There’s a new warning for smartphone users. Free apps with hundreds of millions of installs are now putting users, devices and data at risk. And this problem is about to get worse, with millions more certain to install those apps within weeks as a new porn ban goes into effect, putting more iPhone and Android users in danger.

We’re talking VPNs and a new report that says many of the top free apps on both Apple’s App Store and Google’s Play Store are secretly sending data to China. Free VPNs are dangerous, but two events have turned many of these apps into viral blockbusters.

The first was the short-lived TikTok ban in the U.S., which saw a VPN surge even if using VPNs did not actually solve the problem — those apps are still on phones today. The second is ongoing and more widespread and is set for a new surge.

We’re talking porn bans and the age or identity verification checks required to access the world’s most popular websites. Multiple U.S. states have now jumped on this bandwagon, resulting in many U.S. users installing VPNs for the first time.

As the Tech Transparency Project warns, “millions of Americans have downloaded apps that secretly route their internet traffic through Chinese companies.” And if the political push to introduce a national U.S. porn ban is successful, this will get much worse.

VPNs — virtual private networks — route all online traffic to and from a device via a third-party server. The risk is that the wrong type of VPN is more dangerous than no VPN at all. And while users in plenty of places around the world cannot access the free internet without these location and identity masking tools — that’s not the case anywhere in the U.S. At least not before these porn bans started to come into effect.

But unlike the TikTok ban, VPNs easily bypass porn restrictions, tricking the websites into thinking you’re in a different location not subject to any bans or requiring any form of verification. But while it’s easy to skirt the rules, you could be putting your device and your data at risk, sending all your traffic to a shady foreign server.

Now the U.K. is set to do the same. A month from now — on July 25 — it will mandate the same government approved age verification before users can access porn sites.

Per BBC News, “Pornhub and a number of other major adult websites have confirmed they will introduce enhanced age checks for users from next month. Parent company Aylo says it is bringing in ‘government approved age assurance methods’ but has not yet revealed how it will require users to prove they are over 18.”

The U.K.’s controversial Online Safety Bill will “bring pornography into line with how we treat adult services in the real world,” say the regulator charged with enforcing the new laws, warning that “recent research indicated 8% of children aged 8-14 in the UK had visited an online porn site or app over a 28-day period.”

Porn is more popular than ever on mobile devices, which are more at risk from free VPNs than other devices. It’s all too easy to install a free app from even the official stores without asking how the app is being funded or who operates the service.

As BeyondTrust’s James Maude told me, “if you aren’t paying for a product, you are the product. These VPN services are a perfect example of the hidden costs of free apps.”

The advice on VPNs is simple:

1. Only install VPNs from Google’s Play Store or Apple’s App Store
2. Only use paid VPNs on a clear monthly or annual subscription for a sensible amount, never use a VPN with obfuscated in-app purchases
3. Only use VPNs from recognized developers that you can easily find on mainstream websites, and never any that operate out of China
4. Always ensure Play Protect is enabled on Android, and never disable or pause Play Protect to install a VPN that has been flagged as high-risk.