1. Check the collection and use disclosures

• Find the privacy policy linked from the app listing and open the provider's own current policy. Confirm it names the app or service and identifies the organization responsible for it.
• Look for categories such as account details, device identifiers, diagnostics, app activity, connection timestamps, IP addresses, and browsing or traffic data. Check the stated purpose for each category; a list without a purpose leaves an important question open.
• Find out whether data is collected only to operate the service or also for analytics, advertising, personalization, or product development. Check how long it is retained and how deletion requests work, if accounts or records are kept.
• Compare the privacy policy with the app-store privacy disclosure and the app's in-product notices. Differences can reflect different versions or definitions, but they are worth resolving before you rely on a privacy claim.

A policy is a provider's description of its practices. Reading it does not independently establish what the app or its infrastructure actually does.

2. Review permissions and VPN access

• Read each device permission request and ask what feature needs it. If a permission such as contacts, precise location, microphone, photos, or messages seems unrelated to the VPN function, look for a clear explanation before granting it.
• Distinguish ordinary device permissions from the operating system's VPN connection consent. A VPN needs the system's permission to create a VPN connection and route covered network traffic; that consent is not by itself evidence that the app reads every category of data on your phone.
• Check whether a permission is optional, requested only when you use a feature, and still manageable in your device settings. Declining an unrelated optional permission may limit a feature; do not assume the app will work the same on every device.

The FTC says VPN apps can have access to internet traffic and recommends reviewing requested permissions, especially sensitive permissions that do not appear to fit the app's purpose. The permission list and the privacy policy answer different questions: what the device allows and what the provider says it collects or does.

3. Look for sharing and the business model

• Search the policy for “share,” “third party,” “advertising,” “analytics,” “service provider,” and “sale.” Note which data categories may be disclosed, to whom, and for what purpose.
• Check whether advertising or analytics partners receive identifiers, app activity, diagnostics, or other information. Identify whether the policy distinguishes service providers working for the VPN from companies using data for their own purposes.
• Ask how the free service is funded. In-app ads, a paid upgrade, or other revenue can be relevant context, but a funding model alone does not prove a particular data practice. Review the disclosures for the specific app.
• Look for a contact channel and a clear way to report a concern or request account/data deletion. If the policy leaves key terms undefined, ask the provider before trusting it with traffic.

For Android: use Data safety as one input

Google Play's Data safety section summarizes collection and sharing as disclosed by the app developer. Google says the developer supplies this information and that Google Play does not verify the disclosure's accuracy or completeness. It is a useful cross-check against the app's privacy policy, not an independent audit or guarantee. It applies to apps distributed through Google Play; an app obtained elsewhere may have different information available.

VPNs also differ in their technical behavior. Review whether the provider explains encryption, traffic routing, and what happens when the connection drops. See what a VPN can and cannot hide for the trust shift to the VPN provider.

When to pause

Pause if you cannot identify who operates the app, cannot find a meaningful privacy policy, see sensitive permissions with no convincing explanation, or cannot tell whether information is shared for advertising or other purposes. These are reasons to seek clearer information or choose another option; they are not proof that an app has misused data.

This checklist does not claim that all free VPNs collect more data than paid VPNs, or that a paid plan is automatically more private. It does not rank or audit any provider. The FTC notes that some VPN apps may be funded by advertising or information sharing, and recommends evaluating each app's own disclosures and practices.

For a side-by-side look at published plan details, see the VPN service comparison. For the network trust question, use the VPN goal checker.