Every free PDF site looks the same: a big “Drop your file here” box, a button, a download. What sets them apart isn't on the screen: where the file goes, how long it stays there, who else is watching your visit, and the point at which free stops being free.
We gathered this information for ten of the most widely used services in France. One thing to say up front, since we make a PDF tool ourselves: none of the figures in this comparison comes from us. The tracker data comes from an independent observatory; everything else comes from the pages each service publishes. It's all sourced; the method is set out further down, along with how to run the test yourself.
The table
| Service | Company (country) | File uploaded to a server | Stated retention | Trackers per page | Tracking requests | Free tier |
|---|---|---|---|---|---|---|
| iLovePDF | ILOVEPDF S.L. (Spain) | Yes | 2 h (signed documents: 5 years) | 2.2 | 13% | Limited per task; ads |
| Smallpdf | Smallpdf AG (Switzerland) | Yes | 1 h with an account; “a reasonable period” without | 4.4 | 10% | Limited, no figures given |
| PDF24 | geek software GmbH (Germany) | Yes (except the Windows software) | 1 h | 2.9 | 52% | Unlimited; ads |
| Adobe Acrobat online | Adobe (US; Irish subsidiary) | Yes | deleted “soon”, no time frame given | 6.3* | 8% | 1 operation without an account |
| Sejda | Sejda BV (Netherlands) | Yes (except the desktop software) | 2 h | 3.4 | 47% | 3 tasks/hour, 50 pages |
| PDF Candy | Icecream Apps Ltd (Cyprus) (privacy) | Yes | 2 h | no profile | — | Limited, no figures given; no ads (pricing) |
| Soda PDF | Avanquest Software (imprint) | Yes | 24 h | no profile | — | 2 files/day, 3 MB |
| PDF2Go | QaamGo Web GmbH (Germany) | Yes | “as long as necessary” | 4.3 | 23% | Limited; ads |
| Convertio | Convertio Ltd (Cyprus) | Yes | Input: immediate; output: 24 h | 5.9 | 35% | 10 min of conversion/day (terms); ads |
| Online2PDF | Austrian operator, self-described as non-commercial (contact) | Yes | Immediate (90 s to download) | no profile | — | Free, 500 pages; ads |
Trackers: averages measured by WhoTracks.me (Ghostery). “Tracking requests”: the share of a page's network requests that are used for tracking. *For Adobe, the figure covers the whole adobe.com domain. “No profile”: the site isn't in WhoTracks.me's panel, which doesn't mean it has zero trackers.
We read the pages of three of these services in detail: Smallpdf, Adobe Acrobat online and PDF24.
First finding: all ten upload your file
None of the ten services documents any in-browser processing for its online tools. All of them upload the file to a server, process it, then delete it after a set period. Several offer a local alternative in the form of software you install: PDF24 Creator for Windows, for instance, or Sejda's desktop app, whose maker states that “files never leave your computer” (Sejda).
Second finding: retention ranges from “immediate” to 24 hours
The stated periods run from immediate deletion to twenty-four hours. Online2PDF and Convertio delete input files as soon as the conversion is done; iLovePDF, Sejda and PDF Candy keep them for two hours; Soda PDF, and Convertio for the converted file, keep them for up to twenty-four hours. Adobe says it deletes files “soon” and PDF2Go keeps them “as long as necessary”, with no figure attached; Smallpdf only commits to one hour for signed-in users.
These periods are commitments, not technical guarantees anyone outside can verify. And they say nothing about intermediaries: several services go through Cloudflare, an American company, or through American hosting providers, which exposes the data to the CLOUD Act.
Third finding: the page you drop your file on is often an advertising page
Seven of the ten services have a profile on WhoTracks.me. On five of them (iLovePDF, Smallpdf, Sejda, PDF2Go, Convertio), a Google tool appears on more than 70% of the pages observed; at Adobe, it's mainly the company's own tools, plus consent-management, analytics and ad-targeting providers. Some go further:
- at PDF24, more than half of the requests made by its pages are for tracking (WhoTracks.me);
- at Sejda, nearly half (WhoTracks.me);
- at PDF2Go, the observatory records Microsoft Clarity, a tool that logs clicks and scrolling, on 89% of pages, and Amazon Advertising on 69% — neither of which appears in its privacy policy (WhoTracks.me, PDF2Go);
- at Smallpdf, Microsoft Advertising shows up on 63% of pages, and it too is missing from the privacy policy (WhoTracks.me).
Two GDPR rules put these findings in context: a privacy policy must state the categories of recipients of the data (LegalPlace), and consent to non-essential trackers must be given through an affirmative act (LegalPlace).
Advertising isn't a crime; it often pays for the free service, and PDF24 is open about it. But it does mean that the moment you drop a payslip on the page, several third-party companies are told about your visit.
Fourth finding: free comes with very different limits
PDF24 and Online2PDF impose next to no limits. At the other end, Soda PDF stops at two 3 MB files a day, Adobe at one operation without an account, Sejda at three tasks an hour. iLovePDF limits the number of files per task (two for compression). Smallpdf, PDF Candy and PDF2Go don't publish precise figures. As soon as you hit a limit, most of them invite you to create an account — which, from then on, ties your files to an identity.
Not in the table
Xodo, from the Canadian company Apryse, limits free use to one action a day; it says most of its tools process files on the device, and that the ones that upload them delete them after an hour; its privacy policy lists OpenAI, Google, Hotjar and Microsoft Clarity among its third parties (Xodo, Apryse). Stirling-PDF is a case apart: this open-source software can be installed on your own server or computer, in which case the files never leave the machine; its online version is run by a San Francisco company (Stirling-PDF, privacy).
Method, and its limitations
Trackers. We used WhoTracks.me, Ghostery's observatory. Its data comes from users of the Ghostery extension, aggregated anonymously, and covers the 10,000 most visited websites in the world; the method is described in a research paper and on GitHub. Two limitations: the profiles don't show the period over which the data was collected, and a site outside the panel has no profile — which doesn't mean it has no trackers.
Uploads, retention, limits. We recorded what each service publishes about itself, on 27 September 2026: security pages, FAQs, privacy policies, terms, pricing pages. These are statements, not measurements. Services update these pages regularly; the links in the table let you check.
What we didn't do. We didn't measure these sites' network traffic ourselves. You can do it in a minute, on any site, ours included: open your browser's developer tools, go to the Network tab, drop in a file and watch what goes out. Here's the walkthrough.
What about PDFKami?
We're not in the table, because we couldn't mark our own homework, and because PDFKami has no WhoTracks.me profile. Here's what we state, and what anyone can check with the method above: PDFKami processes files in the browser, without uploading them; the site's security policy technically blocks any connection to another site; there are no cookies, no trackers, no ads, no account and no usage limits. Try it once, then switch off the Wi-Fi: the tools still work.
What PDFKami doesn't do, on the other hand: OCR, PDF-to-Word conversion, electronic signatures. For those, the table above will help you make an informed choice.