<![CDATA[Virtual Private Network (VPN) services are widely used by the general public to browse the internet more securely, bypass geographic restrictions, or gain access to blocked services and content. Among the available options, free VPN applications are particularly favored by lay users due to their accessibility and absence of subscription fees. However, behind this convenience lie various security and privacy risks that are often unrecognized by users, ranging from data leaks and weak or non-existent encryption to the practice of selling user data to third parties. This study aims to systematically review the security aspects of free VPN usage, focusing on the understanding and vulnerabilities faced by lay users who generally lack a technical background in cybersecurity. The method used is a literature review of scientific publications, independent research reports, and relevant policy documents on VPN security published within the last five years. The review results indicate that most popular free VPN applications contain significant security flaws, such as IP and DNS leaks, the use of risky third-party libraries, excessive permission requests, and non-transparent logging practices. Low digital literacy exacerbates these risks, as lay users rarely read privacy policies or verify a provider's reputation before installing an application. This study recommends improving digital security literacy, developing practical guidelines for selecting safe VPNs, and establishing clearer regulations for VPN service providers operating in Indonesia.]]>
