Always-On VPN on Android: The Setting Most People Skip

You pay for a VPN, you install the app, and you assume your phone is protected. Then one afternoon you glance at the status bar on café Wi-Fi and notice the little key icon is missing. The app was quietly closed sometime overnight, perhaps by the battery saver, perhaps after an update, and for the last few hours your traffic has been going out the ordinary way. You had no idea.

This is the most common gap I see when people ask me to look at their phones. The VPN works perfectly when it is on. The problem is all the time it is not on and nobody notices. Android has a system setting that closes most of that gap, and it sits two menus deep where almost nobody goes. Here is what it does, how to switch it on, and the trade offs nobody mentions in the app store listing.

Why a VPN app drops without telling you

A VPN on Android runs as an ordinary app with special permission to route your traffic. Like any app, it can be stopped. The usual culprits are aggressive battery optimisation (some phone makers are far stricter about this than stock Android), a system update that restarts the phone, the app crashing after its own update, or you swiping it away from recent apps without thinking.

When that happens, Android does not panic. It simply sends your traffic over the normal connection, because from its point of view, nothing is wrong. Most VPN apps show a notification while connected, but the absence of a notification is easy to miss. You notice things that appear, not things that vanish.

What Always-on VPN and "Block connections" actually do

Android has two related switches, both in the system settings rather than inside the VPN app.

Always-on VPN, available since Android 7, tells the system to start your chosen VPN as soon as the phone boots and to restart it if it stops. It is the operating system taking responsibility for keeping the app alive, which is more reliable than the app trying to look after itself.

Block connections without VPN, added in Android 8, goes further. If the VPN is not connected, apps get no network access at all. This is the system level version of a kill switch, and it matters because the OS enforces it even when the VPN app itself has been closed. If you want the background on why kill switches exist, our explainer on what a VPN kill switch does covers it.

How to turn it on

The exact menu names vary between phone makers. These steps follow a Pixel; I have added the Samsung path where it differs.

1. Open your VPN app once and connect, so Android knows which VPN to use.
2. Go to Settings > Network & internet > VPN. On a Samsung Galaxy it is Settings > Connections > More connection settings > VPN.
3. Tap the gear icon next to your VPN's name.
4. Switch on Always-on VPN.
5. Switch on Block connections without VPN.
6. Go to Settings > Apps, find the VPN app, open Battery and choose Unrestricted, so the battery saver stops closing it.
7. Test it: turn on aeroplane mode, turn it off again, and watch whether the key icon returns before any page loads.

If the Always-on switch is greyed out, the VPN app does not support it. That is worth knowing before you renew a subscription, and it is one of the questions I would add to any checklist for choosing a provider.

The advice I disagree with: "the app's kill switch is enough"

Many VPN apps advertise their own kill switch, and reviews often treat that as the end of the story. On Android I do not think it is. An in-app kill switch depends on the app running. If the system closes the app to save battery, the app cannot block anything, because it is no longer there to do the blocking. The system setting does not have that weakness.

That said, the system setting is not perfect either, and I would rather say so plainly. In 2022 the VPN company Mullvad reported that Android still sends a small amount of traffic outside the tunnel even with blocking turned on, mainly the checks the phone uses to test whether a network has internet access. Google's position was that this is intended behaviour. For most people that leak is minor, since it reveals that a phone is online rather than what it is doing. For someone with a serious reason to hide their location from a local network, it is worth knowing about.

A VPN protects you only while it is running. The setting that keeps it running matters as much as the VPN you chose.

The trade offs you will notice

The biggest one is Wi-Fi login pages. Hotels, airports and some trains make you accept terms on a web page before the internet works. With blocking on, your phone cannot reach that page, because the VPN cannot connect until you log in, and you cannot log in until the VPN connects. The fix is clumsy but quick: switch off Block connections without VPN, log in to the Wi-Fi, then switch it back on. I keep a note on my home screen reminding me to do the last step, because I forgot twice in one trip. Our guide to public Wi-Fi risks and simple fixes explains why it is worth the hassle on those networks in particular.

Battery use goes up slightly, since the VPN never sleeps. On my phone the difference across a normal day was a few percent, smaller than I expected, though older phones and weaker signals will show more.

Some apps behave oddly too. Banking apps occasionally refuse to open over a VPN, and a few local services, like a smart speaker setup app or a printer, may not find devices on your home network. Most VPN apps offer split tunnelling to exclude specific apps, which solves this without turning everything off.

And you can only have one VPN active at a time on Android. If your workplace uses its own VPN on the same phone, the two will fight, and you will need to choose.

If you use an iPhone

iOS has no equivalent switch for ordinary users. A true always-on VPN is reserved for phones managed by a company or school through device management. What you can do is turn on the "Connect On Demand" or auto connect option inside your VPN app, which tells iOS to reconnect whenever you use the internet. It is less strict than Android's blocking, but it covers most of the gaps. If several devices in your home need protection, putting the VPN on the router instead is another route, which we walk through in setting up a VPN on a router.

Five minutes this week

Pick up your Android phone today and open the VPN settings page from the steps above. If both switches are off, turn them on, set the app's battery use to Unrestricted, and do the aeroplane mode test. Then leave it for a week and see whether anything you rely on breaks. If nothing does, you have closed the gap most VPN users never realise they have. More device guides are in our devices section.