What a VPN Can — and Can’t — Hide

Image: Digiopedia / Illustration

A VPN is often described as a privacy shield. That description is useful, but incomplete.

A virtual private network can hide important parts of your internet activity from your internet provider, the operator of a public Wi-Fi network, and the websites you visit. But it does not make you invisible, and it does not erase the information you voluntarily give to online services.

The distinction matters because privacy and anonymity are not the same thing.

What a VPN Actually Does

When you connect to the internet normally, your device communicates with websites and online services through your internet connection. Your internet provider can generally see which destinations you connect to, along with connection-related information such as timing and data volume.

A VPN adds another layer between you and the internet.

Instead of connecting directly to a website, your device establishes an encrypted connection with a VPN server. Your traffic then travels through that server before reaching its destination.

To the website, your connection appears to originate from the VPN server rather than your normal public IP address.

That changes what different parties can see.

Your public IP address can be hidden from websites, which can also make your approximate location appear to be somewhere else. Your internet provider can see that you are connected to a VPN server, but it generally cannot see the websites and services you are accessing through the encrypted tunnel.

This is particularly useful on networks where you do not fully trust the local connection.

Image: Digiopedia / Infographic

What a VPN Can Hide

A properly configured VPN can conceal several pieces of information from particular observers.

Your IP Address

Websites normally see the public IP address associated with your internet connection.

With a VPN, they see the VPN server's IP address instead.

This can prevent a website from directly seeing your normal public IP and can make IP-based location information less precise.

Your Browsing Destinations From Your ISP

HTTPS already encrypts the contents of most modern web connections. Your ISP generally cannot simply read the exact article you are viewing or the message you are sending.

However, without a VPN, the network can still obtain information about where your connection is going.

A VPN moves that visibility to the VPN provider.

Your Activity on Public Wi-Fi

A VPN can also protect traffic between your device and the VPN server when you are using an untrusted network.

That can make it considerably harder for someone monitoring the local network to inspect your traffic.

But this does not mean every security problem on public Wi-Fi disappears. Device security, malicious websites, compromised accounts and phishing remain separate problems.

What a VPN Cannot Hide

This is where VPN marketing can create unrealistic expectations.

A VPN is not an invisibility cloak.

If you sign into your Google account, Facebook account, bank account or another service, that service knows who you are because you identified yourself.

Changing your IP address does not change your account identity.

Websites can also use cookies, browser characteristics, device information and other signals to recognize users. A VPN can alter one important signal — your IP address — without eliminating all the others.

Your VPN provider also becomes an important part of the privacy equation.

Your traffic is no longer being entrusted only to your ISP. It is being routed through another company that operates the VPN infrastructure.

That makes choosing the VPN provider itself a privacy decision.

What About Your Location?

A VPN can change the location associated with your IP address, but IP location is only one form of location information.

Apps and websites may have access to other signals depending on the device, browser and permissions involved.

A VPN therefore should not be treated as a universal location-spoofing system.

VPN vs. HTTPS

These technologies are sometimes presented as competing forms of protection, but they solve different problems.

HTTPS protects the connection between your browser and the website.

A VPN protects the connection between your device and the VPN server and changes how your traffic is routed across the internet.

In modern browsing, HTTPS is fundamental. A VPN adds another layer of privacy, particularly against the network through which you connect.

The VPN Trade-Off

The simplest way to understand a VPN is this:

It moves trust; it does not eliminate trust.

Without a VPN, you trust your network provider with certain information about your connections.

With a VPN, you reduce what that provider can see, but you must place greater trust in the VPN operator.

That is why a free VPN that aggressively collects information can defeat the purpose of using one in the first place.

The Bottom Line

A VPN is valuable when you understand its actual job.

It can hide your public IP address, encrypt traffic between your device and the VPN server, reduce the visibility your ISP has into your destinations, and provide an additional layer of protection on untrusted networks.

It cannot guarantee anonymity, prevent tracking by accounts and cookies, protect you from phishing, or make an unsafe device secure.

The best way to think about a VPN is not as a way to disappear from the internet.

It is a way to change who can see parts of your internet connection — and who you have to trust with that information.