6 Worst VPNs to Avoid in 2026: Unsafe VPNs for Your Privacy

Last Updated on October 6, 2026 by Editorial

The worst VPNs can give you a false sense of security while exposing the very data you installed a VPN to protect. A VPN should encrypt your internet traffic, hide your IP address, and reduce the amount of information observers can see.

But not every VPN delivers those protections.

Some VPNs have been linked to excessive data collection, third-party tracking, security flaws, questionable ownership, or serious privacy practices. Others may simply have weak technical protections that make their security claims difficult to trust.

That makes choosing a VPN more important than simply looking for the cheapest subscription or the highest app-store rating.

In this guide, we examine some of the worst VPNs to avoid based on documented security and privacy concerns. We also explain how we assess these services, why some free VPNs deserve extra scrutiny, and what to look for when choosing a safer alternative.

Disclaimer: VPN services change their software, ownership, policies, and infrastructure over time. Some of the issues discussed below are based on documented testing or incidents involving particular versions, apps, or features. Always check the provider’s current policies and app version before making a final decision.

What Makes a VPN One of the Worst?

The worst VPNs are not necessarily the ones with the slowest speeds or fewest servers. A VPN becomes particularly concerning when its privacy and security protections conflict with what users reasonably expect from a privacy service.

We look at several factors when assessing whether a VPN belongs among the worst VPNs to avoid.

Weak or Outdated Encryption

Encryption is one of the fundamental jobs of a VPN. When you connect to a VPN server, your traffic should be protected inside an encrypted tunnel before it travels across the internet.

Reputable providers generally support established VPN protocols such as WireGuard, OpenVPN, or IKEv2. They also use strong modern cryptographic algorithms such as AES-256 or ChaCha20.

The exact implementation matters, too. Simply displaying “military-grade encryption” on a website does not prove that an app is secure.

IP, DNS, IPv6, or WebRTC Leaks

A VPN should prevent websites and other online services from seeing your real public IP address.

It should also prevent DNS requests from escaping through your ISP’s resolver. Otherwise, your ISP could potentially see the domains your device is requesting even though your main traffic is passing through a VPN tunnel.

WebRTC can create another potential exposure point in browsers, while IPv6 can bypass a VPN that only properly handles IPv4 traffic.

These are not theoretical concerns. VPN testing methodologies commonly check IP, DNS, IPv6, and WebRTC behavior because a VPN can appear connected while still exposing information outside the tunnel.

A VPN that repeatedly fails these tests deserves serious scrutiny.

Questionable Logging Policies

“Zero logs” is one of the most common VPN marketing claims. The problem is that there is no single universal definition of a no-logs VPN.

One provider might mean that it does not record browsing history. Another may still retain connection timestamps, bandwidth consumption, device identifiers, IP addresses, or diagnostic information.

Those distinctions matter.

A provider handling your internet traffic should clearly explain what information it collects, why it collects it, how long it retains it. They should also make it clear whether it shares the information with third parties.

A vague privacy policy does not automatically make a provider malicious, but it should make you cautious.

Lack of Independent Audits

A privacy policy is a promise from the VPN company. An independent audit can provide evidence supporting that promise.

Audits vary considerably in quality. Some examine infrastructure and logging systems. Others review application security or specific privacy controls.

A strong VPN should make it reasonably easy to understand:

• Who performed the audit
• When it was performed
• What systems were examined
• What the scope covered
• Whether significant findings were identified
• Whether the provider addressed those findings

A lack of an audit is not automatically proof that a VPN is unsafe. However, when an obscure provider combines vague policies with questionable technical behavior, the absence of independent verification becomes another warning sign.

Poor Ownership Transparency

Who operates your VPN matters.

You are effectively moving trust from your ISP to the VPN provider. The provider may have technical access to information about your connection, even when it cannot see the contents of properly encrypted HTTPS traffic.

If you cannot determine who owns or operates a VPN, it becomes harder to evaluate its incentives, jurisdiction, privacy obligations, and history.

Aggressive Advertising and Third-Party Tracking

A free VPN still needs to make money. That money can come from subscriptions, advertising, affiliate arrangements, or other forms of monetization.

The problem arises when the business model involves extensive tracking or sharing of user information with third parties.

