What a VPN Actually Does
A VPN — Virtual Private Network — creates an encrypted tunnel between your device and a server operated by the VPN provider. From there, your traffic continues to the internet. The result is twofold: your internet service provider (ISP) can no longer easily see which websites you visit, and those websites see the VPN server's IP address rather than your own.
This matters most on public Wi-Fi networks — in coffee shops, airports, or hotels — where other users on the same network could potentially intercept unencrypted data. A VPN substantially reduces that exposure. It also limits how much your ISP can log or sell about your browsing habits, which is a real and documented commercial practice in the United States.
For a broader look at what online encryption does and doesn't cover, see our explainer on HTTP vs. HTTPS.
Encrypts traffic on untrusted public Wi-Fi networks
On shared networks, a VPN prevents other users from intercepting your unencrypted data, which is particularly relevant when accessing sensitive accounts while traveling.
Limits ISP visibility into your browsing habits
In the U.S., ISPs are legally permitted to collect and monetize browsing data. A VPN makes it significantly harder for them to build a detailed profile of your online activity.
Masks your IP address from visited websites
Websites log IP addresses by default; a VPN substitutes the provider's IP for yours, reducing one data point that can be used for tracking or geo-targeting.
Useful for remote workers accessing company networks
Many organizations require employees to connect via VPN to access internal systems securely, making it a standard corporate security tool with a well-established use case.
What a VPN Cannot Do
Marketing around VPNs frequently overstates their protective power. A VPN does not make you anonymous. Websites can still identify you through browser fingerprinting, cookies, and login accounts — none of which a VPN addresses. If you log into Google while using a VPN, Google still knows who you are and what you're doing.
A VPN also provides no protection against malware, ransomware, or phishing attacks. It won't alert you to a fake website, won't block a malicious download, and won't prevent you from handing over your password to a convincing scam page. These threats require different tools — antivirus software, browser security settings, and good judgment.
Critically, using a VPN shifts trust rather than eliminating it. Instead of your ISP observing your traffic, your VPN provider can. Providers with vague or non-existent no-logging policies represent a real privacy risk. This is why the provider's jurisdiction, ownership, and published privacy policy deserve scrutiny before you commit.
Online safety myths that give people a false sense of security covers this kind of misplaced confidence in detail.
Does not provide anonymity online
Cookies, login accounts, and browser fingerprinting can all identify you regardless of VPN use. Expecting anonymity from a VPN alone leads to a false sense of security.
Shifts trust to the VPN provider
Your traffic is visible to the VPN server. Providers with weak privacy policies, unclear ownership, or histories of data disclosure can represent a privacy risk in themselves.
No protection against malware or phishing
A VPN cannot detect or block malicious downloads, fake websites, or social engineering attacks — threats that account for the majority of real-world security incidents.
Can noticeably reduce connection speed
Routing traffic through an additional server and encrypting it introduces latency. The impact varies by provider and server location, but it is a consistent trade-off.
Many free VPN services carry significant risks
Free VPNs frequently monetize user data — the very activity most people use a VPN to prevent. Some have been found to contain malware or sell browsing histories to third parties.
How VPNs Fit Into a Broader Privacy Strategy
A VPN works best as one layer in a larger privacy approach, not a standalone fix. Consider pairing it with:
- Strong, unique passwords managed through a dedicated tool — see how password managers work for a plain-language overview.
- HTTPS awareness — understanding what the padlock in your browser actually protects (and where it doesn't help).
- Basic digital hygiene — keeping software updated, recognizing phishing attempts, and limiting what personal data you share with apps and services.
For readers new to this space, Digital Privacy from the Ground Up offers a practical starting point without requiring technical knowledge.
Free VPNs: A Specific Caution
Many no-cost VPN services generate revenue by collecting and selling the very browsing data users expect them to protect. Security researchers have documented cases of free VPN apps containing malware or transmitting user data to third parties. If you decide a VPN fits your needs, a provider with an independently audited no-logging policy and a clear business model is worth the additional scrutiny — and often the cost.
The decision to use a VPN ultimately comes down to your specific threat model — what you're trying to protect, from whom, and in what situations. There is no single right answer for every user.
