How Do Free VPNs Make Money? What the App Store Shows

Free VPNs mostly pay for their servers with ads shown inside the app or with a paid upgrade sold to some of the users. Some also use your data, or your connection itself. You can usually tell which one an app relies on from its App Store page and its developer’s website, and this post shows how.

Why a free VPN has to make money somewhere

A VPN runs servers around the world, and servers cost money to operate. If the app doesn’t charge you, something else has to pay. That’s not a scandal, just arithmetic. The useful question is what the app does to cover it.

Before writing this I ran a small check of my own, and I’ll describe it below. I’m not naming any app in it, and I’m not saying anything about any single app’s behavior.

Way 1: Ads inside the app

The most visible model is advertising. Ads in apps are bought and sold through ad systems, and there’s a public file that lists which ones a developer has authorized. It’s called app-ads.txt. The IAB Tech Lab, the industry body that wrote the standard, describes it as a way for app developers to publish a website file “that lists authorized sellers of their app’s ad inventory” (IAB Tech Lab).

Each line has up to four fields (IAB Tech Lab, ads.txt 1.1):

1. The domain name of the advertising system.
2. The publisher’s account ID in that system.
3. The relationship: DIRECT means the developer controls the account itself, and RESELLER means it has authorized another company to control the account and resell its ad space.
4. An optional certification authority ID.

The developer links to its website from the App Store listing, and the file lives at that site’s /app-ads.txt (IAB Tech Lab).

What 31 free-to-download VPN apps show

On November 10, 2026, I took the first 25 results each for “vpn” and “free vpn” in the US App Store search (using Apple’s iTunes Search API), kept the free-to-download apps, removed duplicates and Mistero, and fetched app-ads.txt from each app’s developer website. That left 31 apps.

• One of the 31 listed no developer website at all.
• 24 of the 31 publish an app-ads.txt file.
• The number of distinct ad systems per file has a median of about 263, a high of 512 and a low of 1. 18 of the 24 list 100 or more.
• The median share of RESELLER lines is about 97%, and the median file is about 1,770 lines long.

The caveats matter, so here they are plainly:

• app-ads.txt is an authorization list. It isn’t proof that an app shows ads from all of those systems or contains their code.
• One file covers every app the developer publishes from that website, not only the VPN.
• A free-to-download app can also sell subscriptions.
• Search results are not a ranking of popularity.

What I do take from it: a long file means the developer has authorized a lot of ad sellers. That fits a business that depends on ads. It doesn’t tell you what the app does with your traffic. You can check any developer’s file yourself with the app-ads.txt analyzer, which counts the ad systems and the DIRECT and RESELLER lines in your browser.

Way 2: Freemium, a free tier that sells an upgrade

The second model is a free tier built to sell a paid plan. The free version might cap your data, limit the locations you can choose or slow you down, and the app keeps asking you to upgrade. Here the free users are the shop window, and the paid users cover the servers.

This model is easy to spot. The App Store listing shows “In-App Purchases” and the app tells you what the paid plan unlocks. Many apps combine it with ads, which is one reason a free-to-download VPN can show both.

Way 3: Data

The third model is the one people worry about, and I’d rather give you the rules and the research than a guess.

What Apple says VPN apps can’t do. Section 5.4 of the App Review Guidelines says: “Apps offering VPN services may not sell, use, or disclose to third parties any data for any purpose, and must commit to this in their privacy policy.” It also requires “a clear declaration of what user data will be collected and how it will be used on an app screen prior to any user action to purchase or otherwise use the service” (Apple, App Review Guidelines). That’s a strong rule on paper. A rule isn’t proof of behavior in any one app, so I’d still check.

What research found. A 2016 study at the ACM Internet Measurement Conference analyzed 283 Android apps that use the VPN permission. It found that 75% of them used third-party tracking libraries, and that 28% of the free VPN apps embedded none, against 65% of the premium ones (Ikram et al., IMC 2016). The authors read that as a sign that premium apps rely less on advertising and analytics revenue. That is an old study of Android, not of today’s iPhone apps, so I use it only to show why the question is fair.

Way 4: Your connection

Some apps earn money by letting other people use your internet connection. The FBI describes proxy services that pay mobile app developers to include their SDK “in exchange for payment for each person who downloads the application”, so the SDK can “route proxy traffic through users’ devices”. It also warns that “Free VPN services may enroll users’ devices in a residential proxy network, without obtaining their consent”, with the details “often hidden in the terms of service” (FBI). Then other people’s traffic can leave the internet from your IP address. That’s why the terms are worth a read before you connect.

