VPN advertising tends to promise privacy in general terms, which oversells what the technology actually does. A VPN solves a specific problem well: it hides your traffic from the network you are connected to. It does not solve every privacy problem, and knowing the boundary is what lets you decide if you need one.
What a VPN actually does
A VPN (virtual private network) creates an encrypted tunnel between your device and a server operated by the VPN provider. Two concrete things follow from that:
- Your internet provider, or the operator of a public Wi-Fi network, cannot see which sites you visit, only that you are connected to the VPN server.
- The sites you visit see the VPN server's IP address, not your own, which hides your general location and network identity from them.
That is the whole mechanism. Everything else marketed around it is downstream of those two facts.
What it does not do
It does not make you anonymous. The moment you log into an account — email, banking, social media — that service knows who you are, VPN or not. A VPN changes what your network can see; it does not change what the services you use already know about you.
It does not block trackers or cookies. Advertising and analytics trackers identify you through cookies, device fingerprinting and account logins, none of which a VPN interferes with. A VPN plus a tracker-blocking browser addresses more of this than either alone.
It does not protect you from phishing, malware or weak passwords. It secures the network connection, not your judgment or your credentials.
It moves your trust, rather than removing it. Without a VPN, your internet provider can see your traffic. With one, your VPN provider can, at least in principle. Choosing a VPN is choosing who you trust with that visibility, not eliminating the need for trust altogether.
When a VPN is genuinely useful
- On public Wi-Fi — airports, cafes, hotels — where anyone else on the network could otherwise intercept unencrypted traffic.
- On a home network where you specifically want to shield browsing from your internet provider.
- When traveling, to reach services that behave differently or are unavailable based on network location.
- On a shared or unfamiliar network where you do not control the router.
When it is not doing much
If most of what you do is already on HTTPS sites — the padlock in the browser address bar — a meaningful share of your traffic is already encrypted in transit regardless of a VPN, since HTTPS encrypts the connection to the site directly. A VPN adds an additional layer, but the marginal benefit on an already-encrypted connection, on a network you trust, is smaller than the advertising suggests.
Choosing a provider, if you decide you want one
- How does it make money? A free VPN's costs have to be covered somehow, commonly through data collection and resale, which undermines the reason to use one. A paid provider with a clear subscription model has a more straightforward incentive structure.
- What is the logging policy, specifically? Look for a no-logs policy that describes what is not collected, not just a marketing claim, and whether it has been independently audited.
- Where is the company based, and what legal obligations does that create for handing over data?
- Does it support modern protocols and a kill switch, which blocks internet access if the VPN connection drops, preventing an accidental unprotected moment?
The bottom line
A VPN is a network-layer tool for a network-layer problem: shielding your traffic from the network you are on. It is worth using on public Wi-Fi and worth considering for a home network where you specifically want to limit what your provider sees. It is not a substitute for the account-level habits that protect you far more broadly — unique passwords, two-factor authentication, and care about what you click — covered in how to secure your online accounts and how to protect your privacy online.
