Open Wi-Fi networks can be dangerous, especially if you use websites that don't have TLS encryption (HTTPS), because someone could capture all that plain-text traffic, including your login credentials to different websites.
Some VPN companies are promoting their services as a way to protect yourself against this type of attack, but VPN services aren't usually free, or if they are, the monthly bandwidth limit is quite small, and they might do some tracking themselves in order to show you more targeted ads.
However, Google may be working on a built-in VPN service for all Android users in the future that would protect their mobile browsing when connecting to open Wi-Fi networks. The hint is a new hidden feature in Android 5.1. By using an app such as QuickShortcutMaker you can link to the hidden Android activity found at:
After you click on the newly created shortcut, you are greeted with a screen that says, "To help protect you on open Wi-Fi networks, your data will be transmitted securely through a Google VPN."
If you click "Learn more," you are taken to a Google support page, and clicking "Got it" takes you to a standard VPN connection request screen.
This doesn't actually do anything right now, though, as Google hasn't launched the service yet, which is why the feature isn't readily available for anyone to use.
Google plans to launch a new wireless service soon, which will presumably use Wi-Fi networks as well as LTE connections from carriers such as T-Mobile and Sprint. Those networks will likely be open Wi-Fi networks, although Google could probably just as easily require its customers to log in to those networks with their Google accounts.
Google's VPN can protect against hacking and spying from others, but if the sites you log in to don't use HTTPS connections, then Google can also see your traffic data, including your login credentials to other sites.
Google could become a "zero-knowledge" VPN provider to reassure people that the VPN is only intended to protect against hacks and is not just another way to collect data on user's online activities, but it remains to be seen what the company will do. Ultimately, you'll still have to trust that Google is keeping your connections private, whether it promises to track your traffic or not.