The ad engine and the subscription upsell are the legitimate core. Selling data is the part that earns the scare headlines, and it is a choice, not a requirement of the free VPN business model.
The economics are lopsided in a way that surprises people. A free VPN can run almost entirely on a paying cohort in the low single digits of its user base, with everyone else monetized through advertising at a few cents to a few dollars per thousand impressions. That is why the free tier exists at all. It is a funnel and an ad surface at the same time, and a well-run one funds the servers without touching anything you would be ashamed of.
How free VPNs actually make money: the ad engine
The biggest surprise from taking the app apart is how much machinery sits behind one banner. A serious free VPN does not integrate a single ad network. It integrates a mediation layer that pulls demand from twenty or more networks at once and auctions every impression. This is the core of how free VPN apps make money at scale.
Mediation, bidding, and the price-floor waterfall
Mediation is the aggregator between the app and the ad networks. Instead of hard-coding one provider, the app talks to a single mediation SDK that brokers every ad request out to all the networks wired into it. The roster is the one you would expect from any large free app: Google AdMob, AppLovin, ironSource, Unity, Vungle and Liftoff, InMobi, Bigo, Pangle, Mintegral, Yandex, and more. Naming them is not the point; the point is that all of them compete for the same slot.
They compete two ways at once, and modern stacks run both. The first is real-time bidding: networks that support it submit a live price per request, and the highest bid wins that impression. The second is a price-floor waterfall: networks are stacked by a fixed minimum price, the app asks the highest floor first because those impressions are worth the most, and it falls down the ladder until something fills. A house ad (promoting the app’s own subscription or a sibling app) sits at the very bottom, so almost no impression goes to waste.
Why go to this much trouble? Two reasons: fill and eCPM. Fill is the share of ad requests that actually return an ad. eCPM is what you earn per thousand impressions. One network alone leaves both on the table. Stack twenty and the auction gets denser, the clearing price rises, and the long-tail countries where one network has no advertisers get filled by another. The breadth is the product.
Server-driven and segmented by country
None of this is hard-coded. The waterfall, the floors, the frequency caps, and the kill switches all arrive from the backend as config, so the operator retunes monetization without shipping an app update. The teardown showed separate ad configs by region, because ad economics are uneven across countries. A network that dominates one market has no demand in another, and sanctioned markets drop networks that will not serve or pay there. eCPM and fill can swing by an order of magnitude between a high-income country and a low-income one, so the same app quietly serves a different ad stack depending on where the user opens it.
The most valuable moment: the VPN connect
Every app has one moment worth more than the rest. In a VPN it is the connect event, the instant the user taps to connect and waits for the tunnel to come up. That pause is a natural break in the flow, and the user’s attention is already on the screen. It is the best interstitial slot in the product, and the app we examined treats it exactly that way, preloading an interstitial and showing it right around the connect moment.
This is also where the compliance line runs straight through the design. The reference app briefly delayed the connection while the ad loaded, and delaying the user’s core action to serve an ad is the pattern that gets VPN apps flagged. Google Play’s ads policy treats interstitials that interfere with normal use, or that appear before the action the user asked for actually happens, as disruptive ads, and enforcement can mean removal. The defensible version is narrow: show the ad after the connection succeeds, cap any load wait hard, and never trap the back button or block the user from what they came for. The connect moment is valuable precisely because it respects the user’s intent; abuse it and you lose both the user and the listing.
The rewarded “earn more time” loop
The bridge between the free tier and the paid tier is a rewarded ad, and it is the most elegant piece of the whole design. Free sessions are time-limited. When the clock runs low, the app offers a choice: watch a short rewarded video to add more minutes, or subscribe to remove the limit and the ads entirely. Every time-out becomes either an ad impression or a subscription prompt.
Rewarded is the format Google and the ad networks favor most, because the user opts in for a clear exchange of attention for value. That makes it the highest-eCPM, most policy-safe format in the stack, and it sidesteps the unexpected-ad problem entirely because the user asked for it. It also does quiet double duty. A user who repeatedly chooses to watch an ad for more time is telling you they value the product, which is exactly the signal that warms them up for the subscription offer. The same moment that sells an impression today qualifies a subscriber for tomorrow.
