VPN privacy myths: what a VPN can and cannot protect

A VPN is a useful privacy tool, but it is also one of the most over-promised products on the internet. It does a few specific things well and many things not at all. This guide explains what a VPN can and cannot protect, where the common myths come from, and how to decide whether a VPN fits the risks you actually face.

What a VPN actually does

A VPN creates an encrypted connection between your device and a server run by the VPN provider. Your traffic travels through that connection, and websites see the address of the VPN server instead of the address your internet provider gave you. If you want the basics first, see our guide on what a VPN is.

That description is short on purpose, because it shows both the strength and the limit. A VPN does not change who you are, what you type into a login form, or what your browser reveals about itself.

The myth of full anonymity

Marketing often uses words like anonymous, untraceable and invisible. None of these describe what a VPN gives you. At best, a VPN gives you a degree of privacy from specific parties in specific situations.

A VPN does not achieve anonymity. The provider can see that your account connects to its servers, websites may know you because you log in, and your browser can be recognised without your IP address. A more honest description is that a VPN moves some visibility from one party to another. Whether that is a good trade depends on who you are worried about.

Logging policies and what they mean

Many providers claim to keep no logs. The phrase sounds precise but is not. There are several kinds of data a service might record, and a policy may cover some and not others.

• Connection logs: when you connected, for how long, and from which address. Some providers keep short-lived records for operating the service or limiting abuse.
• Activity logs: which sites you visited or what you downloaded. This is the category most people mean when they say logging.
• Account and payment data: your email address, payment method and subscription details. Nearly every paid service keeps these.

When you read a policy, look for plain statements about each category and how long data is kept. Some providers pay independent auditors to publish a review. That is a better sign than a promise alone, but an audit covers a point in time and a limited scope. If you cannot find a clear policy, treat that as an answer.

Trust shifts from your ISP to the provider

Without a VPN, your internet provider can see which domains your device connects to. With a VPN, it sees only a connection to a VPN server, and the VPN provider sees what your internet provider used to see.

This is the central point of the whole subject. A VPN does not remove trust from the picture. It moves trust from a company you already have a contract with, in your own country, to a company you may know very little about. For many people that is still a sensible move, for example on public wifi, or when they do not trust their local network. For others it is a step sideways.

If you have no reason to distrust your internet provider, a VPN may not add much privacy. Our guide on how to choose a VPN covers what to check when you do decide to use one.

Browser fingerprinting and logged-in accounts

Websites do not need your IP address to recognise you. Two common methods work with or without a VPN.

Logged-in accounts

If you sign in to a social network, an email service, a shop or a search account, that service knows who you are. Changing your IP address does not change that. Everything you do while signed in can be tied to the account. A VPN cannot make a logged-in session anonymous.

Cookies and fingerprinting

Cookies live on your device, so they stay the same when your IP address changes. A fingerprint is a combination of details your browser exposes, such as screen size, language, fonts and time zone, which can be distinctive enough to recognise a device. A VPN changes none of these. Separate browser profiles and browsers that limit tracking help more.

Malware and phishing

A VPN does not protect you from malicious software or from scams. If you download an infected file through a VPN, the file is just as infected. If you enter your password on a fake login page through a VPN, the attacker receives it just as easily.

Some apps block known malicious domains, which can help, but it is an add-on and not a replacement for sensible habits. Phishing works on people, not networks. Check the sender and page address before you sign in, and use a password manager, which will not fill in details on a lookalike site.

HTTPS versus a VPN

Most websites now use HTTPS, which encrypts the content exchanged between your browser and the site. This matters for the question of when a VPN is needed.

On a public wifi network, HTTPS already stops other people on that network from reading the pages you load and the data you submit. They may still see which domains you contact. A VPN adds a layer that hides even that, and it protects traffic that is not using HTTPS, such as some older apps or services.

Here is how the two compare in practice:

Neither protects you from the website itself, and neither replaces the other.

DNS and IP leaks

A VPN only helps if all of your traffic really goes through it. Sometimes parts of it do not. These are called leaks, and they are a common way for a VPN to fail quietly.

• DNS leaks: DNS is the system that turns a website name into an address. If your device sends these lookups to your internet provider instead of through the VPN, the provider can still see which sites you visit.
• IP leaks: some browser features can reveal your real address even when a VPN is on. Newer networks also use IPv6 addresses, and if a VPN handles only the older IPv4 type, traffic over IPv6 can bypass it.

