The Mobile VPN App Market: Downloads, Revenue and the Publishers Behind It

The mobile VPN market is dominated by a small number of apps with hundreds of millions of installs, and many of the most-downloaded ones are free, ad-supported apps from publishers most users have never heard of. Paid subscription brands such as NordVPN and ExpressVPN earn the most revenue, while free apps lead on raw downloads. Independent investigations in 2025 showed that several of the largest free apps hide their real owners behind shell companies.

Full-market revenue totals are mostly locked behind paid platforms, so the verifiable public data consists of app store install counts, published app-intelligence figures and investigations into who runs the apps.

The biggest mobile VPN apps by Google Play installs

Google Play shows each app’s install count in broad tiers (for example “100M+”). The tiers here come from the store listings of widely used VPN apps on October 1, 2026.

The only app in the 500M+ tier is Turbo VPN, a free, ad-supported app. The “developer” name on a listing often reveals little: Innovative Connecting, the listed developer of Turbo VPN, is one of the companies that researchers and the Tech Transparency Project have linked to Chinese security firm Qihoo 360 (see below).

Install counts are lifetime totals across all versions and include people who uninstalled the app years ago, so they show reach, not current users.

Subscription brands lead on revenue

Public revenue data for individual VPN apps is scarce, but the snapshots that app-intelligence firms publish point the same way: paid brands earn far more per user than free apps.

In Sensor Tower’s Q2 2025 ranking of Android tools apps in Europe, NordVPN came first by revenue, with peak weekly revenue of about $304,000 and peak weekly downloads of 133,000 in early June. ExpressVPN ranked fifth, with peak weekly revenue of about $50,000. The other three places went to antivirus apps from AVG, Avast and Norton (Sensor Tower, 2025).

Lifetime US revenue figures show that even “free” apps make substantial money through ads and premium upgrades. Using AppMagic estimates from May 2025, the Tech Transparency Project reported that X-VPN had earned more than $10 million in lifetime US revenue on each of Apple’s and Google’s stores, while VPN Proxy Master and Turbo VPN had each passed $5 million on at least one store (TTP, 2025).

The publishers behind the apps

Hidden corporate families

A 2025 paper by researchers at Arizona State University and the Citizen Lab examined 21 Android VPN apps from 13 seemingly separate providers with more than 972 million combined Google Play downloads (Mixon-Baca, Knockel and Crandall, 2025). They grouped the providers into three hidden “families” using business filings, app code and network tests. The families alone accounted for more than 700 million downloads.

• Family A: Innovative Connecting, Autumn Breeze and Lemon Clove, behind apps including Turbo VPN, VPN Proxy Master, Snap VPN and Robot VPN. The apps presented themselves as Singapore-based, but prior research linked the companies to a Chinese national and to Qihoo 360.
• Family B: companies including MATRIX MOBILE PTE LTD, ForeRaya Technology and WILDLOOK TECH, behind apps such as XY VPN, Global VPN and Super Z VPN. Two of their privacy policies referred to Innovative Connecting.
• Family C: Fast Potato and Free Connected Limited, the Hong Kong company behind X-VPN, which shared a proprietary protocol and code library.

The researchers also found that apps in two of the families shared hard-coded encryption passwords, a security problem covered in our free VPN app security report.

Undisclosed Chinese ownership in the App Store

The Tech Transparency Project (TTP) reported in April 2025 that one in five of the top 100 free VPN apps in Apple’s US App Store during 2024 were owned by Chinese companies without clearly saying so (TTP, 2025). Those 20 apps had more than 70 million US downloads, according to AppMagic data cited by TTP. They included X-VPN (ranked 4th), VPN Proxy Master (12th) and Turbo VPN (13th). A June 2025 follow-up found 13 such apps still on the App Store and 11 on Google Play (TTP, 2025).

Sensor Tower’s undisclosed VPN apps

In 2020, BuzzFeed News reported that app-analytics firm Sensor Tower had secretly owned at least 20 apps, including Free and Unlimited VPN and Luna VPN, with more than 35 million downloads. Some prompted users to install root certificates that allowed broad access to their traffic. Sensor Tower said it collected only anonymized usage data and that most of the apps were defunct (BuzzFeed News, 2020).

How demand moves the market

Downloads swing sharply with censorship and regulation. When India restricted Telegram in June 2026, Appfigures told TechCrunch that daily downloads of major VPN apps rose 49%, from about 139,000 to 208,000. Proton VPN climbed from 18th to 5th in Apple’s Utilities chart and from 8th to 2nd in Google Play’s Tools category (TechCrunch, 2026). Our VPN demand spikes timeline lists dozens of similar events.

Platform rules that shape the market

Apple and Google set the terms under which VPN apps reach users.

• Apple’s Guideline 5.4 requires VPN apps to comply with the law wherever they are offered and states that VPN apps are not permitted in China unless pre-approved by the government (Apple, 2026).
• In 2023, Google Play introduced an “Independent security review” badge for VPN apps that pass the App Defense Alliance’s Mobile Application Security Assessment (MASA). NordVPN, Google One and ExpressVPN were first (BleepingComputer, 2023).
• A stricter “Verified” badge followed in January 2025. It requires MASA Level 2 validation, an organization developer account, at least 10,000 installs and 250 reviews, and 90 days on the store (9to5Google, 2025).

Free versus paid among users

Survey data suggests free apps are gaining ground. In Security.org’s August 2026 survey of US adults, 43% of VPN users relied on a free service, up from 28% a year earlier. The most-cited brands among users were NordVPN (24%) and Proton VPN (15%) (Security.org, 2026).

Choosing a mobile VPN app

• Look past the app name. Tap through to the developer page and check the company name, address and privacy policy. A Singapore or Hong Kong address alone is not a warning sign, but a vague one with no company website is.
• Prefer apps with a security review badge on Google Play. The badge does not guarantee privacy, but it means the app passed an independent baseline test.
• Remember how free apps pay their bills. “Contains ads” on a VPN listing means an advertising business sits inside an app that can see your traffic.
• Do not treat big install numbers as a safety signal. Several apps with 100M+ installs belong to the hidden families described above.

Methodology

Google Play install tiers, listed developer names and monetization labels come directly from the US English store listings on October 1, 2026. Revenue and download figures come from publicly released Sensor Tower data, AppMagic figures cited by the Tech Transparency Project and Appfigures and Sensor Tower data cited by TechCrunch. Ownership information comes from the TTP investigations and the peer-reviewed FOCI 2025 paper.

Google Play install tiers are coarse and cumulative, and Apple does not publish download counts. App-intelligence revenue figures are model-based estimates, not company disclosures. Total market-size and company revenue figures (for example, widely shared totals for annual VPN app revenue) are excluded because no primary source for them could be opened. This report describes the market and does not recommend any app.