Millions of free VPN users have inadvertently sent their data to China

Update: After publication, on April 2, 2025, we received a response from Apple. We made some edits to the copy to reflect this.

Millions of free VPN users in America have sent their data to China without knowing it. At least five of these services are linked to Qihoo 360, a Shanghai-based firm hit by US sanctions in 2020 for alleged links with the Chinese military.

These are the worrying findings from an investigation carried on by the Tech Transparency Project (TTP) into the top 100 free VPN apps on Apple’s official app store in the US. Overall, experts found 20 apps had undisclosed Chinese ownership and had been downloaded more than 70 million times.

The China-linked VPN apps are also currently available in both Apple and Google’s official app stores in and out of the US, the UK included. This indicates that the real number of impacted users is likely to be even higher.

The danger of China-linked VPNs

While the best VPN services boost your online anonymity and security by encrypting your internet traffic and spoofing your IP address, malicious apps pose great risks to your privacy.

That’s because providers can potentially read the internet traffic rerouted via their servers. “That risk is compounded in the case of Chinese apps, given China’s strict laws that can force companies in that country to secretly share access to their users’ data with the government,” TTP experts noted.

Worse still, understanding the real ownership behind these free VPN applications isn’t easy. TTP found that none of the 20 China-linked services disclosed this crucial information. The team was able to determine this by piecing together several corporate documents.

Turbo VPN, VPN Proxy Master, Thunder VPN, Snap VPN, and Signal Secure VPN are the five services linked to Qihoo 360. The Shanghai-based firm has been previously accused of having ties with the Chinese military. For this, the US sanctioned the company on national security grounds in June 2020.

All in all, “Apple is not taking adequate steps to determine who owns the apps it offers its users and what they do with the data they collect,” TTP experts note.

Replying to these allegations, Apple told TechRadar the company has some strict guidelines in place for VPN app developers, but it doesn’t limit app distribution based on where the provider is based. Breaking Apple guidelines – which forbid, among other things, VPN services to sell, use, or disclose to third parties any data for any purpose – can lead to Apple removing the app from the App Store.

I first raised the alarm about the Turbo VPN family of #VPN apps and their Chinese ownership links in 2018. Looks like I was right & they’re connected to blacklisted Chinese security firm Qihoo 360. It highlights the problem with free VPNs…April 2, 2025

Apple isn’t alone to allegedly failing user privacy, though.

As reported by the Financial Times, Qihoo-linked apps were all available on Apple and Google’s US stores as of last week. “After the Financial Times contacted Apple for comment, Thunder VPN and Snap VPN were pulled from its store,” pointed out the publication.

It’s estimated that three of these apps alone were downloaded more than 1 million times from the Apple App Store and Google Play Store combined in the past three months.

Turbo VPN even obtained Google’s verified badge, a label that helps users easily identify secure and trustworthy services.

TechRadar was also able to confirm that, at the time of writing, these apps are still available across Apple and Google’s official app stores in the UK. The apps are likely to remain available in other markets, too, considerably raising the number of impacted users.

Which are the China-linked free VPNs?

TTP experts flagged a total of 20 free VPN apps with shady Chinese ownership. This count excludes those services clearly labelling themselves as Chinese in the App Store, making their China connection clear to users.

As mentioned earlier, five of these have links with Shanghai-based Qihoo 360, a company believed to have ties with the country’s military bodies. Below is the full list:

Read More

• Qihoo 360-linked VPNs (Turbo VPN, VPN Proxy Master, Thunder VPN, Snap VPN, and Signal Secure VPN)
• X-VPN
• VPNIFY
• VPN Bucks
• VPN Proxy Master
• LinkWorldVPN
• WireVPN – Fast VPN & Proxy
• Wirevpn – Secure & Fast VPN
• VPN Proxy OvpnSpider
• Best VPN Proxy AppVPN
• Ostrich VPN
• HulaVPN
• VPN Ⓟ (removed from App Store in 2024)
•  Best V2ray (removed from App Store)
• Alphaoo Net (removed from App Store)
• SwiftLink VPN (removed from App Store)
• Speedy Quark VPN
• Now VPN
• Incognito Net (removed from App Store)
• Pearl VPN

Next steps

With the deadline for the TikTok ban in the US looming in the background, more people in the country may soon be tempted to download a free service to find a quick and easy way to circumvent potential blocks.

If you aren’t willing to invest in a premium VPN service, I recommend checking Proton VPN and Privado VPN, as they currently are the most secure freebies you can find on the market.

I also invite everyone who has previously downloaded one of the aforementioned applications to delete their account and apps from their device as soon as possible.

You might also like

• Over 2.5 billion free Android VPN users at risk of data leaks
• 2024 saw a surge in malicious free VPN apps
• It’s not just free VPNs, these premium services may be bad for your privacy

TOPICS

Chiara Castro

News Editor (Tech Software)

Chiara is a multimedia journalist committed to covering stories to help promote the rights and denounce the abuses of the digital side of life – wherever cybersecurity, markets, and politics tangle up. She believes an open, uncensored, and private internet is a basic human need and wants to use her knowledge of VPNs to help readers take back control. She writes news, interviews, and analysis on data privacy, online censorship, digital rights, tech policies, and security software, with a special focus on VPNs, for TechRadar and TechRadar Pro. Got a story, tip-off, or something tech-interesting to say? Reach out to [email protected]

Please follow our community guidelines.

“>

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Logout