What a VPN actually hides — and what it doesn't

Most explanations of what a VPN does are either a diagram with a padlock on it or a list of things it supposedly protects you from. Neither tells you the thing that actually determines whether one is useful to you.

Here is that thing: a VPN does not remove the point at which your traffic is visible. It moves it.

Everything else follows from that.

Where your traffic is visible without one

When you load a page, several parties can see something about it:

• The network you are on — the café Wi-Fi, the hotel, the office
• Your internet provider — which sites you connect to, and when
• The site itself — your IP address, plus whatever it can work out from your browser
• Anything embedded in that site — analytics, advertising, social widgets

With modern encryption, most of these see which site you connected to rather than what you did there. That distinction is already larger than many people assume.

What changes when you turn one on

Your traffic now travels encrypted to the VPN provider’s server first, and reaches the wider internet from there.

What the local network and your provider can now see: that you are connected to a VPN, when, and roughly how much data. Not which sites.

What websites now see: the VPN server’s IP address instead of yours, which usually means a different apparent location.

That is the entire mechanism. It is genuinely useful, and it is narrower than the advertising implies.

What it does not do

It does not make you anonymous

The site you log into knows who you are, because you logged in. No network-level tool changes that.

It does not stop tracking that does not use your IP address

Cookies, accounts, browser fingerprinting and the identifiers inside apps all work the same whether a VPN is on or off. A large share of commercial tracking does not depend on your IP address at all.

It does not protect you from what you install or click

Malware and phishing operate above the network layer. A tunnel carries a harmful download exactly as faithfully as a harmless one.

It does not remove the observer — it changes who it is

This is the part most worth sitting with. Your provider can no longer see your destinations. The VPN operator now can.

You have not eliminated the need to trust someone. You have transferred it, from a company subject to your country’s regulation and usually identifiable, to one that may be neither.

When a VPN is genuinely the right tool

• Untrusted local networks — public Wi-Fi where you do not know who runs the network
• Keeping your browsing away from your internet provider, as a matter of preference
• Reaching a home or work network remotely, which is what the technology was built for
• Hiding your approximate location from sites, within limits

When it is the wrong tool

• “Being anonymous online” — the wrong layer entirely
• Security for your device — different problem
• Stopping advertising and tracking — browser settings and extensions do far more here

The one question that decides everything

If the choice is about privacy rather than reaching a specific network, it reduces to a single comparison:

Do I trust this VPN operator more than I trust my internet provider?

That is a real question with a real answer, and it varies by person and place. What it is not is a question the padlock icon can answer for you.

Worth weighing: where the operator is legally based, what it says it records and for how long, whether that claim has been examined by anyone independent, and how it makes money. A service with no revenue model still has costs, and traffic data is the obvious way to cover them.

The practical summary

A VPN is a good answer to “I do not trust the network I am sitting on.”

It is a partial answer to “I do not want my provider to see my browsing,” because it replaces that provider with another one.

It is not an answer to “I want to be untraceable.” Nothing sold as a consumer product is.