Tens of millions of Android and iPhone users are urged to delete certain free VPN apps due to serious security concerns. The Tech Transparency Project (TTP) has identified multiple VPNs available in Apple and Google app stores that secretly route user data through companies controlled by the Chinese government.
VPNs are designed to enhance online privacy, but these free apps reportedly do the opposite by exposing sensitive user data. TTP highlights that these Chinese-owned apps remain available six weeks after initial warnings.
Experts caution that free VPNs often harvest data under the guise of privacy protection. vpnMentor’s Lisa Taylor states free VPNs can serve as a cover for data collection, while BeyondTrust’s James Maude notes users become the product when not paying for services. Vijay Dilwale from Black Duck emphasizes these apps pose risks far beyond individual privacy due to their hidden ownership and access to all internet traffic.
Though Google and Apple claim to enforce policies and compliance with trade laws, critics say enforcement is inconsistent. Cequence Security’s Randolph Barr and Deepwatch’s Chad Cragle call on app stores to improve vetting and transparency, especially for apps linked to hostile nation-states.
Barr recommends organizations implement rigorous app monitoring including AI-driven analysis of behavior, ownership transparency checks, data flow monitoring, and continuous risk reassessment.
TTP’s list of high-risk VPN apps includes the following:
- Apple App Store: X-VPN, Ostrich VPN, VPN Proxy Master, Turbo VPN, VPNIFY, VPN Proxy OvpnSpider, WireVPN, Now VPN, Speedy Quark VPN, Best VPN Proxy App, HulaVPN, Wirevpn, Pearl VPN
- Google Play Store: Turbo VPN, VPN Proxy Master, X-VPN, Speedy Quark VPN, Ostrich VPN, Snap VPN, Signal Secure VPN, VPN Proxy OvpnSpider, HulaVPN, VPN Proxy AppVPN
The Android app vpnify has since moved outside China and is in talks to be removed from TTP’s report.
Users are strongly advised to avoid these free VPNs due to the significant privacy and national security risks involved.