VPNs (Virtual Private Networks) have moved from specialist tools to consumer products, and marketing around them has drifted into fiction. Ads suggest a VPN makes you anonymous, prevents tracking, and protects you from hackers. Most of that is wrong.
What a VPN actually does is straightforward, what it does not do is equally important to understand, and the choice between providers matters more than most people assume.
What a VPN does
A VPN encrypts the traffic between your device and a server operated by the VPN provider. Instead of your Internet Service Provider (ISP) and the network operator seeing your traffic, the VPN provider sees it. Everything between the VPN server and the destination website is encrypted (assuming the website uses HTTPS, which it should).
That is it. That is the entire technical accomplishment. A VPN does not:
- Make you anonymous (the VPN provider knows who you are and sees your traffic)
- Hide you from websites (websites see the IP address of the VPN server, not your actual IP, but they can still track you through cookies and fingerprinting)
- Protect you from malware (a VPN does not run antivirus)
- Protect you from phishing (a malicious link is still malicious through a VPN)
- Make you secure (a VPN encrypts one part of your connection, not the whole picture)
What a VPN actually provides is protection from a specific threat: a network operator observing your traffic.
When a VPN is useful
Using untrusted WiFi. If you are on a coffee shop WiFi network or a public airport network, the network operator could, in theory, intercept unencrypted traffic. A VPN prevents that. This is the genuine use case.
ISP surveillance. Your ISP can see what domains you visit (though not encrypted traffic). If you want to hide your browsing from your ISP, a VPN does that. Whether you need to is a question of your threat model and how much you trust your ISP.
Regional restrictions. A website might block traffic from your country or region. A VPN makes it appear your traffic originates from somewhere else. Whether you should do this depends on whether you are violating terms of service (you probably are) and whether you care (is up to you).
Hiding your home IP. If you want a website to not see your actual IP address, a VPN does that. This provides minimal privacy because websites track you through other means, but it is something.
That is roughly the complete list of genuine use cases.
When a VPN provides false security
Browsing on a secure home connection. If you are on your home WiFi encrypted with WPA2 or WPA3, a VPN provides almost no additional security. Your ISP can still see that you are using a VPN but not the details. An attacker would have to break the WiFi encryption to intercept traffic, which is far harder than intercepting unencrypted traffic.
Preventing tracking. A VPN prevents ISP-level tracking. It does not prevent website tracking through cookies, local storage, pixels, or fingerprinting. A website that wants to track you will, regardless of VPN.
Preventing targeted attacks. If an attacker has specifically compromised your machine, a VPN running on that machine is not a barrier. They have access to everything on the machine, including decrypted traffic, login sessions, and data.
Making you anonymous. The VPN provider knows who you are and can log your activity. Many claim not to keep logs, but that claim is difficult to verify and has been false before. If the VPN provider is compromised or compelled to provide data, it is available. Some providers are run by companies with business incentives to sell data or cooperate with governments.
Choosing a VPN provider
If you have decided a VPN is appropriate for your threat model, the choice of provider matters more than most people assume.
Avoid free VPNs. Free services make money by monetising user data. Many have been caught logging traffic, injecting ads, or selling data. The product is you, not privacy. Treat free VPNs as untrustworthy.
Jurisdiction matters. A VPN provider in a country with strong data protection laws and a history of resisting surveillance is more defensible than one in a country that cooperates with surveillance. The Netherlands, Switzerland, and some others offer stronger protections than the United States, United Kingdom, or Russia.
Verify log claims. A provider claiming not to keep logs should have that claim independently audited. Some have. Many have not. An audit is expensive and reputable providers do it. Unaudited claims are not very convincing.
Check the feature set. A good VPN has:
- Strong encryption (check the protocol — WireGuard or OpenVPN are solid; unknown proprietary protocols are suspect)
- A kill switch (disconnect from the internet if VPN drops, preventing unencrypted traffic)
- No leaks of DNS or IPv6 traffic
- Support for multiple simultaneous connections
- Reasonable speed (if it is consistently slow, you will abandon it)
Expect to pay. A reliable VPN costs £3-10 per month. Anything cheaper should be approached with extreme scepticism.
Test before committing. A month of service on one provider lets you check speed, reliability, and whether apps work with the VPN. Many services offer money-back guarantees during a trial period.
The honest assessment
A VPN is a useful tool for protecting traffic on untrusted networks. It is not a security solution or a privacy tool in the broad sense. If your threat model is “I do not want my ISP or the network operator to see my traffic,” a VPN is the right answer. If your threat model is “I want to be anonymous online” or “I want to prevent tracking,” a VPN is not enough.
VPN marketing exploits the gap between what VPNs actually do and what people want them to do. They are technically honest but emotionally misleading.
Choose a reliable provider if you have a specific use case. Do not buy a VPN because you feel like you should. The money is better spent on a password manager and two-factor authentication, which prevent far more actual attacks.