So here's a clear-eyed look at what a VPN genuinely does, what it doesn't, and when it's actually worth using.
First, How a VPN Actually Works
When you connect to the internet normally, your traffic goes from your device to your internet service provider (ISP), then out to whatever server or website you're accessing. Your ISP can see which sites you're visiting, when, and how often. The websites you visit can see your IP address, which reveals your approximate location and can be used to track activity across sessions.
A VPN inserts an encrypted tunnel between your device and a VPN server. Your traffic gets routed through that server before it reaches its destination. This means the websites you visit see the VPN server's IP address, not yours — and your ISP sees that you're connected to a VPN, but can't read the contents of your traffic.
That's the core mechanism. Everything a VPN can and can't do flows from that.
What a VPN Does Hide
Your IP Address From Websites and Services
When you're connected to a VPN, the sites and services you visit don't see your real IP address — they see the VPN server's. This limits their ability to pinpoint your physical location and makes it harder to link your browsing activity across different sites based on IP alone. If you've ever noticed ads that seem eerily specific to a place you've recently visited, that's partly IP-based geolocation at work. A VPN disrupts that.
Your Browsing Activity From Your ISP
Without a VPN, your internet service provider has a relatively clear view of which domains you're visiting. In many countries, ISPs are legally permitted — or even required — to retain this data, and in some cases it can be shared with third parties or requested by authorities. A VPN encrypts that traffic, so your ISP can see that you're using a VPN and how much data you're transferring, but not which sites you're visiting or what you're doing there.
Your Traffic on Public Wi-Fi
This is one of the genuinely strong use cases for VPNs. Public Wi-Fi networks at coffee shops, airports, and hotels are not trustworthy by default. A bad actor on the same network can potentially intercept unencrypted traffic — a technique called a man-in-the-middle attack. A VPN encrypts everything leaving your device, which significantly reduces the risk of traffic interception on networks you don't control.
Your General Location
Because websites see the VPN server's IP rather than yours, they infer your location based on where that server is, not where you actually are. This is what allows VPN users to access streaming libraries from other countries, or browse from a server in a country with fewer content restrictions. It's a geographic mask, not true anonymity — but it does meaningfully obscure your real location from most services.
What a VPN Does Not Hide
This is the part that matters just as much, and gets far less airtime in VPN marketing.
Your Activity From the VPN Provider Itself
When you use a VPN, you're not becoming invisible — you're shifting who can see your traffic. Instead of your ISP, it's now the VPN provider. If that provider keeps logs of your activity (and some do, regardless of what their marketing says), your data exists somewhere. A VPN provider that gets served a legal request, suffers a breach, or simply has poor data practices can expose what you were doing. "No-logs" policies are common in the industry, but they vary in how comprehensively they're audited and enforced. Trusting a VPN means trusting the company behind it.
Your Identity When You're Logged Into Accounts
Here's something that surprises a lot of people: once you log into Google, Facebook, your email, or any service tied to your identity, that service knows who you are — regardless of what IP address you're coming from. A VPN hides your IP; it doesn't hide the fact that you're signed in as you. If you're browsing logged into your Google account with a VPN, Google still has a complete picture of your activity. The VPN protects the network-level data, not the account-level data.
You From Browser Fingerprinting and Tracking Cookies
Advertisers and analytics platforms have developed tracking methods that don't rely on IP addresses at all. Browser fingerprinting collects data points about your browser configuration — fonts installed, screen resolution, plugins, system settings — and combines them into a unique identifier that follows you across sites. Tracking cookies do something similar within sessions and across sites that share ad networks. A VPN does nothing to either of these. They operate at the application layer, above where VPN encryption is relevant.
Malware or Phishing Attacks
A VPN is not an antivirus and doesn't protect you from malicious software or deceptive websites. If you click a phishing link or download something compromised, the VPN doesn't intervene. Some VPNs offer supplementary threat protection features that block known malicious domains, but this is an add-on to what VPNs fundamentally do — it's not core to the technology itself.
Your Activity From Employers or Schools on Their Networks
If you're connected to a corporate or institutional network, the organization managing that network may have monitoring in place at a deeper level than a consumer VPN can address. Some corporate security setups include endpoint monitoring — software on the device itself — which sits above the VPN and can log activity regardless of whether encrypted traffic is being used.
Legal Liability
This one's worth stating plainly: using a VPN doesn't make illegal activity legal or untraceable. VPN providers can and do respond to valid legal requests in the jurisdictions where they operate. Jurisdictions matter here — a provider based in a country with strong privacy protections and no data-retention laws is meaningfully different from one that operates in a country with broad surveillance laws. But no VPN is a legal shield.
