What a VPN Actually Hides, and What It Does Not
A virtual private network is genuinely useful, but the marketing around it often promises far more privacy than it can deliver.
Few pieces of internet technology are as heavily marketed and as widely misunderstood as the virtual private network, better known as a VPN. Advertisements often promise something close to total invisibility online: browse without being tracked, hide from hackers, disappear from surveillance. Some of what a VPN does genuinely supports those goals. A great deal of it does not, and understanding the difference matters, because relying on a VPN for protection it cannot actually provide leaves people exposed in ways they do not expect.
What a VPN actually does
At its core, a VPN creates an encrypted tunnel between your device and a server operated by the VPN provider, and routes your internet traffic through that tunnel before it continues on to its final destination. Two consequences follow directly from this arrangement, and they are the genuine, verifiable benefits of using one.
Hiding your traffic from your local network
Without a VPN, anyone positioned on the same network as you, such as the operator of a public wireless network, or your internet service provider more generally, can potentially see which websites you are visiting, even if they cannot see the specific content of encrypted pages. With a VPN active, that local observer sees only that you are connected to the VPN server and exchanging encrypted data with it; the specific sites you visit afterwards are hidden from that particular vantage point. This is genuinely useful on shared or public networks, such as café or airport wireless, where you have no way of knowing who else might be watching network traffic.
Masking your location from the sites you visit
Because your traffic emerges from the VPN server rather than directly from your own device, websites you visit see the VPN server's location and address rather than your own. This is why VPNs are commonly used to access content that is restricted to certain countries, or simply to avoid revealing your rough geographic location to every site you browse.
What a VPN does not do
This is the part that marketing tends to gloss over. A VPN changes where your traffic appears to come from and hides it from your local network, but it does not make you anonymous, and it does not protect you from a wide range of other privacy and security risks.
It does not hide your identity from services you log into
If you log into an email account, a social media platform, or an online shop while using a VPN, that service still knows exactly who you are, because you have identified yourself directly by logging in. A VPN cannot undo the fact that you have voluntarily told a website who you are; it only affects what your network connection reveals separately from that.
It does not stop tracking based on browser and device characteristics
Websites and advertisers have many ways of recognising a returning visitor that have nothing to do with network location, including cookies stored in your browser, unique combinations of device and browser settings, and account logins that persist across sessions. A VPN changes none of these. Someone using a VPN can still be tracked and profiled by the same techniques that would work without one, simply minus the location information.
It does not make the VPN provider trustworthy by default
Using a VPN necessarily means routing all of your traffic through a company you may know very little about, and trusting that company not to log, sell, or mishandle that traffic. A VPN provider is, in a meaningful sense, in a position similar to the internet service provider it is meant to protect you from: capable of seeing your unencrypted traffic pass through its servers. Some providers publish independently audited policies committing not to keep logs of user activity; others make claims that are difficult to verify. Choosing a VPN provider is therefore not a decision to be made lightly or based purely on price or advertising.
It does not protect against malware, scams, or poor personal security habits
A VPN encrypts and reroutes network traffic; it does nothing to stop you from downloading malicious software, falling for a deceptive message, or reusing a weak password across multiple accounts. These remain entirely separate categories of risk that a VPN has no bearing on whatsoever.
A clearer picture: VPN protection at a glance
| Situation | Does a VPN help? |
|---|---|
| Someone on the same public wireless network snooping on your traffic | Yes, meaningfully |
| Your internet provider seeing which sites you visit | Yes, for the sites, though not for the fact you use a VPN |
| A website knowing your rough location | Yes, it sees the VPN server's location instead |
| A website you log into knowing who you are | No, login identifies you directly |
| Advertisers tracking you via cookies or device fingerprinting | No, largely unaffected |
| Malware or phishing attempts | No, unrelated protections are needed |
Why people reach for a VPN in the first place
Understanding the limits of a VPN is not an argument against using one; the genuine benefits are real and worth having for many people. Anyone who regularly uses public wireless networks, travels frequently, or wants to reduce the amount of browsing data their internet provider can casually observe has a reasonable case for using one. People also use VPNs to access services or content restricted by geography, though it is worth being aware that this can sometimes conflict with the terms of service of the platform being accessed.
Choosing a provider thoughtfully
Because a VPN provider sits in a position of considerable trust, a few practical questions are worth asking before choosing one: does the provider have a clearly stated, independently reviewed policy on what it logs and for how long; is the company transparent about its ownership and jurisdiction; and does its pricing model make sense for a service that must cover real infrastructure costs, since a completely free VPN service needs to fund itself somehow, and that funding source is worth understanding before trusting it with your traffic.
Sensible habits alongside a VPN
A VPN works best as one part of a broader, realistic approach to online privacy and security rather than as a single solution to all of it.
- Use unique, strong passwords for different accounts, since a VPN offers no protection against a reused password being exposed elsewhere.
- Keep browsers and devices updated, since security patches close vulnerabilities that a VPN has no bearing on.
- Be sceptical of unexpected messages asking for personal information or urging quick action, regardless of whether a VPN is active.
- Remember that logging into any service, VPN or not, identifies you to that service directly.
- Treat browser privacy settings, such as blocking third-party cookies, as a separate and complementary layer of protection.
The honest summary
A VPN is a genuinely useful tool for a specific, limited set of problems: hiding browsing activity from a local network and masking your location from the wider internet. It is not a cloak of general anonymity, it does not erase your digital footprint, and it cannot protect you from risks that have nothing to do with network routing. The gap between what VPNs are marketed to do and what they actually do is wide enough that it is worth closing deliberately, so that the tool gets used for what it is genuinely good at, and other, separate habits are relied on for everything else.
About the author
Mara Devlin edits the publication and writes about the internet's infrastructure and incentives. She spent a decade as a technology reporter and editor before founding this masthead, and still does most of her reporting by reading documentation nobody else wants to read.
