In this report:
- A study of popular free VPNs on Google Play found significant privacy problems.
- What a VPN does, and why a free one can cost you your data.
- What incognito mode and private browsers can and can’t do instead.
- How to choose a VPN you can trust.
We make Incognito Browser, a private browser for Android that is mentioned in this article. It is not a VPN.
The Hidden Dangers of Free VPNs
Free virtual private networks (VPNs) are more tempting than ever as privacy worries grow. But research suggests many of them put users at risk. In a 2024 study, the VPN review site Top10VPN tested the 100 most popular free VPN apps on Google Play, which together had been installed more than 2.5 billion times, and found serious privacy and security problems in most of them. The lesson is to choose privacy tools carefully and know what each one actually does.
Uncovering Privacy Flaws
Simon Migliano of Top10VPN, who ran the tests, analyzed the apps’ code and network traffic. He found that almost 90% of them suffered some kind of data leak, most often involving DNS requests. Seventy-one percent shared personal data with at least one third party. And 19% were flagged as malware by antivirus scanners, though Top10VPN says those flags should be viewed with low confidence and doesn’t claim the apps are actually malware. These findings are troubling, because people use VPNs specifically to protect their privacy.
The results also show why it helps to know what each privacy tool does. A private browser such as Incognito Browser keeps your browsing history off your phone: it runs in private mode all the time and wipes history, cookies and sessions when you exit the app. It does not hide your IP address or route your traffic through an encrypted tunnel, so it is not a substitute for a VPN. The sites you visit and your internet provider can still see your activity.
How Free VPNs Compromise Your Data
A VPN hides your IP address from the sites you visit and hides your traffic from outside parties such as your internet provider or others on the same Wi-Fi network. A reliable VPN creates an encrypted tunnel from your device to its server. But that protection depends on the VPN provider, because all your traffic passes through its servers. (For more, see how privacy browsers compare to VPNs.)
Many paid VPN services advertise protections such as strong encryption, RAM-only servers and independent no-logs audits. Free VPNs often fall short. Without subscription revenue, many free VPN providers make money through ads or by sharing user data with third parties. That defeats the purpose of using a VPN and can expose users to more risk.
Where a Private Browser Fits
If your main concern is keeping your browsing history off your device, you don’t need a VPN for that: incognito mode or a private browser does it. Incognito Browser, the Android browser we make, opens every tab in private mode and wipes history, cookies and sessions when you exit the app. Downloaded files are kept. It also has a built-in ad blocker.
A private browser does not stop the websites you visit from seeing your IP address, and it doesn’t hide your activity from your internet provider. If you need that, use a trustworthy VPN or Tor Browser. Every app has its own data practices, too: Incognito Browser’s Google Play Data safety section says it may collect crash logs, diagnostics and other app performance data, for analytics.
The Growing Popularity, and Risks, of Free VPNs
Despite these risks, demand for free VPNs keeps growing. According to Top10VPN, the 100 most popular free Android VPNs had around 260 million total installs in 2018; by the time of its 2024 study, that number was more than 2.5 billion. Many of the people installing them may be giving up privacy without knowing it.
The economics explain why. Free VPN apps often make money from ads or user data. In the study, 71% of the apps shared personal data with third parties, and at least 29 sent some personal user data to their own servers. The study also found that 93 of the 100 apps had Data safety labels on Google Play that didn’t match their own privacy policies.
What Can You Do?
Top10VPN’s advice is to pay what you can afford for a VPN, even a cheaper one, so the provider doesn’t need other ways to make money. If any fee is out of the question, it says a good free Android VPN is possible if you do your research, though it will come with trade-offs such as a data cap or limited servers. Consider the free plan from an established provider, such as Proton VPN, whose free tier has no ads, and read the provider’s privacy policy, not just its app listing. A trusted service with limits is better than an unknown app that shares your data.
Journalists, activists and NGO workers facing censorship can apply for free emergency access from some paid providers. Surfshark and IPVanish both run Emergency VPN programs; check each provider’s page for current eligibility.
Finally, match the tool to the job. If you want to keep your browsing history off your phone, a private browser such as Incognito Browser does that. If you need to hide your IP address or protect your traffic on public Wi-Fi, use a VPN you trust.
Learn what your privacy tools actually do, and make informed choices about the ones you rely on, whether that’s a private browser, a VPN, or both.