You can reduce these risks. Look for a kill switch setting, use the official app, and run a leak test from a reputable testing site while connected. Repeat it after major updates or when you change network.

Jurisdiction and data requests

Every VPN company is based somewhere and operates servers in various places. The laws of those places affect what the company can be required to do. In general terms, authorities in many countries can send legal requests to companies, and a company that holds data may be required to hand it over. A company that holds very little data has little to hand over.

This is why a clear logging policy matters more than any country name on a map. Laws on VPN use, data retention and privacy differ widely between countries and change over time. This guide is general information, not legal advice. Check the rules where you live and travel.

Free VPNs

Running a VPN costs money for servers, bandwidth, software and support. A service that charges nothing has to pay for those things somehow. That does not make every free service harmful, but it is a reason to read the terms with extra care.

Ways free services can make money include showing advertisements, limiting speed or data to push you towards a paid plan, and collecting and selling information about how you use the internet. The last one is the real concern for privacy, because the whole point of using a VPN is to limit who sees your traffic. A free app that records and sells browsing data defeats that purpose.

Before you install any free VPN, check who runs it, how it makes money, and what the privacy policy says. If you cannot answer these, do not install it.

Advertising claims to be sceptical of

VPN advertising is full of dramatic language. You do not need to assume bad faith, but you should read these claims critically.

• "Military-grade encryption." This is a marketing phrase, not a technical standard. Look for the actual protocols and ciphers named in the documentation.
• "Complete anonymity" or "untraceable." As explained above, a VPN cannot deliver this.
• "Works with every streaming service." Streaming services actively block VPN addresses, and what works changes often. No provider can promise lasting access. See our guide on VPNs on phones, routers and streaming for what to expect.
• Countdown timers and huge discounts. Read the renewal terms before buying. Our guide on VPN prices and renewals explains how introductory pricing works.

A trustworthy provider describes limits as plainly as benefits.

Other tools that complement a VPN

For most people, the biggest improvements to privacy and security come from basic habits and tools, not from a VPN. These do things a VPN cannot.

• Software updates. Keep your system, browser and apps updated, since many attacks use known flaws.
• A password manager. It creates and stores a unique password for every account, so a breach on one site does not open the others. It also helps you avoid fake login pages.
• Two-factor authentication. A second step at sign-in, ideally through an authenticator app or a physical security key, protects an account even if the password is stolen.
• Tracker blocking. Browser settings or extensions from reputable sources can limit cookies, third-party trackers and some fingerprinting. This addresses what a VPN leaves untouched.

A realistic threat-model checklist

A threat model is simply an honest answer to the question of what you are trying to protect, and from whom. It stops you from buying a solution for a problem you do not have. Work through these questions.

1. What do I want to protect? Examples include login details on public wifi, browsing history from my internet provider, my real location from a website, or access to content while travelling.
2. Who might see it? Examples include other people on the same network, my internet provider, advertisers, a website, or someone targeting me personally.
3. Does a VPN address that risk? If the answer depends on logged-in accounts, malware or your own device, a VPN will not solve it.
4. Whom would I trust instead? Decide whether you trust the VPN provider more than your current internet provider, and why.
5. What else is needed? Add updates, a password manager, two-factor authentication and tracker blocking where relevant.

If your honest answers point to public wifi, a distrusted network, or a wish to keep your browsing away from your internet provider, a VPN is a reasonable tool. If they point to anonymity from the sites you log in to, safety from malware, or protection from a determined adversary, a VPN alone is not enough. To keep going, read our guide on what a VPN is for the foundation, and then compare options with the steps in how to choose a VPN.

Key takeaways

• A VPN hides your traffic from the local network and your internet provider and changes the address websites see. It does not make you anonymous.
• Using a VPN moves trust from your internet provider to the VPN company, so the provider's logging policy and track record matter.
• Logged-in accounts, cookies and browser fingerprinting identify you regardless of your IP address.
• A VPN does not stop malware or phishing. Updates, a password manager and two-factor authentication do far more here.
• HTTPS and a VPN protect different parts of the connection, and neither protects you from the site you are visiting.
• Test for DNS and IP leaks, and use a kill switch where one is available.
• Free VPNs need extra scrutiny, because the money has to come from somewhere.
• Be sceptical of absolute claims about anonymity, speed, security and streaming access.
• Laws on VPNs and data requests differ by country, so check local rules.
• Start with your own threat model, then choose tools that match it.