TL;DR: Red flags include a "free" VPN with no clear business model, permissions requests unrelated to VPN function (like contacts or SMS access), and a privacy policy that's vague about what data it logs or sells. Stick to well-reviewed, established VPN providers with a clear, published no-logs policy (ideally independently audited), check the permissions the app requests before installing, and avoid VPN apps that are entirely free with no visible business model.
Red flags include a "free" VPN with no clear business model, permissions requests unrelated to VPN function (like contacts or SMS access), and a privacy policy that's vague about what data it logs or sells.
What Usually Causes This
Some free VPN apps generate revenue by logging and selling user browsing data or bundling malware/adware into the install — the opposite of what a VPN is supposed to protect against.
What to Do About It
Stick to well-reviewed, established VPN providers with a clear, published no-logs policy (ideally independently audited), check the permissions the app requests before installing, and avoid VPN apps that are entirely free with no visible business model.
If this looks similar to something else you've seen, it's worth reading How to Tell If a Mobile App Is Spyware.
This pattern shows up elsewhere too — see How to Tell If Someone Is Reading Your Texts.
Frequently Asked Questions
What are the real warning signs?
Red flags include a "free" VPN with no clear business model, permissions requests unrelated to VPN function (like contacts or SMS access), and a privacy policy that's vague about what data it logs or sells.
What usually causes this?
Some free VPN apps generate revenue by logging and selling user browsing data or bundling malware/adware into the install — the opposite of what a VPN is supposed to protect against.
What should I do about it?
Stick to well-reviewed, established VPN providers with a clear, published no-logs policy (ideally independently audited), check the permissions the app requests before installing, and avoid VPN apps that are entirely free with no visible business model.
Should I be worried if I only see one sign?
One sign alone (like a slower device) is usually not cause for alarm — most single symptoms have mundane explanations. Multiple signs together, especially unexpected data usage or unfamiliar apps, are worth investigating.