The VPN must provide basic functionality by encrypting traffic and routing it to a server operated by the VPN company. It cannot compromise privacy and security for free subscribers.