Do Free VPNs Sell Your Data? Follow the Verbs
- Start with the Customer You Can't See
- “Sell” Is One Verb in a Longer Sentence
- Make Four Separate Data Maps
- Follow Each Recipient Past the Policy Door
- App Analytics Aren't Tunnel Logs
- Your Bandwidth Can Be the Product
- Controls Need the Right Target
- Test What the Screen Can't Promise
- The Answer Is a Data Flow, Not a Slogan
The privacy policy says, “We do not sell your personal data.” Three paragraphs later, it says identifiers may be shared with advertising and analytics partners. The first sentence may be legally accurate. It still hasn't answered the question you meant to ask.
Some free VPNs may monetize information. Others are supported by paying subscribers and collect little operational data. There is no honest universal yes or no. Trace what this operator collects, what it calls the data, who receives it, and what those recipients may do.
Start with the Customer You Can't See
Servers, bandwidth, app development, fraud handling, and support need recurring funding. A free service should make the paying side of the exchange visible.
Subscribers may fund a limited free tier. Donations may support a public-interest service. Other apps may rely on advertising, analytics, sponsorships, affiliate deals, a portfolio of related products, or contributed device resources.
None of those labels delivers a verdict alone. Advertising can range from a contextual ad inside the app to profiling across services. A paid service can still collect too much. The useful question is who gains value when you connect—and from what.
Two people install the same app. One sees a zero-dollar receipt. The other maps the operator, parent company, ad partners, and product family. Only the second has begun to identify the business model.
“Sell” Is One Verb in a Longer Sentence
Everyday speech uses “sell” to mean almost any commercial data use. Privacy laws and company policies often define sale, sharing, service-provider processing, targeted advertising, and business transfers separately.
California's current CCPA overview, for example, describes distinct rights to know how information is used and shared, to delete it subject to exceptions, and to opt out of sale or sharing. That is one jurisdiction's framework, not a global dictionary for every VPN policy.
A no-sale sentence may therefore coexist with analytics vendors, affiliate disclosures, cross-context advertising, or a merger clause. Don't assume deception; don't stop reading either. Find the policy's definitions and apply them to the actual transfers it permits.
A VPN can change the IP address a site sees while logins, cookies, device identifiers, and browser fingerprints continue linking activity. “The website didn't get my home IP” and “nobody can track me” are very different claims.
Make Four Separate Data Maps
Create columns for the account, provider website, client app, and VPN infrastructure. A policy can treat them differently.
Account data may include an email address, subscription status, support history, or payment records. Website data may include cookies and referral tags. App telemetry may record launches, buttons, crashes, device models, versions, and advertising identifiers. Tunnel systems may handle source and assigned IPs, session times, bandwidth totals, DNS requests, or destination-related data.
Now connect the rows. Which identifiers can link those columns? A crash report detached from an account presents a different risk from a device ID joined to a source IP and session history. Retention matters because data that is promptly discarded can't be queried like a year-long record.
- Maps the many ways companies and governments collect data during ordinary online activity
- Makes large-scale surveillance understandable without requiring a technical background
- Helps readers question privacy promises and recognize the tradeoffs behind convenient services
Search for the nouns: IP, DNS, browsing, timestamp, identifier, advertising, analytics, location, retention, partner, and affiliate. Then search for the verbs: collect, use, combine, share, disclose, retain, and delete.
“No activity logs” may narrowly exclude browsing destinations while saying nothing about connection metadata or product analytics. Preserve that distinction. A limited claim isn't automatically false, but it shouldn't be inflated into total invisibility.
Follow Each Recipient Past the Policy Door
A processor handling crash reports under the VPN company's instructions is different from an advertising partner permitted to use an identifier for its own purposes. The policy should name recipient categories, data categories, and purposes clearly enough to tell those relationships apart.
Watch broad phrases: “may share,” “including but not limited to,” “business purposes,” and “trusted partners.” They can preserve discretion without showing which information crosses the line. Look for regional privacy notices and opt-out pages that make the general text concrete.
