Free VPNs from Google Play: what they collect about you, in their own words

In short: on 20 October 2026 we opened the “Data safety” section of 13 popular free VPNs on Google Play, each with between one million and 500 million downloads. Nine of the 13 say they share some data with other companies, six share device identifiers and two share location. Four offer no way to delete your data. These are not our guesses: it is what the developers say about themselves.

What the free VPNs say about themselves

The data comes from the app pages on the US Google Play, read on 20 October 2026. Google warns that the section may vary by app version and region. All 13 declared encryption in transit, so it is not a column. “For advertising” is the purpose of sharing as the developer itself gave it.

What these lines mean

• Device identifiers — for advertising. Ad networks use the advertising ID to link what you do across apps. A VPN that passes it on adds you to an ad profile itself.
• Location. People often install a VPN to hide where they are. An app that passes precise location to ad networks does the opposite.
• Browsing history. A VPN can technically see which sites you visit. If it says it collects history, that is not a leak but something it declared itself.
• Data cannot be deleted. You cannot ask the developer to erase what it has collected about you.
• “Not shared” does not mean “not collected”. Collected data stays with the developer; shared data goes to other companies. The developer fills in the section and is responsible for its accuracy.
• Photos and messages are marked optional in some apps: usually screenshots and messages to support.

What researchers found

• 2016, IMC conference. Researchers at CSIRO Data61, UNSW, ICSI and UC Berkeley took apart 283 VPN apps from Google Play. 75% had tracking libraries, antivirus engines on VirusTotal flagged 38%, 18% did not encrypt traffic and 84% let IPv6 bypass the tunnel. The study is old, but it was the first large one.
• 2025, “Hidden Links”. Researchers found three families of VPN apps with over 700 million Google Play downloads between them. The apps are secretly linked and share the same server passwords hard-coded in the apps: whoever pulls the password out of one can decrypt the traffic of users of the others. One family is apps of Innovative Connecting, Autumn Breeze and Lemon Clove. Innovative Connecting is the developer of Turbo VPN on Google Play.
• 2025, Tech Transparency Project. According to the organisation, Turbo VPN, VPN Proxy Master and Thunder VPN have owners in mainland China, and X-VPN through a Hong Kong company. The store pages do not say so. In June 2025 Turbo VPN and VPN Proxy Master were still on Google Play.
• December 2025, Urban VPN. Researchers at Koi reported that the Urban VPN Proxy extension for Chrome sent users' conversations with chatbots to the owner's servers. It is a browser extension, not an Android app, but the owner is the same.

Check any app in a minute

1. 1Open the app's Google Play page, scroll to “Data safety” and tap it.
2. 2Under “Data shared” look for device identifiers and location. For a VPN that is a bad sign, especially with the purpose “Advertising or marketing”.
3. 3Under “Data collected” see whether browsing history, the list of installed apps or contacts are there.
4. 4At the bottom, under “Security practices”, check whether you can request deletion of your data.
5. 5On the app page find the developer contact: an honest service has a website, an email and an address there.
6. 6After installing, open Settings → Apps → the app → Permissions. A VPN does not need contacts, SMS, microphone or location.

The other six checks, from working on your network to the background, are in Best VPN for Android: check it yourself. Why a free service always has a source of income is in free VPN and bandwidth resale.

If you do not want to pay blind

The fairest way is to test a service during a short trial. The app itself is free; what you pay for is the subscription: $1.50 per device per month, taken from your balance, with nothing charged to your card automatically. Top-ups start at $5. An account opened on the Russian site is priced in roubles instead: an account keeps the currency it was opened in, whatever card tops it up. Our ProxysVPN app is on Google Play and as an APK file on our apps page.

Frequently asked questions