I'm assuming this would be done by zero-rating their advertising service. They already imply that they restrict traffic on their Free plan to certain services s

I'm assuming this would be done by zero-rating their advertising service. They already imply that they restrict traffic on their Free plan to certain services so I would assume they use the same mechanism to allow traffic to pass through their advertising service even when a users free plan has run out. Here is a paper on how websites could be identified for zero-rating: https://www.researchgate.net/publication/343966537_Knocking_on_IPs_Identifying_HTTPS_Websites_for_Zero-Rated_Traffic https://www.researchgate.net/publication/343966537_Knocking_... It has a whole list of possible methods.