You didn’t pay for that flashlight app, that mobile game, or that habit tracker sitting on your phone right now. Somebody still got paid. It just wasn’t you, and the currency wasn’t money, it was you.
That old line, “if you’re not paying for the product, you are the product,” gets repeated so often it barely registers anymore. So let’s skip the slogan and get specific: what exactly gets collected, who buys it, and what it’s worth once it changes hands.
Free Was Never the Business Model
A free app still has servers to run, developers to pay, and investors expecting a return. None of that happens on goodwill. The app needs a revenue line somewhere, and for most free apps, that line is advertising, which means the app’s real customer is the ad network, not you.
Once you accept that framing, the rest of how these apps behave stops looking strange. The permissions requests, the account sign-ins, the “allow tracking” pop-ups, all of it exists to make you a more valuable product to sell.
The Two-Sided Market You Never Signed Up For
Economists call this a two-sided market: one side gets the app for free, the other side pays for access to that first side’s attention and data. You’re on the free side. Advertisers are on the paying side. The app itself is just the meeting point, and it’s built to keep both sides coming back.
What a Free App Actually Collects
Most people picture data collection as something abstract, a vague cloud of “information” floating somewhere. In practice, it’s a lot more granular than that, and a lot more mundane.
A typical free app can track:
Your precise location, often even when the app is closed
The device you’re using, its model, its operating system, its unique advertising ID
Which other apps are installed on your phone
How long you spend on each screen, and what you tap, scroll past, or ignore
Your contacts, your photos, your microphone or camera, if you granted the permission
The Advertising ID Is the Real Star
Every phone carries a device advertising identifier, a long string of letters and numbers that doesn’t have your name attached to it, but does the job of a name anyway. Ad networks link this ID across every app you use, every website you browse on that device, and every purchase tied to it. Your name never needs to appear for the profile to be complete.
How Ad Networks Turn That Into Cash
Once your data leaves the app, it enters a pipeline most users never see. The app sends behavioral signals to an ad network. The ad network folds those signals into a profile. Advertisers then bid to show that profile a specific ad, in real time, in the fraction of a second before a page loads.
How it happens
Real-time bidding. Every time an ad slot loads, dozens of advertisers bid on the right to show you an ad, based on your profile, in under 300 milliseconds.
Data brokers. Separate companies buy behavioral data from multiple apps, merge it into a single profile, and resell that profile to advertisers who never touched the original app.
Why Some Users Are Worth More Than Others
Not every profile sells for the same price. A user who regularly browses car listings and lives near a dealership is worth more to an auto advertiser than a random visitor from another country. Location, purchase intent, and income signals all push the price of a single ad impression up or down, sometimes by a wide margin.
What a Single Profile Actually Sells For
Individual data points are worth close to nothing on their own. A single location ping or a single app-open event sells for a fraction of a cent. The value comes from volume and from combination, which is exactly what the mobile ad industry is built to produce at scale.
Under $0.001
What a single banner ad impression typically pays an app
$300B+
Estimated size of the global data broker industry in 2025
1,500+
Data points a single broker profile can hold on one person
Sources: Mistplay mobile eCPM report, Fortune Business Insights, Adreva data broker overview.
The Free Game That Made Millions Off Nothing But Attention
Mobile games are the clearest example of this math working at scale. A free puzzle game with no in-app purchases can still generate significant ad revenue purely from session length and ad impressions, multiplied across millions of daily players. No purchase ever needs to happen. Attention alone is the product.
The Apps Worth a Second Look
Some categories collect more aggressively than others, usually because their entire business case depends on it rather than on subscription revenue or a paid tier.
Categories to check permissions on twice:
Weather apps that ask for precise location instead of approximate location
Flashlight and utility apps requesting contacts or camera access they don’t need to function
Free VPN apps, which are frequently funded by selling the exact browsing data they claim to protect
Casual games with account logins tied to a phone number or email rather than a guest profile
The Irony of the “Free VPN”
A free VPN still needs to cover server and bandwidth costs somehow, and a fair number of them cover those costs by logging and reselling the traffic passing through their own servers. Handing your entire browsing history to the one app claiming to hide it is a worse trade than most people realize.
What Actually Reduces Your Value on the Market
You won’t get your data out of every broker database that already holds it, and no single setting undoes years of collection. A few habits do meaningfully shrink how much new data these networks can add to your profile going forward.
1. Turn off ad tracking at the operating system level.
Both iOS and Android let you reset or limit your advertising ID. It won’t stop collection entirely, but it breaks a lot of the cross-app linking that makes profiles valuable.
2. Grant location access only “while using the app,” and only when the app needs it.
A food delivery app needs your location to find you. A language learning app does not. Treat every location request as a question worth answering separately.
3. Mask your IP address on the apps and sites you use most.
Your IP address ties your device to a rough location and, over time, to a browsing pattern that data brokers can match against other sources. Hiding it removes one of the easier signals to collect.
4. Read the permissions list before you tap install, not after.
If a simple utility app is asking for your contacts, your microphone, and background location, that mismatch is the clearest signal available that data collection, not the utility itself, is the actual product.
Where an Ad Blocker Actually Fits Into This Picture
Everything above happens before an ad ever reaches your screen. An ad blocker works on the other end of the pipeline, at the moment the ad is about to load, which is also the moment a fair amount of tracking and risk gets introduced. That’s the part ZoogVPN’s Ad Blocker is built to interrupt.
The Trackers Riding Along With the Ads
Most ad slots don’t load in isolation. They pull in third-party scripts that read your device, your session, and sometimes your scroll behavior, feeding the same profile-building process described earlier in this piece. Global research puts ad blocker adoption at close to 30 percent of internet users, and privacy concerns are consistently the top reason people give for turning one on, ahead of speed or convenience. ZoogVPN’s Ad Blocker works at the connection level rather than as a browser add-on, so it strips out ad requests and the third-party trackers bundled with them across apps, not just tabs.
The Security Angle Is Not an Afterthought
Ad slots are also a real delivery channel for malware, not a theoretical one. Confiant’s mid-2025 ad quality data found that roughly 1 in every 78 ads served carried some verifiable risk to the person viewing it, whether that meant a scam page, a malicious redirect, or AI-generated deception. Separately, malvertising incidents rose 42 percent year over year in 2025, the sharpest jump recorded since 2019. Because ZoogVPN’s Ad Blocker filters ad content before it loads, it removes a meaningful share of that exposure along with the ads themselves, rather than reacting to malware after the fact.
One Toggle, Every Connected App
The feature turns on the moment you connect to any ZoogVPN server, with no separate extension to install or configure per browser. That also covers ad interruptions on streaming apps and smart TVs, which sit outside what a standard browser-based ad blocker can reach in the first place. Switching it off is just as quick, from the same menu in the dashboard.
One less data point to sell
Free apps still collect. Your IP doesn’t have to help them.
ZoogVPN masks your IP address and location across every app and browser tab you use, so ad networks get one fewer signal to fold into your profile. Turn on the built-in Ad Blocker in the same dashboard, and the trackers and malicious ad content get filtered out before they ever load.
- Diana BestaievaContent Writer at ZoogVPN. Diana deeply explores the newest technologies and shares valuable insights engagingly and comprehensively. Keeping up with the tech news, she makes in-depth content, explaining complex concepts with ease.