Research into free Android VPN applications has repeatedly found privacy and security problems. One large investigation of 100 popular free Android VPNs found that 88% had some form of data leak and 71% shared user data with third parties.

That does not mean every free VPN is unsafe. It does mean that the worst VPNs can hide behind an attractive “free” price.

Poor Kill Switches

A kill switch is designed to block internet traffic when the VPN connection unexpectedly drops. This prevents your device from silently switching back to your ordinary internet connection.

A broken kill switch is particularly dangerous because it creates a false sense of security. You may assume the VPN is protecting you while traffic is actually leaving through your ISP connection.

Independent VPN testing specifically checks what happens during connection failures and route changes because this is one of the easiest ways to expose weaknesses in a VPN client.

Poor Security Updates

VPN applications are software, and software can contain vulnerabilities. A provider that responds quickly to security issues, publishes updates, and maintains its applications across major platforms gives users a much stronger security baseline.

On the other hand, an abandoned or poorly maintained VPN app can become a liability even if its original design was reasonable.

The Worst VPNs to Avoid in 2026

The following services deserve caution based on documented privacy or security concerns. This does not mean every user of every version of these products will experience the same problem.

Instead, these are examples of services where we believe the documented concerns are serious enough that privacy-conscious users should consider alternatives.

1. Urban VPN Proxy

Urban VPN Proxy deserves a place on this list because of the serious controversy surrounding its browser extension and AI conversation data.

In December 2025, security researchers reported that Urban VPN Proxy and related browser extensions were collecting conversations from AI services including ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI.

The reported data included prompts, responses, conversation identifiers, timestamps, and session information.

That is particularly concerning because users install VPN extensions to improve privacy. An extension capable of accessing browser-level content introduces an entirely different privacy risk.

Urban VPN has disputed some of the reporting. The company says its AI Protection feature is optional, requires explicit consent, and can be disabled without uninstalling the VPN.

Its current privacy policy also acknowledges that AI inputs and outputs may be processed when the relevant features are used.

The dispute itself is worth noting, but the incident illustrates an important lesson: VPN privacy is not limited to the encrypted tunnel.

Browser extensions can have access to information that exists inside the browser. That means users should examine extension permissions and data-handling practices separately from the VPN protocol.

2. VPN Proxy Master

VPN Proxy Master has also raised privacy concerns in independent testing. A 2024 investigation into 100 popular free Android VPNs found that VPN Proxy Master contained third-party code and permissions capable of accessing precise location data.

The investigation identified third-party components associated with companies including ByteDance, Yandex, Google Ads, and other advertising technology firms.

Location information can be sensitive even when it does not include your exact street address. Repeated location data can reveal where you live, work, travel, shop, and spend your time.

This is exactly why VPN users should look beyond the basic question of whether an app changes their IP address. Changing your IP address does not automatically make an application privacy friendly.

3. Betternet VPN

Betternet is another service that requires careful consideration. Independent research into popular Android VPN applications found Betternet among apps containing third-party code and permissions associated with background location tracking.

The research specifically identified advertising SDKs from companies including Amazon Ads, Google Ads, and AdColony in the app.

Betternet’s own privacy materials have evolved, and the provider now publishes an independent security audit and states that it does not log browsing activity that can be tied back to users.

That is important context.

We would not describe every current Betternet feature or version as inherently malicious based solely on older research. However, the historical data-collection findings are significant enough that privacy-conscious users should examine the current app carefully.

4. Touch VPN

Touch VPN is another service where users should pay close attention to the distinction between VPN browsing activity and broader app telemetry.

Touch VPN’s current product privacy notice says it does not store information connecting individual users to their VPN browsing activity. However, the provider also states that it collects information such as session duration, bandwidth usage, device hashes, and certain diagnostic information.

Its broader privacy materials also describe collection of device, usage, diagnostic, and approximate location information depending on the service being used.

The Android app’s current Google Play listing also states that the app may share certain data types with third parties, including location and app activity.

None of this proves that Touch VPN records the websites you visit and associates them with your identity. Its current VPN-specific policy explicitly says it does not do that.

The concern is broader.

When a VPN is marketed as a privacy tool, users should understand what information the surrounding application and advertising ecosystem may still collect.

