How a VPN protects your privacy online (and where the protection stops)
Open your laptop in a café, connect to the Wi-Fi, and within a few minutes someone on that same network can map your browsing without ever touching your device. No malware needed. No password cracked. Just a badly configured network and a tool that costs nothing to run. That sentence alone is why I started caring about VPNs years ago—not out of paranoia, but because I watched it happen to a colleague on a work trip, and the lesson stuck.
Here's the thing most VPN marketing hides: a VPN is a tunnel, not a force field. It does one job extremely well and several jobs not at all. Understanding the difference is the whole game.
Key Takeaways
- A VPN encrypts your traffic between your device and the VPN server, hiding your real IP from the sites and networks in between.
- It does not stop malware, phishing, or tracking that happens after you log in to an account.
- Your VPN provider sees your traffic instead of your ISP—so who you trust matters enormously.
- Free VPNs are rarely free. The business model usually involves your data.
- Speed drops, cost, and provider trust are the real downsides, not the ones ads mention.
- A VPN is one layer. It is not the layer.
What a VPN actually does (in plain terms)
A VPN creates an encrypted tunnel between your device and a server run by the VPN company. Everything you send—the request for a page, the text of a message, the file you upload—gets wrapped in encryption before it leaves your machine. Your internet provider, the café network, the hotel Wi-Fi: they see gibberish headed toward one IP address. Not the sites you visit, not the content.
The encrypted tunnel, explained without the jargon
Picture a sealed courier envelope. You write the letter (your data), seal it (encryption), and hand it to a courier (the VPN server) who delivers it to the recipient. The mailroom in between—your ISP—only sees an envelope going to the courier's address. It cannot read the letter.
What protocols actually do the sealing? The common ones you'll see named are WireGuard, OpenVPN, and IKEv2/IPsec. WireGuard is the modern default on most good services now: lean, fast, and auditable. OpenVPN is older but battle-tested. IKEv2 is what you want on mobile if you switch between Wi-Fi and cellular a lot, because it reconnects fast.
Why your IP address matters more than you think
Your IP address is a rough home address for your connection. It narrows you to a city, an ISP, sometimes a neighborhood. Advertisers, sites, and anyone watching network traffic use it to build a profile. A VPN replaces it with the server's IP, so a site in another country sees a server, not you.
Which is real and useful. It is also narrower than the ads suggest.
Does a VPN really protect your privacy?
Yes—against a specific set of observers. No—against a different set. The honest answer depends entirely on who you're hiding from.
What it protects against
- Your internet provider logging which sites you visit and selling that profile onward (legal in several countries, including parts of the US).
- The public Wi-Fi operator at a café, airport, or hotel reading your traffic.
- Sites seeing your real location and IP.
- Some—not all—ISP-level throttling of streaming or specific services.
What it doesn't protect against
Log into Gmail with your real account while connected to a VPN and Google still knows exactly who you are. The tunnel doesn't anonymize you; it anonymizes the connection. Once you authenticate, the site ties everything back to your identity regardless of the IP in front of it.
This is the point most guides gloss over. A VPN changes where your traffic appears to come from. It does not change what you tell the destination about yourself.
What are three things that a VPN cannot protect you from?
Three concrete categories, and they're the ones that actually get people hurt.
1. Malware and phishing
A VPN encrypts the pipe. It does not inspect what flows through it. If you click a phishing link and type your bank credentials into a convincing fake page, the tunnel happily delivers that data to the attacker, encrypted end-to-end. Encryption protects the transport, not your judgment.
2. Tracking that happens while you're logged in
Cookies, browser fingerprinting, and account sessions all survive a VPN. If you're signed into a social platform, it recognizes you regardless of IP. Advertisers have moved heavily toward fingerprinting—screen resolution, fonts, timezone, and dozens of other signals—precisely because IP-based tracking is easy to defeat.
3. DNS and WebRTC leaks
This is the technical one that bites people who think they're covered. A VPN can be perfectly configured and still leak because the operating system or browser resolves domain names or makes real-time communication requests outside the tunnel.
