FREE VPN apps on Android promise privacy at no cost, but research from MysteriumVpn shows they often collect and share personal data instead. The study analysed 18 popular free VPNs from the Google Play Store, using MobSF to examine permissions, embedded trackers, hardcoded endpoints and developer emails.
It found that 17 of the 18 apps contained at least one tracker, with the average app including nearly five, and some hosting more than a dozen trackers from the US, China and Russia; Google’s AdMob and Firebase Analytics appeared in nearly every app, and Facebook integration was present in several, enabling cross‑platform tracking.
Permissions told a similar story: FreeVPN alone requested 21 permissions, 12 of which were deemed dangerous, potentially enabling audio or video recording, contact reading, location tracking and access to files. The report notes numerous hardcoded server domains, including connections to jurisdictions under OFAC sanctions or with state surveillance programs, increasing risks for users.
According to the report, free VPNs are largely data collection and advertising platforms that provide VPN functionality as a lure; open‑source and independently audited VPNs are suggested as safer alternatives.