Audit reveals 88% of free VPNs fail security tests

A comprehensive audit of 281 free Android VPN applications, conducted by researchers from the University of Michigan, University of New Mexico, and IIT Delhi, revealed alarming security and privacy deficiencies. The findings, presented in February 2026 at the NDSS security conference, indicated that 88% of these popular free VPNs exhibited at least one critical security or privacy failure.

Specifically, the audit found that 29% of the tested apps leaked DNS and browser traffic outside the VPN tunnel. Furthermore, 61% transmitted data in plain text, and a striking 246 apps communicated with advertising or tracking domains. These applications collectively represent over 2.4 billion installations, highlighting a widespread risk to user data for millions.

In stark contrast to these findings, paid VPN services like NordVPN undergo rigorous scrutiny. NordVPN's no-logs policy has been audited by Deloitte six times, with the latest audit in February 2026 confirming its adherence. This level of transparency and security is generally absent in free VPNs, which often monetize user data due to the lack of a paid product.

NordVPN offers various subscription tiers, including a Basic plan at $3.49 per month, which provides VPN services with audited privacy. More comprehensive plans add features like malware protection, ad blockers, and cloud storage, with prices ranging up to $7.49 per month for the Prime plan. These paid options ensure user privacy and security are prioritized over data monetization.