How to check if your VPN is leaking
Connect to the VPN, then visit a leak-test page that reports your visible IP, DNS servers, and WebRTC status. If your real IP or your ISP's DNS server shows up, you have a leak. In most clients, the fix is enabling a setting called something like "DNS leak protection" or "block WebRTC." On desktop, browser extensions can force all traffic through the tunnel.
I made this mistake myself. Set up a VPN on a work laptop, felt secure for weeks, then ran a leak test and saw my real IP appear through a browser feature I'd never heard of. Fixed with two settings. The point is the tunnel was fine; the client was not.
Can hackers get through a VPN?
Not by breaking the encryption—modern VPN protocols aren't being cracked by hobbyist attackers. They get through by going around it, or by attacking the parts that aren't encrypted.
How attacks actually happen
- Your device is compromised. If malware is already running on the machine, it reads data before it's encrypted, or after it's decrypted. The tunnel is irrelevant.
- The VPN server is misconfigured. Poorly managed servers have exposed user data. This happens; it's less common than it used to be.
- The free VPN is the attacker. Some free services have been caught injecting ads, tracking traffic, and in documented cases, logging and reselling data.
- Your account credentials are stolen—through a breach that has nothing to do with the VPN.
Notice the pattern. None of these break the tunnel. They sidestep it.
What's the downside of using a VPN?
The honest downsides, in the order most people feel them.
Speed, cost, and the trust problem
| Downside | What it looks like in practice | How bad it usually is |
|---|---|---|
| Speed loss | Roughly 10–30% slower on a good server; much worse on distant or overloaded servers | Noticeable on video calls, mild on browsing |
| Cost | Reputable services run a few dollars a month on annual plans | Small, but real |
| Provider trust | You're shifting who sees your traffic from your ISP to the VPN company | The biggest hidden cost |
| Logging policy | Some claim "no logs" and are vague about what that means when law enforcement asks | Depends entirely on jurisdiction |
| Blocked by services | Streaming platforms and some banking sites detect and block known VPN IPs | Annoying, occasional |
That third row is the one I'd underline. A VPN doesn't make your traffic invisible; it makes it visible to a different company. If you'd trust that company with your browsing history, the trade is fine. If you wouldn't, no encryption in the world is going to save you.
On the "no logs" claim: the meaningful question isn't whether a company says it keeps no logs. It's which country's legal system can compel them to keep logs, and whether they've ever been tested in court. Jurisdiction matters more than marketing.
How to choose a VPN without getting burned
Filter aggressively. Most services fail at least one of these.
- Audited no-logs policy. Look for a policy that's been independently examined, not just asserted on a homepage.
- Jurisdiction. Where the company is based determines what it can be forced to hand over.
- Modern protocol support. WireGuard at minimum.
- An open-source client, or at least one that's been reviewed by people who don't work for the company.
- A payment method you're comfortable with. Some services accept cash or cryptocurrency; that's a signal about their threat model.
- Independent leak tests—run them yourself.
- A refund window. If they don't offer one, that tells you something.
Services like Mullvad get mentioned a lot in privacy-focused circles for a reason: they publish audits, don't require an email to sign up, and have been transparent about what they do and don't do. I'm not telling you to pick them. I am telling you that the service you pick matters more than the protocol you pick.
A realistic way to think about it
A VPN is one lock on one door. A useful one. Worth having. But if the rest of the house is open—weak passwords, no two-factor authentication, a browser loaded with tracking extensions, a habit of clicking links from unknown senders—that one lock changes very little about your actual exposure.
The people I know who take privacy seriously don't treat a VPN as a solution. They treat it as a baseline, along with password managers, 2FA, and a willingness to read past the front page of a privacy policy. That combination is what actually moves the needle.
The question worth asking isn't "does a VPN work?" It's "working against whom, and for how long?" Answer that honestly and you'll pick better tools—and stop expecting one of them to do the work of five.
