VPN Data Harvesting 2026: Why 85% of App Store VPNs Are Worse Than No VPN

Disclosure: the sidebar link and the link at the end of this article are affiliate links. They cost you nothing extra and help keep this site independent.

I have spent about fifteen years on the defensive side of consumer security — decompiling mobile apps to see what they quietly send home, reading packet captures line by line, and translating the findings for people who simply want their phone to be safe. I also travel constantly, through enough hotel lobbies and airport lounges that untrusted Wi-Fi stopped being an abstract problem for me long ago. This VPN privacy guide comes out of both halves of that experience.

The most uncomfortable finding of the past year is this: for a great many people, the security app is the threat.

The 2026 numbers are worse than most people expect

In August 2026, the Swiss privacy company Proton published an analysis of more than 7,000 mobile VPN applications worldwide, narrowing its focus to the 390 actively downloaded through the App Store and Google Play in the United States. The researchers combined download estimates from the app-intelligence firm AppTweak with tracker detection from Exodus Privacy, an open-source project that scans Android applications for known advertising, analytics, and profiling components.

The headline figure: 85% of VPN apps downloaded in the United States contained trackers. These components can collect your advertising identifier, device model, network type, and mobile carrier — the precise raw material for building a persistent profile of a person.

Sixty-four of the 390 apps went further and accessed GPS or other geolocation data. Those location-harvesting apps accounted for roughly three million American downloads in a single month, about one-fifth of the dataset. Among them were familiar names from the top of the free charts: VPN Proxy Master, X-VPN, and VPN-Fast.

Ownership told a similar story. Proton traced 64 of the services to Chinese companies, 31 of which concealed their true ownership behind shell entities registered in Singapore, Hong Kong, and the United Kingdom. This is not a China-only problem: trackers shipping data to firms in Israel were linked to roughly 2.6 million downloads, and Russia to about 1.4 million. In total, Apple and Google permitted the flagged applications to be installed more than 13.2 million times in June 2026 alone.

One honest caveat: Proton sells a competing VPN, so this is not disinterested research, and a tracker’s presence does not by itself prove what a given provider does with the data. But the methodology is transparent and the tracker data is independently verifiable, which is more than most of the industry offers.

Why “free” is the entire explanation

Running a VPN is expensive in a way that is easy to overlook. Every byte you send travels twice — once to the provider’s server, once onward to the internet — and someone pays for that bandwidth and that engineering staff. When you are not paying, the money comes from somewhere else.

The mechanics of VPN data harvesting 2026 are mundane rather than exotic. A developer integrates a third-party advertising or analytics SDK, the SDK collects identifiers and location, and the resulting audience data is sold onward. Proton documented American-owned apps that had signed commercial agreements to embed tracking software supplied by foreign partners, plus white-label VPN products built specifically to be monetized this way. Several VPNs in the study are owned outright by market-research firms, which tells you plainly what the product is.

The structural irony is severe. A VPN sits between you and the entire internet and sees every destination you visit — the single most privileged position on your device. Handing that position to an advertising-funded application consolidates your whole browsing life into one commercial pipe. A free App Store VPN really can leave you worse off than no VPN at all, because without one your traffic is at least scattered across networks rather than pooled by a company with an incentive to sell it.

What a VPN actually protects on hotel Wi-Fi

Let me be precise here, because overselling this is how the industry lost credibility in the first place.

Nearly all web traffic is now encrypted with HTTPS, so the era when a stranger in the lobby could read your email off the air is largely over. What remains exposed is still meaningful. The network operator can see the domains you connect to, often through unencrypted DNS lookups. Captive portals and hostile hotspots can attempt redirection. Your IP address reveals your rough location and links your sessions across sites. And whoever actually runs that network can log all of it.

A trustworthy VPN closes those specific gaps: it encrypts the tunnel, moves DNS resolution to the provider, and replaces your visible address with a shared one. What it does not do is make you anonymous. It cannot protect an account you are logged into, defeat browser fingerprinting, or undo bad password habits. Anyone promising otherwise is selling something.

An encryption signal worth watching

If you want a technical way to separate providers who invest in engineering from those who merely market, watch which ciphers they adopt.

Most of the industry, NordVPN included, currently uses AES-256-GCM for OpenVPN and ChaCha20-Poly1305 for WireGuard-based protocols. These remain strong. But a newer family called AEGIS — far faster on processors with hardware AES support, and shepherded through standardization by the cryptographer Frank Denis, who maintains its reference implementations — has begun appearing in production. Surfshark moved first, shipping AEGIS-256X2 inside its Dausos protocol.

Reports are circulating that NordVPN is preparing to follow, based on a GitHub pull request said to have been noted by Denis himself. I have not independently confirmed it and NordVPN has not announced it, so treat it as a rumor. It is worth watching regardless, because adopting a modern cipher ahead of the pack is the kind of unglamorous engineering investment that distinguishes a security company from a marketing operation.

Why AI VPN recommendations deserve a second look

A growing number of people now ask a chatbot which VPN to buy. That instinct is reasonable, but it has a blind spot.

Language models learn from text on the internet, and the internet’s writing about VPNs is overwhelmingly affiliate content. So AI VPN recommendations tend to reproduce the consensus of the review industry rather than the findings of security research. Ask better questions and you get better answers. Instead of “what is the best VPN,” ask who legally owns the company, what jurisdiction it operates under, when its no-logs claim was last audited and by whom, and whether its apps appear in public tracker databases. Those are verifiable facts, not opinions.

Is NordVPN worth it?

This is the question I get most, so here is my reasoning rather than a sales pitch.

NordVPN is based in Panama, outside the major intelligence-sharing arrangements, and has had its no-logs policy verified by independent auditors — most recently Deloitte in 2025. Its servers run from RAM, so a restart wipes memory. Its NordLynx protocol, built on WireGuard, adds a double-NAT design so the server never writes your real address to disk, and it offers optional post-quantum protection against the “harvest now, decrypt later” problem. The apps include a working kill switch and DNS leak protection. That is a coherent set of engineering decisions, and it is what I rely on when I connect from a network I did not choose.

The honest drawbacks: ten simultaneous devices rather than unlimited, no port forwarding, NordLynx is not open source, and NordVPN has not disclosed what cipher its NordWhisper protocol uses. Weigh those.

On price, long-term plans land in the neighborhood of $3.50 a month. If you are hunting for the best cheap VPN, that is the range where the math changes: it is roughly the cost of one coffee a month, and it removes any need for the advertising-funded business model described above. Cheap is fine. Free is the problem.

A five-minute check before you install anything

Find the legal owner. Read the corporate entity named in the privacy policy, not the marketing page. If it is hard to determine, that is your answer.
Look for a recent independent audit of the no-logs claim, with a named firm and year.
Check the app against Exodus Privacy, free and public, to see which trackers the Android build contains.
Review the permissions. A VPN has no legitimate need for your GPS location.
Confirm there is a kill switch and turn it on, so a dropped tunnel does not silently expose you.

The practical takeaway

If you take one thing from this: delete the free VPN on your phone today. It is statistically likely to be harvesting more about you than the networks you installed it to hide from — exactly backwards.

If you would rather not audit the market yourself, NordVPN is what I use and recommend for travelers. You can get it through the link in the sidebar to your right, or the link at the bottom of this page — both carry current pricing, with a 30-day refund window if you decide it is not for you. Whatever you choose, choose something you pay for. In this product category, that is the whole ballgame.