What a free app is actually selling
The transaction you didn’t notice
You downloaded a flashlight app, a calculator, a game, a “battery saver.” It didn’t ask for a credit card. It just asked for permissions, and you tapped allow because the alternative was not having a flashlight app. That’s the whole transaction. No money changed hands because you weren’t the customer. You were the product being prepared for sale.
This isn’t a conspiracy theory, it’s a business model, and it’s worth understanding the mechanics rather than just repeating the slogan. Free apps make money in a small number of concrete ways, and almost all of them involve turning something about your device or your behavior into data that someone else will pay for.
Where the money actually comes from
Strip away the marketing and a free app has roughly four revenue paths: showing you ads, selling data about you to brokers or advertisers, upselling you to a paid tier, or being funded by a company that wants the userbase itself (for research, for a future acquisition, for training a model). Most free apps run on the first two, often stacked together.
Ad-supported apps don’t just show you a banner and call it done. They integrate one or more ad SDKs (software development kits) from companies like Google, Meta, or smaller ad networks. These SDKs run inside the app with the same permissions the app has. When the app can see your location, so can the SDK. When it can read your device’s advertising identifier, so can every SDK bundled into it. A single “free” app can carry three or four of these SDKs simultaneously, each one a separate pipe sending data to a separate company, and you’ll never see any of their names in the app itself.
The SDK is the storefront
This is the part that surprises people: the app developer often isn’t the one directly selling your data to a data broker. They’re integrating a monetization SDK that does it for them, in exchange for a cut of ad revenue or a flat payment. The SDK vendor’s actual product is the aggregated behavioral profile it builds across every app that includes its code. Your flashlight app and someone else’s weather app might share the exact same ad SDK, which means both are feeding the same profile of you.
This is also why permissions matter more than the app’s stated purpose. A flashlight app has no functional reason to know your location, your contacts, or which other apps are installed on your phone. When it asks for those anyway, the request usually isn’t coming from “the flashlight,” it’s coming from the SDK riding inside it.
What permissions really unlock
Android and iOS both gate this kind of collection behind permission prompts, and the permission system does real work here, it’s not theater. But a permission grant is broad. If you allow “location,” you’ve allowed it for the app and everything bundled inside the app, not just the one feature that prompted the request. If you allow “photos,” an SDK with bad incentives can, within the bounds of what the OS permits, scan metadata across your library rather than just the one image you picked.
The mobile advertising identifier (called IDFA on iOS, GAID on Android) is the connective tissue here. It’s a resettable ID tied to your device that lets advertisers and brokers stitch together behavior across different apps without needing your name. Apple’s App Tracking Transparency prompt and Android’s equivalent controls exist specifically because this ID is what makes cross-app profiling cheap and automatic. Turning tracking off for an app doesn’t erase data already collected, and it doesn’t stop every method of correlation, but it does close the cheapest and most common one.
Location data is the most valuable thing on your phone
Of everything a free app can collect, precise location is usually worth the most, because it’s the hardest to fake and the easiest to monetize. Location data gets sold. Real estate analytics firms buy it, and so do hedge funds trying to estimate foot traffic at retailers. Ad targeting companies buy it to build “visited a competitor’s store” audiences. So do government contractors, who purchase commercially available location datasets rather than seeking a warrant.
That last point matters for how you think about this. Location brokers aggregate data from many apps and resell it as a dataset, and buyers of that dataset aren’t limited to advertisers. This is worth knowing because “the app is free” and “the data stays with the app” are two completely different claims, and only the first one is usually true.
The free VPN paradox
This one deserves a direct callout because it inverts what people expect. A VPN’s entire pitch is that it hides your traffic from your ISP and from networks you connect to. A free VPN still has to pay for bandwidth and servers. If it isn’t charging you, the same logic applies. It’s often selling something about your traffic or your connection metadata, or bundling an SDK that monetizes your device in the background.
There have been well-documented cases of free VPN apps logging traffic they promised not to log, or being owned by ad-tech companies with a direct financial interest in the data flowing through their servers. This doesn’t mean every free VPN is malicious, some are loss leaders for a paid tier and behave exactly as advertised. It does mean a VPN’s no-logging claim is a policy statement, not a technical guarantee, and it’s worth checking who owns the app and what their business actually is before you route your traffic through it. No VPN, free or paid, makes you anonymous. It changes who can see your traffic, not whether anyone can.
What “anonymized” data usually means
Privacy policies love the word “anonymized” or “aggregated.” In practice this usually means your name and email are stripped, while your advertising ID, device fingerprint, approximate location trail, and app usage pattern stay attached to a record. That record is not the same as “anonymous” in any strong sense. Researchers have repeatedly shown that location trails alone, even without a name attached, can be re-identified to a specific person with a small number of data points, because most people’s movement patterns are distinctive (home, workplace, a few regular stops).
That doesn’t mean anonymization is worthless, stripping direct identifiers does raise the cost and effort required to re-identify someone. It means you should read “anonymized” as “harder to attribute,” not as “impossible to attribute.”
Reading a privacy label like it means something
Both app stores now require some form of disclosure, Apple’s privacy labels and Google’s Data safety section. They’re useful and worth checking before you install something, but they’re self-reported by the developer, checked inconsistently, and describe categories of data rather than exact behavior. A label saying “data not linked to you” is a claim by the developer about their own practices, not an independent audit. Treat it as one data point, alongside who built the app, how it makes money, and whether it needs the permissions it asks for.
What you can actually do about it
None of this means you need to delete every free app you own or that a single setting change solves it. A few things genuinely reduce your exposure without requiring you to become a different person:
Check permissions against function. If an app doesn’t need location, contacts, or the microphone to do its one job, deny it, or use “only while using the app” instead of “always.”
Turn off ad tracking at the OS level (App Tracking Transparency on iOS, “opt out of ads personalization” on Android). This resets and limits the advertising ID that ties your behavior together across apps. It reduces cross-app correlation, it doesn’t stop collection inside a single app you’re actively using.
Prefer apps with a stated revenue model you can point to. A subscription. A one-time purchase. An ad tier you opted into. Be warier of the ones that are free with no visible business behind them and ask for permissions unrelated to their function.
Periodically review installed apps and permissions on your phone rather than only at install time. Permission needs and app ownership both change over time.
None of this makes you invisible, and anyone telling you a single setting or a single app gets you there is selling something. What it does is shrink the number of pipes running out of your phone and make the ones that remain intentional rather than default.
The bottom line
A free app is a business, and businesses have revenue. When you can’t identify where the money comes from, the honest assumption is that it’s coming from data about you, whether that’s ad impressions built on your behavior, a dataset sold to a broker, or both. That’s a reason to ask the same question you’d ask of any other free service: what exactly am I paying with, and am I okay with that price.
If you want more explainers like this one that stick to how things actually work instead of fear-selling you a fix, check out the rest of The Privacy Wire.