The one discipline it requires is pacing. The teardown showed cooldowns, per-session caps, and limits on how often the “you are out of time” dialog can reappear. Left uncapped, the loop nags, users leave, and the “too many ads” reviews are the ones that draw platform scrutiny. Frequency caps here are a retention feature, not just a courtesy.
Subscriptions: the other engine
Ads monetize the many. Subscriptions monetize the few who are worth the most. The product IDs we pulled out of the app told the whole subscription strategy on their own: three price cohorts, three durations (weekly, monthly, annual), and modifiers for a free trial and a steep win-back discount.
That is a textbook subscription machine, and each piece has a job:
- Price cohorts (A/B/C). The backend assigns new users to different price groups, so the operator can test what each market will actually pay rather than guess a single global price.
- Weekly anchored against annual. A weekly plan priced high per week makes the annual plan look cheap by the day. The weekly option is not really there to be bought. It is there to make annual look like the sensible choice.
- Free trials. A short trial on the flagship plan lowers the barrier to starting and converts far better than asking for money cold.
- Win-back discounts. A deep discount aimed at lapsed or price-sensitive users recovers revenue that would otherwise churn away.
The important mental shift for a builder is that these two engines are complementary, not competing. The same high-intent moments that show the best ads (connecting, running out of time, tapping a premium server) are also the best places to offer the subscription, so you measure them together. Blended revenue per user across ads and subscriptions is the number that matters, because pushing one at the expense of the other just moves money between pockets. This freemium VPN structure, free tier plus paid upsell, is the model most of the category runs on.
The honest part: where free VPNs cross the line
Everything above funds a free VPN without doing anything shady. Ads and a subscription upsell are a legitimate business. But the category has an ugly reputation, and it is earned by a real subset of apps that monetize something they should not: the user.
A VPN is uniquely positioned to abuse trust because it sees all of the traffic. The same access that lets it protect you lets a dishonest operator inspect, log, or sell what flows through the tunnel. The research on this is not new and it is not kind. A widely cited 2016 study of 283 Android VPN apps by researchers at CSIRO and ICSI found that roughly three in four embedded third-party tracking libraries, and about 38% showed signs of malware or malvertising, with a number of apps intercepting TLS traffic or leaking DNS (An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps). That is inside a tool people install specifically for privacy.
The clearest named example is Facebook’s Onavo. It was marketed as a free VPN, and its real purpose was to collect data on what people did on their phones, which Facebook used for competitive intelligence. Apple pulled it from the App Store in 2018 for breaking its data-collection rules (The Verge). The VPN was the delivery mechanism. The data was the business.
Even short of selling traffic, several patterns sit on the wrong side of the line for a privacy product. The app we examined requested permission to enumerate every other app installed on the device, carried an advertising ID, and bundled third-party analytics SDKs, including one whose origin sits uneasily inside a privacy tool. Little of that is illegal and much of it is common, but it is a conscious data-collection posture a founder should choose deliberately, not inherit by default from an SDK. The worst end of the spectrum is the “free” VPN that turns the user’s own device into an exit node for other people’s traffic, reselling the user’s bandwidth and IP address. At that point the user is not the customer or even the product. The user is the infrastructure.
It helps to treat free VPN monetization as a spectrum rather than a verdict:
| Attribute | Trustworthy free VPN | Toxic free VPN |
|---|---|---|
| Primary revenue | Ads plus subscription upsell | Selling user data or bandwidth |
| Data posture | Minimal, disclosed, no traffic logging | Broad collection, quiet SDKs, traffic inspection |
| Permissions | Scoped to what the VPN needs | Installed-app lists, excessive access |
| The user is | The customer being converted | The product being sold |
| Ad formats | Rewarded, capped interstitials | Whatever pays, however intrusive |
The model on the left funds itself honestly. The model on the right funds itself with the thing the user came to protect. Same category, opposite ethics.