The FTC's 2024 final Avast order isn't a case about a free VPN. It is a nearby warning about reading privacy marketing critically: the agency alleged detailed browsing data was sold after privacy-protection claims, and the final order imposed restrictions and deletion requirements.
Use enforcement cases as proof of a documented case, not proof that every security app behaves the same way.
App Analytics Aren't Tunnel Logs
The VPN app can collect diagnostic events even when the servers don't store browsing activity. Conversely, a sparse mobile disclosure can't demonstrate what a provider's DNS and server systems retain.
Google Play says its Data safety section is populated from developer declarations about collection, sharing, and security practices. Read it, but don't treat a disclosure form as an audit.
Compare the store page, installed permissions, in-app analytics controls, full policy, and any independent assessment. Check whether diagnostics are optional and whether an opt-out applies only to advertising, only to the website, or also to app telemetry.
One observer watches the app send a crash report. Another reads the server audit. Neither can substitute for the other's view because they cover different systems.
Your Bandwidth Can Be the Product
Some free network services use participant devices or residential connections as peers. That isn't the same transaction as selling a behavioral profile, but it can commercialize your bandwidth and public IP.
Hola's own FAQ, for example, says some free users contribute network resources and that approved businesses pay for access to the network. The point isn't to turn one documented model into a claim about all free VPNs. It is to widen the business-model check beyond ad trackers.
Peer participation should be prominent, specific, and deliberately accepted. Find which devices participate, when resources may be used, how to opt out, and what abuse controls exist. If you didn't knowingly volunteer your connection as infrastructure, remove the app and its VPN profile.
Controls Need the Right Target
Disabling ad personalization may reduce one use without deleting connection records. Deleting the app may leave an account and stored data intact. Resetting an advertising identifier may break one link while an email address or device account keeps another.
Use every control for the stream it actually governs. Request access or deletion where available. Save confirmation. Look for a “Do Not Sell or Share” control when relevant to your location, and check whether the provider honors a browser's Global Privacy Control on its website.
Keep unique passwords and strong multifactor authentication on important accounts. A VPN can alter routing, but signed-in services still know who signed in. Browser and account controls remain part of the privacy plan.
Revisit the policy after an acquisition. Business-transfer clauses can move stored information to a new owner whose incentives differ from the company you first evaluated.
Test What the Screen Can't Promise
No home test can reveal every database at a provider. You can still catch contradictions.
Connect with low-risk traffic. Compare public IP addresses, then test DNS and IPv6 behavior. Interrupt the tunnel during a harmless reload and verify the kill switch or operating-system blocking mode. Watch for injected ads, altered search pages, redirects, unexpected certificate warnings, and unexplained background use.
Technical research is bounded, too. A test covers particular app versions, servers, devices, and conditions. A clean leak test doesn't prove a retention claim; a tracker in one version doesn't prove a current server records browsing.
The practical goal is control, not omniscience. Combine what the app does on your device with what the operator permits itself to do on paper and what scoped independent evidence has tested.
- Connects everyday data collection to real choices about freedom, power, and control
- Explains why privacy matters even when you have nothing to hide
- Turns a broad social issue into practical questions you can apply to your digital life
If those layers disagree, the contradiction matters more than the “free” label.
The Answer Is a Data Flow, Not a Slogan
Write one sentence before connecting: “This service is funded by ___, collects ___, keeps it for ___, and shares it with ___ for ___.” If the blanks survive a careful read, the policy hasn't earned your traffic.
Don't say every free VPN sells data. Don't let “we don't sell” end the inquiry. Trace the funding model, four data streams, identifiers, recipients, retention, controls, and peer use.
A trustworthy free service makes that flow understandable before the tunnel opens. When it doesn't, uncertainty isn't proof of a secret sale—but it is a concrete reason to choose an operator that can finish the sentence.