The True Price of Zero Dollars: What Ten Free VPN Privacy Policies Reveal About Client Confidentiality

There is a saying in our industry that if you're not paying for the product, you are the product. In the VPN market, the corollary is more unsettling: your clients may be the product too.

We undertook this review not as another speed-test roundup but as a close reading of privacy policies, terms of service, and audit disclosures for ten widely used free VPN services. The question was narrow and professional: could a firm using one of these tools credibly argue that it safeguarded client information? For most of the ten, the answer is no.

What We Looked For

Our rubric had four criteria, adapted from the confidentiality obligations that govern accounting practice: whether the provider logs browsing activity or connection metadata; whether it shares or sells data with third parties, including advertising brokers; whether it has undergone an independent, published security audit; and whether its jurisdiction raises data-request concerns.

We read the documents ourselves — the full policies, not the marketing summaries. What follows are the patterns that emerged, with providers grouped by the severity of what we found.

The Data Brokers

Two of the ten services disclosed, in language buried deep in their policies, that they share 'advertising identifiers' and usage information with third-party partners. One free Android VPN's policy explicitly reserves the right to monetize 'device information and usage patterns' — phrasing broad enough to encompass, at minimum, metadata about when and how you connect. Neither names the specific brokers, which is itself a finding. A firm cannot assess third-party risk when the third parties are anonymous.

The Silent Loggers

Three providers claim a 'no-logs' position in their marketing but contradict it in their policies, which disclose collection of connection timestamps, device identifiers, or bandwidth figures. A no-logs claim without a policy to match is not a security control; it is a slogan. For a professional handling return filings, the distinction is material — connection metadata tied to a client's tax portal session is exactly the kind of artifact that becomes discoverable in the wrong circumstances.

The Unaudited Middle

Four more services avoid explicit red flags but offer no independent verification whatsoever. No published audit, no transparency report, no warrant canary. These services may be perfectly safe — or not. The absence of evidence is not evidence of safety, and in a professional context, unverified tools are difficult to defend in a risk assessment.

Only one of the ten offered both a clean policy and a current third-party audit. That provider's free tier is genuinely usable for light, non-client work — checking the news on a coffee shop network, perhaps — but its bandwidth caps and server restrictions make it unsuitable as firm infrastructure.

The Cost-Benefit Math

Let's put numbers on it. A reputable business VPN for a five-person firm runs roughly $10 to $15 per user per month — call it $600 to $900 annually. A single confidentiality incident involving client financial records can trigger state breach notification obligations, an FTC scrutiny under the Safeguards Rule for firms handling consumer financial data, professional liability exposure, and a client relationship that no malpractice deductible fully repairs.

Set against that, the $600 annual spend is not a cost. It is among the cheapest risk transfers available to a small practice. The 'free' alternative transfers risk in the opposite direction — onto your clients, whose SSNs and EINs move through tunnels operated by companies that may profit from their data.

Our Position

AccountingVPN does not review free consumer VPNs as viable options for professional use, and this audit is why. The economics of the free VPN market are structurally incompatible with client confidentiality: bandwidth and infrastructure cost money, and providers who don't charge users must monetize something else. Occasionally that something is upgrade revenue. More often, it's data.

If budget is the constraint, the honest alternatives are a low-cost tier from an audited provider, or simply declining to connect to client systems from untrusted networks until you can do so properly. Both are defensible. Routing client data through an unaudited, ad-supported tunnel is not.