A thread on Reddit this summer put a hard number on a suspicion a lot of people already had. Researchers from the University of Michigan, the University of New Mexico, and IIT Delhi presented a study at the Network and Distributed System Security Symposium in February 2026. They looked at free Android VPN apps and found a pattern that cuts against the promise on the install screen. More than 80 percent of the tested apps contacted advertising or tracking domains. Sixty-one apps sent some of their own data without encryption. Seventy-six transmitted the Android Advertising ID. Together, the problematic apps had more than 2.4 billion installs.
That is not a niche complaint about one shady listing. It is a description of how a large part of the free VPN market actually behaves. The same week, posts on X made a related point that is easy to miss: HTTPS encrypts the page, but it does not hide the domain name from your internet provider. The server name still travels in the handshake. A VPN is one of the few consumer tools that wraps that metadata too. The two points belong in the same conversation. A free app that claims to hide you, then phones home to ad networks, does not solve the problem it advertises.
This post walks through what the study actually showed, what it does not prove, and how to decide whether the app on your phone is doing the job you installed it for. The NordVPN links in the right sidebar and at the bottom of this page are there if you want a paid route instead of another free install.
What the researchers measured
The paper was not a review of speed tests or server lists. It looked at behavior: where the apps connected, what identifiers they sent, and whether their own traffic was protected on the wire. A few findings are worth separating, because they fail in different ways.
- Tracker contact. More than 80 percent of the tested apps reached advertising or tracking domains. The researchers identified those domains with EasyList, EasyPrivacy, and Disconnect. An app can still pass traffic through a tunnel and, at the same time, report who you are to an ad network.
- Unencrypted app traffic. Sixty-one apps sent their own data to servers without encryption. That traffic was generated by the app, not by the sites you visit, but an ISP, a café router, or anyone on the same open Wi-Fi can still see or alter it.
- Advertising ID. Seventy-six apps transmitted the Android Advertising ID. Others shared IP addresses, device model, operating-system version, language, or location. Those fields are enough to tie a “private” session back to a profile.
- Scale. The problematic set had accumulated more than 2.4 billion installations. Install count is not a quality signal. It is a distribution signal.
A separate claim around SplitVPN, discussed alongside this research, was even starker: a cache of connection logs on the order of 58 million records. A service that markets itself on a no-logs promise and then holds connection logs has already failed the only test that matters. Logs are not a paperwork issue. They are the thing a court, a breach, or a buyer of the company can later demand.
What the study does not say
It does not say every free VPN is malicious. It does not say a paid subscription is automatically clean. A subscription can still log, still sit in a country with weak oversight, and still ship a client that leaks DNS. The useful reading is narrower. If the business model is ads, the incentive is to know who you are. If the business model is a subscription and a published no-logs design, the incentive runs the other way. Incentives are not proof. They are the first filter.
Why “free” and “private” rarely share a balance sheet
Bandwidth is not free. A VPN provider pays for servers, IP addresses, abuse desks, and support. A free app covers that cost somehow. The common covers are ads inside the client, sale of aggregated telemetry, a bait plan that throttles you into a subscription, or a side business in residential proxies, where your connection becomes someone else’s exit node. None of those covers require the company to be competent at privacy. Some of them require the opposite.
The Android Advertising ID is a good example. It exists so advertisers can recognize a device across apps. A VPN that sends it has handed an ad network a stable handle on the person who installed the privacy tool. Blocking trackers in a browser and then identifying yourself from the VPN client is a wash. You moved the tracking from the page to the tunnel.
There is a second failure mode that has nothing to do with ads. Posts on X today put it plainly: HTTPS is an improvement, and your provider can still see which domains you connect to, because the server name is exposed in the handshake. That is called SNI, and it is enough for a network operator to know you opened a bank, a health site, or a news site, even when the page body is encrypted. A VPN that actually tunnels DNS and traffic hides that name from the local network. A VPN that leaks DNS, or that only proxies some apps, does not. The NDSS apps that sent their own traffic in the clear failed a simpler version of the same test.
How to check the app you already have
You do not need a lab to do a first pass. Work down this list before you keep a free client installed.
- Read the privacy policy for logs, not for adjectives. Look for connection timestamps, source IP, assigned VPN IP, and DNS queries. “We respect your privacy” is not a retention schedule. A real no-logs policy says which records are never written.
- Check the developer and the jurisdiction. A brand with no company name, no address, and a support address on a free mail host is a hobby project or a throwaway. Jurisdiction matters because that is where a data demand lands.
- Look at the permission list. A VPN needs the VPN permission. It does not need your contacts, SMS, or location. Extra permissions are a reason to uninstall, not a reason to tap through.
- Test for DNS and IPv6 leaks. Connect, then open a leak-test page. If your ISP’s DNS servers appear, or your real IPv6 address appears beside the VPN’s IPv4 address, the tunnel is partial.
- Turn the kill switch off and on. Drop the VPN and reload a page. Traffic should stop, not fall back to the open network. A kill switch that only works on Wi-Fi, or only inside the vendor’s browser, is not a kill switch.
- Watch for ad SDKs. If the client shows banners, those banners are loaded from somewhere. That somewhere is a third party that can see the app is running, and often more than that.
Fail any two of those and the app is not a privacy tool. It is a proxy with a logo. Uninstall it and revoke the VPN permission in system settings so it cannot reconnect in the background.
What a paid no-logs service changes
Paying does not make a provider honest. It removes the need to sell your attention. The checks that matter after that are public and repeatable.
- A written no-logs policy that names what is not stored: browsing history, traffic destination, DNS queries, and the IP address assigned during a session.
- An independent audit, with a date, that tried to find those logs and reported whether the systems could produce them.
- A kill switch that blocks traffic when the tunnel drops, including on cellular handoffs.
- A client that does not ship an advertising SDK, and a business that does not need one.
- Enough servers that a streaming or banking block is a routing problem, not a reason to turn the VPN off and forget it.
NordVPN is built on that model: a subscription, a published no-logs stance, and clients for the platforms people actually use. It is not the only service that can say some of those things. It is a concrete alternative to the free apps in the NDSS set, which is the comparison this discussion calls for. If you want to look at plans, use the NordVPN links in the right sidebar or the matching links at the bottom of this page. Those are the paths this site maintains, and they keep the choice one click from the argument instead of a scavenger hunt.
A limit worth stating
No consumer VPN stops a company from reading what you type into its own app. It does not hide your identity from a site where you are logged in. It does not beat a device that is already compromised. It does hide your traffic from the local network, replace your visible IP, and, when the provider keeps no activity logs, leave much less for a later demand to collect. That is the job. Free apps that contact trackers and send an advertising ID are not doing it.
A sensible order of operations
Start with the threat you actually have. On café Wi-Fi, the threat is the local network, and any reputable tunnel is an improvement over nothing. On your home connection, the threat is your provider’s view of domain names and a profile built from them. On a phone full of free utilities, the threat may be the privacy app itself. Fix that one first.
Remove free VPN clients you cannot vouch for. Confirm the remaining client passes a leak test and holds a kill switch. Then decide whether a subscription is worth it for the networks you use in a normal week. If it is, the sidebar on the right and the links at the bottom of this page both go to NordVPN, which is the paid option this site recommends for that job. Read the current plan details there, compare them with the checks above, and install only after the policy and the client match what you were promised. A VPN earns trust by what it refuses to store, not by what the install screen claims on the way in.
Still Wondering?
Check out our NordVPN review to help you decide if this is the VPN that’s right for you. Need help with your connection? Start with our article about Deep Packet Inspection (DPI).