5. X-VPN

X-VPN demonstrates why the distinction between free and paid VPN services matters. Investigative testing of popular paid Android VPN applications found that X-VPN’s freemium model shared personal data.

The same research found that this sharing stopped after upgrading to a paid subscription. That model may be commercially understandable. A company providing a free service still needs to generate revenue.

But it creates an important privacy question.

What happens if a user believes they are protected but is actually using a free tier with substantially different data-handling practices?

On top of this, users also need to consider subscription failures, expired trials, and app changes. A privacy product should make the difference between its free and paid privacy protections extremely clear.

6. Hotspot Shield Free VPN

Hotspot Shield has a long history of privacy controversy. In 2017, the Center for Democracy & Technology filed a complaint with the U.S. Federal Trade Commission alleging that Hotspot Shield Free VPN’s privacy and security practices conflicted with its marketing claims.

The complaint focused on alleged tracking, redirection, and advertising-related practices. That is an older case, and the VPN industry has changed significantly since then.

It would be inaccurate to treat a historical complaint as proof that every current version of Hotspot Shield behaves in exactly the same way.

However, the case remains useful when evaluating the history of a VPN provider and illustrates why privacy claims should be tested against actual technical and business practices.

Quick Comparison of the VPNs to Avoid

The following table summarizes the main concerns discussed above.

Why You Should Avoid These VPNs

The worst VPNs tend to have one thing in common: there is a disconnect between what the user expects a VPN to do and what the product actually does.

You install a VPN because you want greater privacy. Suddenly, you discover that the application collects extensive telemetry, uses third-party tracking libraries, requests unnecessary permissions. It even exposes information outside the VPN tunnel.

That defeats much of the reason for using a VPN in the first place.

A VPN Changes Who You Trust

A VPN does not make you anonymous. It changes the path your traffic takes and moves part of the trust relationship away from your internet service provider and toward the VPN provider.

The FTC explains this distinction clearly: a VPN can prevent the local network from seeing the contents of properly encrypted VPN traffic, but the VPN provider itself becomes an important party in the trust chain.

That means choosing a VPN is partly an exercise in choosing a company you are willing to trust.

Marketing Claims Are Not Security Evidence

The worst VPNs often have impressive marketing. You may see terms such as:

• Military-grade encryption
• Bank-grade security
• Zero logs
• Total anonymity
• Complete privacy
• Unbreakable protection

These phrases mean very little without technical evidence. Good VPN reviews should look at the actual protocol, encryption configuration, leak behavior, kill switch, privacy policy, ownership, audits, and application permissions.

A VPN Can Have a Great Rating and Still Have Problems

App-store ratings are useful, but they should not be your main security metric. A user may give a VPN five stars because it successfully changed their Netflix region. Another user may rate it five stars because the interface is easy to use.

Neither review tells you whether the application collects excessive data or whether its kill switch works during a network interruption. That is why security research and technical testing matter.

Are Free VPNs the Worst VPNs?

Not automatically.

There are legitimate free VPN services. Some use free plans as a way to introduce users to paid products. Others deliberately limit servers, speeds, locations, or monthly data rather than monetizing users through aggressive advertising.

The problem is that free VPNs have a difficult business model.

Operating VPN servers costs money. Maintaining applications, hiring security engineers, providing customer support, conducting audits, and managing infrastructure all cost money.

If users pay nothing, the provider still needs a revenue source. That is how you end up with some of the worst VPNs in the industry.

Why Some Free VPNs Are Risky

Free VPNs can use several monetization methods. Some display advertisements inside the application. Others may use third-party analytics or advertising SDKs.

Some impose severe bandwidth limitations. Others encourage users to upgrade by restricting server locations. The more concerning model is one where personal or device information becomes part of the provider’s commercial ecosystem.

The important question is therefore not simply:

“Is this VPN free?”

It is:

“How does this VPN make money?”

When a Free VPN Can Be Reasonable

A free VPN may be worth considering when the provider:

A free plan from a reputable paid VPN provider is generally easier to evaluate than a completely unknown VPN that promises unlimited service at no cost.

How to Identify a Bad VPN Before Installing It

You do not need to be a cybersecurity engineer to spot many of the warning signs associated with the worst VPNs.

Start with these checks.

