What a VPN Does and Does Not Protect: An Honest Guide

A VPN does one main job well: it routes your connection through a server run by someone else, inside an encrypted tunnel, so websites see that server’s address instead of yours, and your internet provider sees the tunnel instead of your traffic. Everything else in VPN advertising, from anonymity to protection against hackers, needs checking against that narrower reality.

The Electronic Frontier Foundation (EFF) puts the limit plainly in its Surveillance Self-Defense guide: VPNs are best suited to routing a network connection through a different network. That is useful, and specific, and most disappointment with VPNs comes from expecting more.

What actually changes when you turn a VPN on

When the VPN connects, your device opens an encrypted tunnel to a VPN server. Your traffic travels through that tunnel, leaves the server, and continues to its destination. Three things change as a result:

Websites see a different address. Your location appears to be wherever the VPN server is, because your requests carry the server’s IP address rather than your own. Since an IP address gives an indication of general location, masking it removes one easy way for a site to place you.
Your ISP and the local network see the tunnel, not the destinations. The EFF notes that a VPN hides outgoing traffic from the internet service provider and from the owner of the local network, such as a coffee shop or hotel. The Wi-Fi operator can see that you are connected to a VPN. It cannot read traffic inside the tunnel.
Some network blocks stop applying. Because your connection exits through a different network, a VPN can bypass some blocks on the network you are actually using, for example a school network that filters certain sites. The EFF adds the other half: streaming and other content providers increasingly block devices that appear to be using a VPN, so this route around geographic restrictions often fails.

That is the whole mechanism. There is no extra shield around your device, your accounts, or your downloads. The tunnel covers the stretch between you and the VPN server only.

Who can see what, with and without a VPN

A VPN does not remove watchers from your connection. It changes which watcher sits where.

Observer	Without a VPN	With a VPN on
Local Wi-Fi owner	Can see which sites you connect to, and any unencrypted traffic	Sees an encrypted connection to the VPN server
Your ISP	Can see the sites you visit, when, and for how long	Sees the tunnel and its volume, not the destinations inside it
VPN provider	Sees nothing, because it is not in the path	Can see your traffic much as your ISP could
Websites you visit	See your real IP address and general location	See the VPN server’s address and location
Sites where you sign in	Know your account, whatever your connection	Still know your account

The middle row is the one advertising leaves out. The FTC states the point directly for VPN apps: a VPN generally does not make you entirely anonymous; it hides the content of your traffic from your ISP or public Wi-Fi provider and shifts trust to the VPN provider. Traffic hidden from the ISP is all visible to the provider, and a provider could sell that information just as an ISP could. Providers are also subject to law-enforcement requests and to the laws of the countries where they do business, and the EFF notes that many save as much information as ISPs do. Using a VPN is a decision about which company you would rather have in that position, not a decision to have no company there.

What a VPN does not do

It does not make you anonymous. Even with your IP address masked, companies have other ways to follow you. The EFF lists GPS, web cookies, tracking pixels, and browser fingerprinting, in which a site combines details such as your operating system, device model, and screen resolution into an identifier. Consumer Reports reports that many experts now worry more about ad tracking of this kind than about someone hacking a cafe network. Signing in settles the question: a service where you log in knows which account is active, on any connection.

It does not stop attacks aimed at you rather than at your connection. A fake login page reached through a VPN is still a fake login page, and a malicious download stays malicious inside an encrypted tunnel. Consumer Reports quotes Roya Ensafi of the University of Michigan, principal investigator of the VPNalyzer research project, stating that VPNs do not protect against most known online risks, including phishing, tracking, malware, and ransomware.

It is no longer the default answer for public Wi-Fi. A properly configured VPN can protect unencrypted traffic on a public network, and that used to be a standard recommendation. The EFF explains why the advice has softened: the majority of web traffic is now encrypted with HTTPS. HTTPS already protects the content of a page or message. What it leaves visible is metadata, such as which domain you visited and when. A VPN can hide that metadata from a local listener, but the VPN provider sees it instead.

It is not built to defeat an attacker who controls the local network. In May 2024 the EFF reported research from Leviathan Security called TunnelVision, in which an attacker on a local network uses a DHCP setting, Option 121, to force traffic to bypass the VPN while the connection stays up, exposing unencrypted traffic. The researchers’ summary: VPNs were not designed to mitigate attacks on the local network, and promising otherwise is dangerous. Providers vary in whether they have addressed this technique.

If you use one, choose it like a trustee

Because a VPN app is given permission to intercept all of your traffic, the FTC advises treating that permission seriously. Citing researchers who studied almost 300 VPN apps, it notes that some apps did not use encryption at all, some requested sensitive privileges, and some shared data with third parties to serve ads or analyse use. Many free apps are free for a reason: they sell advertising, or they share information with third parties.

A short checklist from EFF and FTC guidance filters out most risk:

Read the privacy policy for collection, not slogans. Look for what the provider collects, whether it sells data, and what it says about handing data to governments. A claim to keep no logs is a claim, not a proof.
Look for outside checks. The EFF points to public third-party security audits and transparency reports as signs a provider takes scrutiny seriously, while noting that practices can change after an audit.
Ask how the service pays for itself. Servers and staff cost money. If you are not paying a subscription, the EFF’s question applies: how does the business stay afloat, and is the answer your data?
Check the protocol and the kill switch. The EFF advises checking that a VPN uses OpenVPN or WireGuard and warns that the older PPTP protocol uses broken encryption. Consumer Reports describes the kill switch, which cuts your connection if the VPN drops, so traffic does not continue unprotected.
Check app permissions. The FTC’s example is an app requesting access to text messages: if a permission does not fit what a VPN needs, walk away.

One work use is different. A company VPN connecting you to your employer’s internal network is doing the job VPNs were built for. Whoever runs that network can see your traffic on it, which is expected.

Bottom line

A VPN is worth having if your goal matches its one real function: keeping your ISP and local network from seeing where your traffic goes, and having websites see a server’s address instead of yours. It is not anonymity, because cookies, fingerprinting, GPS, and signed-in accounts still identify you, and it is not general security, because phishing and malware pass straight through the tunnel. Choose a provider as carefully as the trust you are handing it requires, keep HTTPS, updates, strong passwords, and two-factor authentication in place either way, and treat any service that promises total protection as a warning sign.