An investigation has uncovered several VPNs with links to the Chinese military. The apps have hundreds of thousands of downloads, and pose a serious risk to the data of their users.
These developments do not involve any of the providers included in our guide to the best VPNs, but American data appears to be the primary target.
One in five of the top 100 free VPNs listed on the U.S. Apple App Store were "surreptitiously" owned by Chinese companies.
China's data laws can force companies to share user data with the government, meaning Chinese authorities could access the internet traffic of a significant number of Americans.
The ownership of these apps is deliberately opaque as they're hidden behind layers of offshore shell companies, and none clearly disclose their Chinese ownership.
20 Chinese-owned VPNs
The research was carried out by the Tech Transparency Project (TPP), with additional work carried out by the Financial Times. The latter reportedly notified Apple of its findings.
At least five free VPN apps were traced back to a firm known as Qihoo 360. The company has previously been listed as a "Chinese Military Company" and was sanctioned by the U.S. Commerce Department in June 2020 on national security grounds.
The listed apps are:
- Turbo VPN
- VPN Proxy Master
- Thunder VPN
- Snap VPN
- Signal Secure VPN (no relation to the encrypted messaging app, Signal)
According to the TPP report Apple removed Thunder VPN and Snap VPN from the App Store after being alerted to their presence.
Tom's Guide checked the U.S Apple App Store and saw Turbo VPN, VPN Proxy Master, and Thunder VPN all listed. Variations of all five VPNs were seen on the U.S Google Play Store.
At the time of writing, Turbo VPN and VPN Proxy Master were present on the UK Apple App Store. Snap VPN and Signal Secure VPN did not appear, whilst Turbo VPN appeared but under a different developer name to that listed in the TPP report.
These five apps are also currently listed on the UK Google Play Store, along with a number of the other free VPNs mentioned in the report.
Tom's Guide has discovered that Turbo VPN has been given a verified badge by Google, which indicates it is a trustworthy VPN.
Google said in a blog post in January that the badge is "designed to highlight apps that prioritize user privacy and safety, help users make more informed choices about the VPN apps they use, and build confidence in the apps they ultimately download."
The fact Turbo VPN has received a verification badge does not inspire confidence in Google's assessment process.
Turbo VPN was number 13 in the App Store's top 100 free VPNs last year. In 2025 it has been advertising itself on Facebook and Instagram, saying it can help navigate the TikTok ban – Tom's Guide found that VPNs couldn't bypass the ban.
Its website lists its developer as the Singapore-based Innovative Connecting. But according to the TPP, corporate records list its sole shareholder as Lemon Seed Technology Ltd, registered in the Cayman Islands.
The TPP reported that Lemon Seed Technology was acquired by 360 Security Technology, aka Qihoo 360, in 2019.
By piecing together a number of corporate documents, the TPP was able to determine 20 VPN apps listed on the U.S. App Store were Chinese-owned. According to the TPP, these apps have been downloaded more than 70 million times.
Apple's failings
Apple's privacy policy states it strongly believes in "fundamental privacy rights" and it imposes strict rules for VPN app developers.
Its App Review Guidelines state that "apps offering VPN services may not sell, use, or disclose to third parties any data for any purpose, and must commit to this in their privacy policy."
But allowing these unchecked VPN apps on its App Store clearly contradicts this statement and leaves us asking how these apps, and other fake free VPNs, can be listed.
Tom's Guide approached Apple for comment and the company told us it takes user privacy and security extremely seriously, citing its strict VPN app developer guidelines.
Apple said that any developers found breaking its rules can be removed from the App Store and any collection of user data, alongside the reasons for this, must be declared prior to service use.
Protect your data
If you have any of these VPN apps downloaded, delete them.
Delete any personal data you can from the apps and consider submitting a data removal request, asking for any stored personal data to be deleted.
Trustworthy VPNs do not log your personal data or internet traffic and many have undergone independent audits to prove this. Make sure any VPN you're considering signing up to has a no- or zero-logs policy – ideally one it can prove.
We would always recommend a paid VPN service to benefit from the best cybersecurity protection possible, and if you're on a budget, our list of the best cheap VPNs is a great place to start – PrivadoVPN currently works out as $1.11 per month.
If you are set on not paying for a VPN, then consider one of the best free VPNs. They're trustworthy, won't log your data, and still protect your data with strong encryption.
PrivadoVPN Free and Proton VPN Free are our two favorites. They don't come with the same number of features as their paid counterparts, but are both very decent free VPNs that will protect you online.
Disclaimer
We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