What this means if you are building one
The reassuring conclusion is that you do not need the shady stuff. A free tier can pay for itself on advertising and a subscription upsell alone, and the whole legitimate machine (mediation, rewarded time, contextual subscription offers) is exactly the part a market leader already runs. The dark patterns are not the engine. They are a bolt-on some operators add for extra margin, and they are what invites lawsuits, app-store removals, and the reputation the category carries.
We have skin in this. DigitalD.tech operates a consumer VPN brand of our own, Onion VPN, so these are not abstract trade-offs for us. We have had to make the same calls on what to log (as little as possible), which SDKs to allow near the tunnel (very few), and how to fund a free tier without selling anyone out. We tell people to press every VPN vendor hard on this question, and that includes us.
If you are scoping a free tier, a few principles keep you on the right side of the line. Fund it with ads and a subscription upsell, not with data. Put rewarded “earn more time” at the center, because it is the most policy-safe format and it feeds your subscription funnel. Keep the ad config server-side so you can pull a misbehaving network instantly. Disclose exactly what you collect, log as little as you can, and keep third-party SDKs away from the tunnel. Build on the official frameworks with an honest store listing, because VPN apps get more scrutiny than most and a rejection can cost weeks.
For the wider picture, our guide on how to start a VPN business covers the models and economics, and the companion piece on how to monetize a VPN app turns this teardown into a builder’s playbook. If you are budgeting the build itself, what a VPN app costs to develop has realistic numbers.
FAQ
Do free VPNs sell your data?
Some do, many do not, and you cannot tell from the marketing. The honest ones fund themselves with ads and subscriptions and keep data collection minimal, but a real subset monetize user data directly, and a VPN that does can see a lot. The 2016 CSIRO and ICSI study found third-party tracking in the majority of the free VPN apps it tested. Judge a provider by its logging policy, permissions, business model, and independent audits, not by the word “free.”
How do free VPNs make money without selling data?
Advertising plus a subscription upsell. The large majority who never pay are monetized through in-app ads, brokered across twenty or more networks by a mediation layer that auctions every impression, while the minority who convert pay for an ad-free subscription. A rewarded “watch an ad for more VPN time” loop bridges the two. That combination funds the servers without touching user data, which is how a trustworthy free tier is supposed to work.
Are free VPNs safe?
It depends entirely on the operator. A free VPN from a reputable company with a clear no-logging policy and a legitimate ad-and-subscription model can be safe to use. One from an unknown publisher that over-collects permissions, bundles trackers, or routes your traffic as an exit node is not. Because the app sees all your traffic, the trust bar for a VPN is higher than for an ordinary free app, not lower.
How much do free VPNs make?
There is no single figure, and it swings hugely with scale and geography. Revenue is a product of daily active users, how many see ads, the eCPM in their countries, and the subscription conversion rate, and eCPM alone can vary by an order of magnitude between a high-income market and a low-income one. A large free VPN with tens of millions of users can be a substantial business on ads and subscriptions combined; a small one may barely cover its bandwidth. The model scales with users, which is why free tiers chase volume.
Can a free VPN be trustworthy?
Yes, if its business model does not depend on exploiting you. A free VPN funded by advertising and honest subscription upsells, with minimal logging and disclosed data practices, can be trustworthy. The test is whether the company makes money from your subscription and attention, or from your data and bandwidth. Read the logging policy, check the permissions, look for an independent audit, and prefer providers whose paid product is the real business.
The short version
So, how do free VPNs make money? If you are not paying, they usually fund it honestly, by showing you ads or upselling a subscription, and occasionally dishonestly, by selling your data or bandwidth. The dual-engine model of ads plus subscriptions is legitimate, and it is what the market leaders actually ship. The data-selling is a separate, deliberate choice. So the model is fine. What separates a free VPN you can trust from one you cannot is the execution and the data ethics, and if you are building one, that line is yours to draw.
Thinking about a free tier for your own VPN and not sure how to fund it without crossing that line? DigitalD.tech can help you design the app, the ad and subscription stack, and the data posture around a business model you can defend. Tell us your market and plan, and we will tell you what we would build. Talk to us, or see our white label VPN options.