When a VPN Is Actually Worth Using
Given all of the above, when does a VPN make sense?
It makes genuine sense when you're regularly on public Wi-Fi and want to reduce the risk of traffic interception. It makes sense when you want to limit what your ISP can see about your browsing habits — whether for privacy preference or because you're on a network that throttles certain types of traffic. It makes sense for bypassing geo-restrictions on streaming services or accessing content that's unavailable in your region. It makes sense if you're traveling to a country with heavy internet censorship and need to access restricted services.
It makes less sense as a primary privacy solution for people who are logged into their Google or Meta accounts all day, since those platforms have tracking that bypasses the IP-level protections VPNs offer. And it's not a substitute for more comprehensive security practices — strong passwords, two-factor authentication, an up-to-date browser, and basic phishing awareness all do more for day-to-day security than a VPN does.
Choosing a VPN That's Actually Trustworthy
If you're going to use a VPN, the provider matters enormously. A few things worth evaluating:
Jurisdiction. Where is the company legally based? This determines what data retention laws apply to them and what legal processes can be used to compel disclosure.
Audit history. Has the provider had their no-logs policy independently audited by a credible third-party security firm? Audits aren't a guarantee, but they're a meaningful signal compared to a self-reported policy.
Ownership and funding. Some VPN providers have been acquired by data brokers or advertising companies — a significant red flag given that the whole point is keeping your data out of those companies' hands.
Transparency reports. Reputable VPN providers publish regular transparency reports detailing government requests they've received and how they've responded.
Providers with strong reputations in the privacy and security community — like Mullvad, ProtonVPN, and IVPN — tend to score well on most of these criteria. Free VPNs, as a category, tend to score poorly, since a free VPN needs to monetize somehow, and the most common way is through data.
FAQ
Does a VPN make me anonymous online? Not fully. A VPN adds meaningful privacy protections at the network level, but anonymity also requires not logging into accounts tied to your identity, avoiding browser fingerprinting, and using additional tools like the Tor network. For most people's needs, a good VPN provides useful privacy — but "anonymous" sets an unrealistic expectation.
Can my ISP see that I're using a VPN? Yes. Your ISP can see that traffic is going to a VPN server and how much of it there is. They can't see what's inside that traffic when it's encrypted. In most countries, using a VPN is entirely legal, though some restrict VPN use.
Does a VPN slow down my internet? Usually, yes — to some degree. Traffic has to make an extra hop through the VPN server, and encryption adds processing overhead. How much it slows things depends on the server's load, its geographic distance from you, and the protocol being used. Premium providers using modern protocols like WireGuard tend to have minimal impact on speed.
Is a free VPN worth using? With very few exceptions, no. Free VPNs have to generate revenue somewhere, and in many documented cases that's meant selling user data — which directly contradicts the reason most people use a VPN. Some even inject ads or contain malware. The exceptions are providers like ProtonVPN, which offers a limited free tier funded by paying customers, with the same no-logs infrastructure as their paid service.
Should I keep my VPN on all the time? There's no universal answer. Running it constantly gives consistent IP masking and ISP-level privacy, but adds latency and can occasionally break certain services. Many people use a "VPN on by default on public networks, optional at home" approach. It depends on your threat model — what you're actually trying to protect against.
The Honest Take
A VPN is a useful privacy tool that does a specific set of things well. It's not a silver bullet, it's not anonymity software, and it's definitely not a substitute for broader digital security practices. Understanding exactly what it protects — and what it doesn't — is what lets you decide if and how it fits into your setup.
The VPN industry has done a remarkable job of selling a partial solution as a complete one. That doesn't mean the tool isn't worth using — it means using it with clear eyes is a lot more valuable than using it on the strength of a well-produced YouTube sponsorship.
📚 Sources
Electronic Frontier Foundation – VPN myths and realities: https://www.eff.org/pages/tools
Wirecutter (NYT) – What a VPN can and can't do: https://www.nytimes.com/wirecutter/guides/what-is-a-vpn/
Mullvad VPN – No-logs policy and independent audit details: https://mullvad.net/en/blog/2020/4/27/mullvad-audited-by-cure53-for-the-third-time/
ProtonVPN – How VPN encryption works: https://protonvpn.com/blog/what-is-vpn-encryption/
NIST – Guidelines on enterprise VPN security: https://csrc.nist.gov/publications/detail/sp/800-77/rev-1/final
Cloudflare – What is browser fingerprinting?: https://www.cloudflare.com/learning/privacy/what-is-browser-fingerprinting/
