You download a free VPN, turn it on, and assume you're invisible. Your traffic is encrypted, your location is hidden, and you're safe from prying eyes. That's the promise, anyway.
Reality tells a different story.
A massive new study from researchers at the University of Michigan, the University of New Mexico, and IIT Delhi just dropped a bombshell. They built an automated testing framework called MVPNalyzer—think of it as a security stress-test for Android VPNs—and ran it against 281 of the most popular free VPN apps on the Google Play Store.
The results? 2.4 billion installs affected by at least one security flaw. Let that sink in for a second.
What Actually Went Wrong
61 apps transmitted user data in plain text—no encryption, no protection. Anyone on the same network could read it. We're talking web content, JavaScript, JSON files—stuff that should never be sent in the clear.
29 apps leaked traffic outside the VPN tunnel entirely. Among them, 24 leaked DNS requests—meaning the network operator could see exactly which websites you were visiting. Those apps alone account for roughly 360 million installs. Six leaked full browsing traffic, and four ran "tunnels" with no encryption at all.
Five apps had an even scarier problem: they downloaded their configuration files without encryption. These files tell the app which server to connect to. An attacker on the same public Wi-Fi could intercept that file, rewrite it, and redirect you to a server they control. The researchers actually built this attack and confirmed it worked.
And then there's the tracking. You install a VPN to avoid being tracked. But 246 apps contacted advertising and tracking servers. 76 apps sent out Android Advertising IDs—unique codes that let advertisers follow you across apps. Many also sent device model, OS version, screen size—enough to build a "fingerprint" that identifies your device uniquely. One app even sent GPS coordinates.
Oh, and 169 apps made no attempt to disguise their traffic as anything other than a VPN. If you're in a country where using a VPN is risky, being that easy to spot is the opposite of what you signed up for.
The Bottom Line
Here's the uncomfortable truth: a VPN doesn't remove the need to trust someone. It just moves that trust from your ISP to whoever built the app. And this study suggests that trust is often misplaced.
The researchers pulled apart OpenVPN configuration files from 108 of the apps. Only one followed every security best practice. Nearly 90% relied on a single authentication method rather than combining two. Almost one in five used weak or outdated encryption.
What You Can Actually Do
None of this means you should stop using a VPN. It means you need to be smarter about which one you use.
- Skip the random free VPNs. If you're not paying for the product, you are the product. These apps need to make money somehow—and as the study shows, many do it through tracking and selling your data.
- Look for paid, reputable services that have been independently audited. Names like NordVPN, ExpressVPN, and Proton VPN consistently rank well for security. They cost money, but privacy was never meant to be free.
- Check the privacy policy. Does it clearly state what data is collected and how it's used? If it's vague, walk away.
- See if they've had independent audits. Reputable VPNs pay third-party firms to audit their security and publish the results.
Google Play's "Data Safety" labels? The study suggests treating them with skepticism. Being on the Play Store or having a VPN badge doesn't guarantee security.
The research team hopes their findings push regulators to tighten app-store enforcement and force VPN providers to clean up their act. Until that happens, the responsibility falls on you.
That free VPN you downloaded last week? It might be doing more harm than good.
Tags:
Technology