The Terabyte Nobody Pays For: What “Unlimited Free VPN” Really Costs
There’s a version of the internet where privacy costs nothing. It shows up at the top of app store searches, promises “unlimited data,” “military-grade encryption” and “no registration required,” and asks for exactly zero dollars. For hundreds of millions of users — students, travelers, people in countries with restricted networks — that promise is irresistible.
Here’s the problem: bandwidth has a price, and it never goes away just because the app store listing says so. Every gigabyte that passes through a VPN tunnel exits through a transit link someone is paying for, on a server someone is renting, in a datacenter someone is cooling. When a provider offers you unlimited traffic for free, the invoice doesn’t disappear. It just moves somewhere you can’t see.
The only question worth asking is: who is holding it?
Why the cap is the tell
Serious free VPN plans almost always have a ceiling — 500 MB a month, 10 GB, a daily reset. That cap isn’t stinginess. It’s accounting. A heavy user streaming video in HD can burn through tens of gigabytes, and at scale, those users become a measurable line item on a bandwidth bill.
So when a plan removes the cap entirely — unlimited, forever, free — one of two things is true. Either the provider has found a way to fund those terabytes through other means, or the users themselves are the funding. Telling the difference between those two situations is the entire skill of evaluating a free VPN.
Three ways the bill gets paid
Free VPNs generally monetize in one of three ways, and they are not equally benign.
Advertising. The app shows banners or full-screen ads, and often bundles third-party trackers. This is the least alarming model on its face, but the research record is sobering. A 2016 study of 283 Android VPN apps by researchers from CSIRO’s Data61, UNSW and UC Berkeley found that 75% embedded third-party tracking libraries, and 18% implemented tunneling protocols with no encryption at all — despite marketing themselves as privacy tools. Some apps in that study weren’t VPNs so much as fake tunnels harvesting traffic in the clear.
Freemium. Paying subscribers fund the servers; the free tier is a showroom with fewer locations, slower speeds or one device. This model can genuinely sustain an unlimited-data free plan, because the free user is a prospect, not a product. If a company sells a premium subscription, the free plan has an obvious, visible reason to exist.
You. The third model turns the user’s own connection into inventory. That same 2016 study found that 16% of the analyzed apps forwarded traffic through other participating users’ devices in a peer-to-peer fashion. In plain terms: someone else’s browsing session can leave the internet from your home IP address.
The Hola warning shot
The textbook case arrived in May 2015. Hola, a free peer-to-peer VPN with tens of millions of installs, was caught selling access to its users’ bandwidth through a sister service called Luminati — reportedly at prices around $20 per gigabyte. The scheme only became public after the image board 8chan was flooded with attacks routed through Hola’s network.
Hola’s defense was, essentially, that users had agreed to the trade: free access in exchange for idle bandwidth. A paid opt-out tier appeared; Luminati was eventually spun off and sold. The episode established the template — free VPN in front, residential proxy marketplace in back — that would be industrialized at a horrifying scale less than a decade later.
The $99 million lesson
In May 2024, the US Department of Justice announced the takedown of 911 S5, described as likely the largest residential proxy service and botnet ever built. Its alleged operator, YunHe Wang, was accused of compromising more than 19 million IP addresses across roughly 190 countries, largely by distributing free VPN apps — MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN and ShineVPN — that quietly installed a proxy backdoor
According to the DOJ, Wang received approximately $99 million between 2018 and 2022 selling access to those hijacked addresses. The customers bought residential IPs precisely because they look like ordinary households — which made them useful for slipping past fraud checks. The damage attributed to the network was staggering: the US government estimates 560,000 fraudulent unemployment claims originating from compromised IPs, with confirmed losses exceeding $5.9 billion, plus more than 47,000 fraudulent applications to a single pandemic loan program. The people whose computers carried all that traffic had simply wanted a VPN that cost nothing. The FBI still maintains guidance for identifying and removing the backdoored apps — a reminder that such software can sit dormant on a machine for years.
How to read a free plan like an invoice
None of this means every uncapped free VPN is a trap. It means you should read the plan the way you’d read a bill — hunting for the line item that pays for it.
- Look for a visible paid tier. If the company sells premium subscriptions, the free product has a legitimate reason to exist. If there is no paid tier, no ads and no data cap, the money is coming from somewhere the marketing page won’t show you.
- Search the privacy policy for phrases like idle resources, peer network, SDK partners and bandwidth sharing. Any of them suggests your connection is part of the transaction.
- Check ownership and accountability. A provider that names its parent company, publishes an independent no-logs audit and discloses server locations has chosen to be answerable. An app that requests contacts, SMS or account access has asked for far more than a tunnel requires.
- Watch the device’s behavior. Unexplained data usage or battery drain while the VPN is disconnected is a warning sign — and the 911 S5 case shows such software can persist unnoticed for years.
The bottom line
Unlimited and free can absolutely coexist — when paying customers cover the infrastructure and the free tier exists to recruit them. That’s a business model you can audit, because it’s printed on the pricing page.
But when a VPN offers unlimited data, charges nothing, sells nothing and advertises nothing, the product isn’t the app. The product is you — or more precisely, your IP address, your bandwidth, and the appearance of innocence your home connection lends to whoever rents it.
Bandwidth is never free. The only open question is who settles the bill, and how much it costs you when you find out.
Sources: US Department of Justice (911 S5 takedown, May 2024); FBI public service announcement on 911 S5; Ikram et al., “An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps” (IMC 2016).
