Free VPNs: follow the money
Bandwidth is not free. Here are the five ways a free VPN pays for itself — and how to tell which one you are funding.
July 30, 2026 · 8 min read
TL;DR — Moving a terabyte of traffic costs money whether or not anyone paid for it. A free VPN is not a company that solved that problem — it is a company that found someone else to bill. There are five common answers to who that is. Exactly one of them is fine for you.
“Free VPN” is a phrase that should prompt a question rather than a download. Not because free software is suspect — some of the best security tools ever written are free — but because a VPN is not only software. It is software plus a permanent, metered, monthly bill for bandwidth and servers, one that grows every time somebody streams something.
So the question is not whether a free VPN is somehow cheating. It is simply: who is paying that bill, and what are they getting for it? There are five common answers, and they are not equally good news.
What a VPN actually costs to run
The expensive part is not the encryption. It is egress: the bandwidth leaving the server towards the internet, billed per terabyte, every month, forever. Add bare-metal servers in dozens of countries, IP address ranges, abuse handling, an audit that costs real money, and engineers who keep the whole thing patched.
A single active user who streams in the evening can move well over a hundred gigabytes a month. Multiply by a user base and you have an operating cost that does not care at all about your pricing page. This is why the free tier of a serious VPN is always small, slow, or limited to a couple of locations — those constraints are the cost model showing through the product.
Five ways a free VPN pays for itself
Advertising inside the tunnel
The provider sits in the perfect position to inject or replace ads, and some have. You installed a tool to stop the network seeing your traffic, and handed the network to an ad business.
Selling what it observes
Browsing patterns, app usage and connection metadata are marketable to data brokers and analytics firms. The privacy policy will call these “partners” and the data “aggregated”.
Reselling your bandwidth
The one people miss. Some free VPNs enrol your device into a residential proxy network, so other people’s traffic exits through your connection. You are not the customer or the product — you are the infrastructure.
Freemium loss-leader
A real paid product subsidises a deliberately limited free tier as marketing. This is the honest model, and it looks like it: tight data caps, few locations, and an upgrade button rather than an ad network.
Grants and donations
Nonprofits and activist-funded projects genuinely give bandwidth away. Rare, usually openly funded, and usually explicit about who writes the cheques and why.
The third model deserves more alarm than it gets. If your connection is being used to relay strangers’ traffic, the requests leaving your home network are attributed to you — by your ISP, by the sites involved, and by anyone investigating what those strangers did with it.
How to tell which one you are in
You can usually work it out in ten minutes without any technical tooling. Open the privacy policy and the app store listing, then check:
- Search the policy for “partners”, “affiliates” and “aggregated” These are the words that do the heavy lifting in a data-sale clause. If sharing is described but the recipients are never named, assume the broadest reading.
- Search for “peer”, “node”, “relay” and “bandwidth” Bandwidth resale has to be disclosed somewhere, usually in language that sounds like a community benefit rather than a sale.
- Look for a named company and a jurisdiction A privacy product that will not say who operates it, or from where, has told you something. The who should not be a research project.
- Check whether there is a paid tier at all If nothing on the site can ever be bought, the revenue is coming from somewhere other than users. That is not proof of anything bad — but it is the point at which you should find out what it is.
- Check the app’s permissions and SDK list An app that only needs to build a tunnel does not need an advertising identifier or an analytics SDK from a company you have never heard of.
The honest case for paying
We charge about $2.50 a month on the annual plan, and we would rather explain that number than dress it up. It covers bandwidth, servers, the audit, and the people who keep it running — and it means the answer to “who is the customer?” is you, without further steps.
It also means we can afford to collect nothing. A business funded by subscriptions has no use for your browsing history; a business funded by advertising has an appetite for it that no policy document ever fully suppresses. The revenue model is upstream of the privacy policy, and it is the part worth reading first.
If you would rather verify that than believe it: the clients are open source, the no-logs implementation is independently audited, and signup does not ask for an email address, so there is no list to sell even if the incentive changed.
A price tag is a privacy feature
About $2.50 a month on the annual plan. No ads, no data sales, no bandwidth resale, and a 30-day money-back guarantee if the maths does not work out for you.
Get LunoVPN See pricing