VPN Privacy Basics, and the Limits Nobody Mentions

Virtual private networks (VPNs) are widely marketed as all-purpose privacy tools. Understanding what they actually do helps you decide whether you need one.

What a VPN does

A VPN creates an encrypted tunnel between your device and the VPN provider's server. Your local network operator and internet provider see that you are connected to a VPN, but not the sites you visit inside the tunnel. Websites see the VPN server's IP address instead of yours.

What it does not do

• It does not make you anonymous. Accounts, cookies and browser fingerprinting can still identify you.
• It shifts trust. The VPN provider can potentially see your traffic metadata. Its logging practices matter.
• It does not stop phishing or malware. See Protecting Your Online Accounts.

When a VPN helps

On untrusted public Wi-Fi, or when you want to keep browsing activity from your local network operator, a reputable VPN is useful.

Evaluating a provider

Look for a clear privacy policy, independent audits, transparent ownership, and modern protocols. Be cautious with free VPNs whose business model is unclear.

Legal note

Using a VPN is legal in the United States, but it does not make illegal activity legal, and many streaming services' terms restrict using one to change your region. If you travel, VPN rules differ by country; check local laws first.

How a VPN connection actually works

When you connect to a VPN, your device creates an encrypted tunnel to a server operated by the VPN provider. Your internet traffic travels through that tunnel, and websites see the VPN server's IP address instead of yours. Modern VPNs typically use protocols such as WireGuard or OpenVPN, along with provider-specific variants. The important point is where trust moves: your internet provider or the operator of a public Wi-Fi network can no longer see which sites you visit, but the VPN provider potentially can.

That is why choosing a VPN is mainly a decision about whom you trust with your browsing metadata.

HTTPS already protects a lot

Most websites today use HTTPS, which encrypts the content of your connection between your browser and the site. On public Wi-Fi, HTTPS already prevents others on the network from reading your passwords or messages on those sites. What HTTPS does not hide by default is which domains you connect to, and your IP address remains visible to the sites you visit. A VPN adds protection for those details and for any apps that still use unencrypted connections. Understanding this helps you avoid overestimating what a VPN adds.

Common myths

• "A VPN makes me anonymous." It does not. Websites can still identify you through logins, cookies, browser fingerprinting and the information you share. If you sign in to Google or Facebook while connected, those companies know it is you.
• "A VPN protects me from malware and phishing." Some VPN apps include basic blocking features, but a VPN is not a substitute for updates, careful clicking and account security.
• "No-logs means no data at all." A "no-logs" claim is a promise, not a technical guarantee. Look for providers that have had independent audits of their claims, and read what they say they do keep, such as payment records or aggregate connection data.
• "Free VPNs are just as good." Running servers costs money. Some free VPNs fund themselves through advertising or data collection, which defeats the purpose. Reputable free tiers do exist, usually with data or speed limits, from companies that sell paid plans.

Practical tips for using a VPN

1. Download only from official sources: the provider's website or your device's official app store. Fake VPN apps have been used to spread malware.
2. Enable the kill switch if the app offers one, so traffic does not leak if the VPN disconnects.
3. Check for DNS leaks using the provider's guidance; a good app routes DNS requests through the tunnel.
4. Keep the app updated, like any security software.
5. Turn it on automatically on untrusted networks, such as airport, hotel and coffee shop Wi-Fi, if your app supports it.

Workplace and school VPNs are different

Your employer or school may require a VPN to access internal systems. These connect you to a private organizational network, and your organization may be able to monitor traffic sent through it. Do not use a work VPN for personal browsing, and follow your organization's acceptable use policy.

Streaming and terms of service

Many people use VPNs to change their apparent location for streaming. Streaming services often prohibit this in their terms and may block known VPN servers. Using a VPN this way is generally not illegal in the US, but it can violate the service's terms and lead to blocked access.

Smarter privacy steps that cost nothing

A VPN is one tool among many. For most people, these free steps provide as much or more privacy benefit:

• Use a privacy-respecting browser and review its tracking protection settings.
• Limit app permissions for location, contacts and microphone.
• Turn on Global Privacy Control in browsers that support it; several US states, including California, treat it as a valid opt-out of the sale or sharing of personal information.
• Review ad personalization settings in your Google, Apple and Microsoft accounts.
• Use unique passwords and two-factor authentication everywhere.

The bottom line

A trustworthy VPN is useful on networks you do not control and for hiding your browsing from your internet provider. It shifts trust rather than eliminating it, and it does not make you anonymous. Choose a provider carefully, and combine it with the everyday privacy habits that protect you whether or not the VPN is on.