How Free VPNs Make Money: The Bandwidth Resale Model

Bandwidth is not free for anyone. A tunnel operator pays for transit, servers, IPv4 addresses and the engineering behind them. When the price to the user is zero, that cost has not vanished — it has moved. In one model it moves onto the user's own connection.

The revenue models that leave your connection alone

• Freemium. Subscribers cover the infrastructure; the free tier is a marketing expense fenced by a data cap or a short server list.
• Advertising. The client shows ads; how much of your usage the ad stack sees varies by implementation.
• Affiliate. The free client points at paid products and earns a commission.
• Bundling. The tunnel ships as a feature of a security suite, browser or carrier plan paid for elsewhere.
• Grants and nonprofit funding. Rarer and slower to scale, usually paired with published finances.

None of these turn your device into infrastructure. The model worth understanding mechanically is different in kind: it makes your connection the product, and the app the vehicle for the software that sells it.

Reselling the connection as residential exit capacity

There is a large market for requests that appear to come from a home. Ad verification firms, price aggregators, brand-protection vendors and scrapers pay for it, because a consumer ISP address is scored differently than a data center one. That supply comes from real households.

The software arranging it is often not a VPN at all. It is frequently an SDK — a drop-in library — embedded in an app with no networking purpose of its own: a wallpaper app, a file converter, a game, a browser extension. The developer integrates it and gets paid for what their users supply: usually a monthly rate per active device, sometimes per gigabyte relayed. Consent lives in the license agreement: sometimes a plain opt-in screen, sometimes one clause about “sharing device resources” that nobody scrolls to.

The plumbing, step by step

The design is unremarkable, which is why it is worth spelling out. None of it needs malware or a rooted device.

1. 1The app launches and the SDK opens an outbound connection to the operator's coordination servers — typically TLS on port 443, indistinguishable from any other API call it makes.
2. 2It is held open as a control channel. Direction matters: a home device usually sits behind NAT and takes no unsolicited inbound connections, so it dials out and keeps the channel alive itself.
3. 3A customer asks the operator's gateway for an exit in a given country, city or ISP, and the gateway picks a matching device.
4. 4The job is pushed down that channel. The SDK opens a fresh connection from your machine to the destination and relays bytes both ways.
5. 5The destination sees an ordinary connection from a residential address, with no view of the gateway, the customer or the app holding the socket.
6. 6Volume is metered, the customer is billed per gigabyte, and the developer collects its cut.

What that does to your address

Every site of consequence scores an incoming address before rendering: which network it belongs to, whether it has surfaced in abuse reports, how it behaved recently, whether its fingerprint matches the location it claims. A consumer address starts high — but that score is not a property of the address. It is a running assessment, and it can be spent.

When your address sits in an exit pool, its recent behavior is not yours. It is the aggregate of whoever bought capacity that hour: automated logins, scraping at machine speed, checkout automation, bulk account creation. Scores fall fast and come back slowly, because scoring leans on recent behavior and lets older history fade. The friction reaches your own devices with no visible cause — CAPTCHAs on sites that never challenged you, extra verification from a bank on hardware you have used for years, signups rejected, payments failing risk checks. Behind CGNAT the address is shared, so neighbors inherit the score without installing anything.

This is documented, not hypothetical. In a public service announcement dated 12 March 2026 (alert I-031226-PSA), the FBI's Internet Crime Complaint Center listed how home devices end up in residential proxy networks: SDK partnerships inside ordinary apps, free VPN apps that enroll devices without consent, compromised IoT hardware, malware in pirated software, and apps sold as passive income for bandwidth. The consequence it named: traffic sent through those devices makes the connection's owner look responsible for it.

How to tell whether an app is doing this

• Search the license for resource language. The clauses that matter say “share your device's bandwidth,” “network resources,” “peer” or “act as a node.” Search for bandwidth, peer and proxy instead of reading it through.
• Treat any offer to pay you as a signal. Apps crediting cash, gift cards or points for staying open are paying for the one asset your device reliably has: its address.
• Check per-app data usage. Android reports bytes per app for both mobile data and Wi-Fi; iOS breaks down cellular only, so home relaying shows up only in the router's stats. A utility with nothing to fetch that has moved gigabytes needs an explanation.
• Watch background behavior. On Android, sustained background networking generally needs a foreground service with a persistent notification; iOS grants far less background time, so relaying tends to be tied to the app being open.
• Read the store policy. Google Play's Device and Network Abuse policy allows apps to facilitate proxy services for third parties only where that is the app's primary, user-facing core purpose.

The question this actually reframes

It would be easy, and wrong, to end at “free tunnels are bad.” Some free tiers are honestly funded, by subscribers or by nonprofits. The sharper point is that resale exposes something true of every tunnel, paid ones included: a VPN does not make traffic vanish. It relocates the point where your traffic enters the public internet, and hands whoever runs that point the position your ISP held.

So the question was never free versus paid. It is who occupies that position and what they are paid for. Under resale, revenue comes from third parties buying access to your address, putting the operator's income and your interests on opposite sides. Under subscription it comes from you, for the tunnel. Questions worth putting to any exit operator:

• Who pays for this capacity — me, an advertiser, or a third party buying access to the exit?
• Does anything in the terms permit my device or my address to carry traffic that is not mine?
• What is recorded at the exit, for how long, and under what process could it be handed over?
• Which legal entity operates the exit addresses, and in which jurisdiction do they sit?
• Are the exits used only by subscribers, or shared with a proxy business run by the same company?

If an app on your phone mentions sharing resources, spend five minutes: open the terms, search those words, check its data usage.