Check Who Owns the VPN

Look for the company behind the application then ask yourself the following questions

• Can you find a legitimate corporate website?
• Does the company identify its management team?
• Does it provide a physical business address?
• Does it explain where the company is incorporated?

None of these factors alone prove that a VPN is safe. Together, however, they can help you distinguish an established provider from an anonymous application developer.

Read the Privacy Policy

Do not stop at the phrase “no logs.” Search the privacy policy for:

• IP address
• Device ID
• Advertising ID
• Location
• Bandwidth
• Connection time
• Browsing activity
• DNS
• Third parties
• Analytics
• Cookies
• Data retention
• Data sharing

Pay attention to whether the provider differentiates between the VPN service itself and its website, browser extension, mobile application, and advertising systems.

Check App Permissions

A VPN application needs certain network privileges. It does not necessarily need access to every part of your device.

The FTC recommends reviewing the permissions requested by VPN applications and questioning permissions that do not appear necessary for the app’s purpose. An app asking for sensitive permissions deserves additional scrutiny.

Look for Independent Audits

A published audit can provide evidence that supports a provider’s privacy claims. But read the scope. An audit of the website is not the same as an audit of the VPN infrastructure. Furthermore, an application security audit is not the same as a no-logs audit.

The best VPN providers publish enough information for users to understand what was actually tested.

Test for Leaks

A VPN should be tested with the connection active.

Check:

• Public IPv4 address
• IPv6 address
• DNS resolvers
• WebRTC exposure

You should also test what happens when the VPN connection suddenly drops. A single successful IP check is not enough.

VPN testing methodologies emphasize that browser-based leak tests are snapshots and cannot prove that every application and every network transition is protected.

That is why a proper VPN review should combine several leak tests.

How We Test and Rank the Worst VPNs

Our approach to identifying the worst VPNs focuses on measurable behavior and documented evidence rather than subjective opinions.

Security Testing

We look at the VPN protocol and encryption standards first. Established protocols such as WireGuard, OpenVPN, and IKEv2 generally provide a stronger foundation than proprietary or poorly documented alternatives.

Then, we look at IP, DNS, IPv6, and WebRTC leaks. Finally, we test the kill switch by interrupting the VPN connection and checking whether traffic continues outside the tunnel.

This is important because a VPN can pass a basic IP test while failing during a connection transition.

Privacy Testing

Privacy assessment goes beyond reading the provider’s homepage.

We examine its privacy policy, data collection practices, jurisdiction, ownership, audit history, and third-party relationships. We also distinguish between the VPN’s core traffic-handling practices and the broader application ecosystem.

This distinction matters because a VPN may claim not to log browsing activity while its application still collects device information, advertising identifiers, or other telemetry.

Performance Testing

Performance is important, but it should not outweigh privacy and security. A VPN that is extremely fast but leaks your real IP address is not a good VPN. We therefore treat performance as one part of the evaluation rather than the entire evaluation.

Transparency

Transparency is particularly important when investigating the worst VPNs. A provider that clearly explains its infrastructure, ownership, privacy practices, security audits, and data retention gives users more information with which to make an informed decision.

Any provider that hides these details gives you less reason to trust it.

What Should You Use Instead?

Finding the worst VPNs is only useful if you know what to choose instead.

Rather than selecting a VPN because it appears first in an app store, start with established providers. These are services that publish detailed privacy policies, use modern protocols, invest in infrastructure, and provide meaningful security documentation.

Providers such as NordVPN, Surfshark, ExpressVPN, CyberGhost, and PIA are worth comparing based on your specific requirements.

The right choice depends on what you need from a VPN.

A user who mainly wants privacy on public Wi-Fi may have different requirements from someone who needs a VPN for gaming, streaming, torrenting, travel, or accessing work resources.

The important part is choosing a provider with a credible security and privacy foundation.

Conclusion

The worst VPNs are not necessarily the services with the fewest servers, lowest speeds, or worst streaming performance. The real warning signs involve privacy, security, transparency, and data handling.

A VPN should protect your connection rather than introduce another layer of tracking.

That is why we look beyond marketing claims when evaluating VPNs. The best approach is to investigate the provider, test its technical protections, read its privacy policy, and look for independent evidence.

When your primary reason for installing a VPN is privacy, privacy should remain the first thing you evaluate.

FAQ