VPN privacy guide
A VPN can be a useful privacy tool, but it is not an invisibility switch. Understanding what changes when you connect makes it easier to judge whether the service is doing what you expect.
What a VPN actually does
A VPN app creates an encrypted tunnel between your device and a server run by the VPN provider. Your traffic travels through that tunnel and leaves from the server, so the websites and services you use see the server's IP address instead of yours. Your local network and your ISP see encrypted traffic going to the VPN, but not where it goes next.
Who can see what
| Party | Without a VPN | With a working VPN |
|---|---|---|
| Wi-Fi operator, such as a café or hotel | Sites you connect to; unencrypted traffic | Only that you use a VPN, plus traffic timing and volume |
| Your internet provider | Sites you connect to and your DNS lookups | Only that you use a VPN, plus traffic timing and volume |
| The VPN provider | Nothing | Sites you connect to; unencrypted traffic |
| Websites you visit | Your real IP address and approximate location | The VPN's IP address. Still your account, cookies and anything you type. |
The VPN provider takes over the view your ISP had, which is why choosing a trustworthy provider matters more than any single feature.
What a VPN does not do
- It does not make you anonymous. Signing in to an account identifies you to that service.
- It does not stop cookies, browser fingerprinting or tracking by the sites you use.
- It does not protect you from malware, phishing or scams. Those need updates, care and good security habits.
- It does not protect traffic you exclude with split tunnelling, or traffic that leaks outside the tunnel.
Features that matter
- Kill switch: blocks traffic if the VPN disconnects unexpectedly.
- DNS and IPv6 leak protection: keeps lookups and IPv6 traffic inside the tunnel.
- Modern protocols: WireGuard-based options and IKEv2 are widely used and generally fast. OpenVPN is mature and widely supported.
- Split tunnelling: lets chosen apps bypass the VPN when needed.
- Clear ownership and policies: a named operator, a readable logging policy and, ideally, independent audits with stated scope and dates.
Choosing a provider using evidence
Start with what you need covered: list your devices and check platform support and how many devices can connect at once. Then read beyond the marketing. Check the logging policy, who operates the service, and the scope and date of any independent audit, since an audit of one component is not a guarantee about the whole service. Compare the introductory price with the renewal price, the refund terms and how to cancel. Be wary of unknown free VPNs, whose business model may depend on your data.
How to verify your VPN
- With the VPN off, run the privacy scan and note your IP address and network operator.
- Connect the VPN and run the VPN test. The IP and operator should now be the VPN's.
- Run the DNS leak test. Your ISP's resolver should not appear.
- Run the WebRTC check and the IPv6 check.
- Repeat after reconnecting, after sleep and after switching networks.
These checks confirm routing in this browser at that moment. They cannot inspect a provider's logs, so judge privacy policies separately.
Privacy beyond the VPN
A VPN is one layer. Keep your browser and devices updated, review browser extensions and their permissions, use a password manager and two-factor authentication, and be careful what you share in photos. The photo privacy checker shows hidden location data in pictures before you post them. If you are choosing a VPN, our VPN buying guide explains what to compare. It also names the service we use, with a clearly disclosed affiliate link.
Reviewed October 8, 2026 · Methods and limitations · Report a problem