Do free VPNs sell your data?

I can’t give you a yes or no for free VPNs as a group, and I’d distrust anyone who does without a source. What I can say from the sources above:

• On the App Store, VPN apps are barred from selling or disclosing user data to third parties, and have to say so in their privacy policy.
• The place to see what an app says about itself is its privacy label. Apple notes that this information is self-reported by the developer (Apple Support).
• Research on older Android VPN apps found tracking was common, especially in free ones.
• The FBI warns that some free VPN services use your device as a proxy for other people’s traffic.

So the answer for a specific app lives on that app’s page, not in a general claim.

How to check a free VPN on your iPhone

Five minutes is enough:

1. Read the App Privacy section. Apple says each product page shows “whether that data is linked to you or used to track you” (Apple Support). Look for Data Used to Track You and Data Linked to You. Apple defines tracking as linking data from the app with data from other companies for ads, or sharing it with a data broker.
2. Check In-App Purchases on the listing. If a paid plan exists, you can see how the app earns money without ads.
3. Open the developer’s website and privacy policy from the listing. A VPN app has to commit to its data rules in that policy.
4. Look up its app-ads.txt. Take the developer’s website from the App Store listing, add /app-ads.txt, and paste what you find into the app-ads.txt analyzer. No file doesn’t prove there are no ads; it means the developer isn’t using app-ads.txt. A file of hundreds of lines is a hint the business runs on advertising.
5. Test it once connected. Use the VPN test to confirm your IP address changed.

None of this proves an app is good. It tells you how the app pays for itself, which is most of what you need.

Are free VPNs safe on iPhone?

Some are, and some aren’t. A free price doesn’t make an app unsafe, and a paid price doesn’t make it safe. What changes the risk is how the app earns money, and what that makes it do with your traffic and your device. I’d treat a VPN as a company you’re handing your browsing view to, which is the point I make in Is a VPN Safe?. For what a VPN actually changes, and what it doesn’t, see what a VPN actually changes.

If your real goal is fewer ads and trackers while browsing, a VPN isn’t the tool for that. See why Safari ads keep interrupting and how to prevent cross-site tracking on iPhone.

Where Mistero fits

Mistero isn’t free, and I don’t want to dress it up as free. The App Store listing says “Some features require a subscription or purchase” (App Store listing, read Nov 9, 2026). Subscriptions are how it pays for its servers.

Here’s what I can check about it with the same method as above. The listing has no developer website, there’s no app-ads.txt on misterovpn.com (it returns a 404), and the app contains no advertising SDK, which our team confirmed in November 2026. That’s our word, so verify what you can: the App Privacy section and the privacy policy are public.

I’d also say what it isn’t. Mistero doesn’t make every app on your phone private, and a VPN doesn’t hide what you do inside an app you’re signed in to.

Sources

• IAB Tech Lab, app-ads.txt Specification v1.0: https://iabtechlab.com/wp-content/uploads/2019/03/app-ads.txt-v1.0-final-.pdf (read Nov 10, 2026)
• IAB Tech Lab, ads.txt Specification v1.1: https://iabtechlab.com/wp-content/uploads/2022/04/Ads.txt-1.1.pdf (read Nov 10, 2026)
• Apple, App Review Guidelines, section 5.4 VPN Apps: https://developer.apple.com/app-store/review/guidelines/ (read Nov 10, 2026)
• Apple Support, About privacy information on the App Store and the choices you have to control your data: https://support.apple.com/en-us/102399 (read Nov 10, 2026)
• Apple Developer, App privacy details on the App Store: https://developer.apple.com/app-store/app-privacy-details/ (read Nov 10, 2026)
• Ikram et al., An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps, ACM IMC 2016: https://research.csiro.au/isp/wp-content/uploads/sites/106/2016/08/paper-1.pdf (read Nov 10, 2026)
• Apple, Mistero VPN App Store listing: https://apps.apple.com/app/id1583175414 (read Nov 9, 2026)
• FBI, Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals (I-031226-PSA, March 12, 2026): https://www.ic3.gov/PSA/2026/PSA260312 (read Nov 10, 2026)