Here’s the core problem with the VPN market: the people most likely to download a free VPN are the people most concerned about their privacy. And according to new research from Proton, those are exactly the people being watched. The company published findings from a months-long survey of more than 7,000 mobile VPN apps, and the results make a strong case that the free VPN category is, for many users, a privacy trap dressed up as a privacy tool.
The headline number is 85%. That’s the share of VPN apps available in the US that contain trackers designed to collect personal user data. We’re talking device IDs, network type, mobile carrier names, and more. That data doesn’t just sit there. It moves. Proton’s analysis found trackers sending data back to companies in China, Russia, and Israel, among others. In June 2026 alone, these apps were downloaded more than 13.2 million times from the Apple App Store and Google Play.
Chinese ownership, hidden behind shell companies
Of the 390 VPN apps studied from US app stores, 64 are owned by Chinese companies. That matters because under Chinese law, companies must hand over user data to the government on request. No warrant required. No meaningful legal challenge available. And 31 of those Chinese-owned VPNs go out of their way to obscure that fact, registering shell companies in Singapore, Hong Kong, or the UK to create the appearance of Western ownership. Users downloaded these apps more than 3 million times in a single month.
So a user in the US, trying to stop their internet provider from monitoring their traffic, may have handed that traffic to a company legally obligated to share it with Beijing. That’s not a theoretical risk. That’s how the ownership structure works.
Location tracking inside a privacy app
The research also found that 64 VPN apps actively track users’ physical location using GPS and geolocation data. Apps like VPN Proxy Master, VPN-Fast VPN Super, and X-VPN are in this group, and together they pulled in over 3 million downloads last month. That means roughly 20% of all VPN downloads in the dataset come from apps that track where you physically are. If you’re attending a protest, meeting a lawyer, or talking to a journalist, a VPN that logs your GPS coordinates is not protecting you. It’s documenting you.
App stores are collecting their cut
Apple and Google both market themselves as guardians of user privacy. But both platforms take roughly 30% of revenue from in-app purchases and subscriptions. That financial relationship creates an obvious conflict of interest when it comes to removing apps that generate that revenue. Both companies require VPN developers to submit privacy policies, but neither independently audits whether those policies reflect what the app actually does. They check that paperwork exists. That’s it.
Three of the VPNs in the study are owned outright by market research companies, including Phone Guardian Safe WiFi (owned by Sensor Tower) and Urban VPN (owned by BiScience, a firm previously shown to capture user conversations and share them with AI platforms). These are not edge cases. These are popular apps, freely listed, with nothing in the app store listing to warn a user what they’re actually downloading.
What users should actually do
The research points to a few categories of risk users should understand before installing any VPN:
- Check who actually owns the VPN company, not just where it’s incorporated
- Avoid free VPN apps with no clear business model — if you’re not paying, your data probably is
- Use tools like Exodus Privacy to check for trackers in Android apps before installing
- Look for VPNs with independently audited no-logs policies, not just self-reported ones
- Be especially cautious of VPNs that request location permissions
Proton is calling on Apple and Google to run more stringent ownership and security checks on VPN apps rather than relying on self-reporting. That’s a reasonable ask. But given that both companies profit from every subscription sold through their platforms, users probably shouldn’t hold their breath waiting for that to happen on its own.