VPNs: What They Genuinely Do, and What They Do Not

The thirty-second version: what a VPN actually changes

A VPN, a Virtual Private Network, does one core thing: it creates an encrypted tunnel between your device and a server somewhere else on the internet. All your traffic travels through that tunnel before it goes anywhere else. The practical result is three changes, and only three.

First, the connection between you and the VPN server is encrypted, so anyone sitting between you and that server, your internet provider, your employer's network, someone on the same coffee shop Wi-Fi, cannot read the contents of your traffic or see which websites you're visiting. Second, the websites and services you connect to see the VPN server's IP address, not yours, which means they see a different location. Third, your internet provider's logs show that you connected to a VPN server. That's it. That is genuinely everything a VPN changes at the network level.

Everything else you've heard in adverts, complete anonymity, protection from hackers, immunity from tracking, is either an exaggeration, a misunderstanding, or a deliberate stretch of the truth. The rest of this piece unpacks each of those three real changes and everything the adverts quietly leave out.

Takeaway: Before you spend a penny, write down the specific problem you want to solve. If you can't name it, a VPN probably isn't what you need right now.

The tunnel: what your internet provider stops seeing

Without a VPN, your internet provider, BT, Sky, Virgin, Vodafone, whoever supplies your broadband or mobile data, can see every domain you connect to. Not necessarily the exact page, because most sites now use HTTPS, but the destination. They know you visited a particular news site, a particular health forum, a particular legal advice page. That information has commercial value, and the ICO's guidance on UK GDPR does constrain how it can be used, but constraints and prohibitions are different things. If you're curious about how ISPs and other companies collect and use that kind of data, our piece on how your data is collected and sold goes into that in detail.

When you connect through a VPN, your internet provider sees an encrypted stream going to a single IP address, the VPN server. They can tell you're using a VPN. They cannot tell what you're doing inside that tunnel. The DNS queries that would normally reveal your destinations are also routed through the tunnel, assuming the VPN handles DNS properly, which is a question worth asking of any provider you consider.

This matters most when you have a specific reason to keep your browsing destinations private from your ISP. It matters less if your concern is something a VPN doesn't address at all, which we'll come to shortly.

Takeaway: If hiding your browsing destinations from your internet provider is your goal, a VPN genuinely addresses that. If your goal is something vaguer, like being "safe online", keep reading before you decide.

Public Wi-Fi: the one place a VPN earns its keep for everyone

This is the clearest, most defensible use case for a VPN, and it's the one that applies to almost everyone rather than a specific subset of users.

When you connect to public Wi-Fi, in a hotel, an airport, a café, a library, you're sharing a network with strangers. The operator of that network can see your traffic. So, potentially, can other people on the same network who know what they're doing. The National Cyber Security Centre's guidance on public Wi-Fi makes clear that public networks carry genuine risks, particularly around traffic interception.

HTTPS protects the content of most web pages now, so a passive observer on the same network can't read your banking page. But they can still see which domains you're connecting to. They can potentially intercept unencrypted traffic from apps that don't use HTTPS properly. And a malicious network operator could attempt to interfere with your connections in various ways.

A VPN on public Wi-Fi wraps all of that in encryption before it leaves your device. The café's router, and anyone watching that router, sees only encrypted noise going to a VPN server. This is a genuine, proportionate benefit. It's not hypothetical. Researchers and security professionals have documented these kinds of interception risks on public networks for years, and the NCSC's advice reflects that evidence base.

The practical upshot: if you regularly use public Wi-Fi for anything sensitive, a reputable VPN is a reasonable precaution. Not because catastrophe is inevitable, but because the protection is real and the cost is low.

Takeaway: Before your next hotel stay or airport wait, decide whether you'll be accessing anything you'd rather keep private. If yes, that's a concrete reason to consider a VPN for that trip specifically.

Location and geo-restrictions: how the trick works

When you visit a website, that website can see the IP address your connection comes from. IP addresses are tied to rough geographic locations, and services use this to restrict or vary their content by country. BBC iPlayer is available in the UK. Certain streaming libraries differ between countries. Some news sites restrict access by region.

A VPN with servers in different countries lets you connect through a server in whichever country you choose. The website sees that server's IP address, not yours. So if you connect through a server in the United States, websites see a US IP address. If you connect through a server in Germany, they see a German one.

This is how people use VPNs to access content that's geographically restricted. It works in the straightforward technical sense. Whether it's permitted under the terms of service of a given platform is a separate question, and one worth checking. Most streaming services' terms prohibit using VPNs to circumvent geo-restrictions, though enforcement varies considerably.

There's also a subtler point here. IP-based geolocation is not the only signal a service uses to determine where you are. Your browser's language settings, your payment method, your account registration details, all of these can contradict a VPN-provided IP address. For casual geo-restriction bypass, a VPN often works. For anything more determined, it's one layer of a more complicated picture.

Takeaway: If geo-restrictions are your main reason for wanting a VPN, check the terms of service of the specific platform you want to access. Knowing what you're agreeing to is worth a few minutes.

What a VPN cannot do, stated plainly

This is the section the adverts skip. Let's go through it carefully, because these limitations are not edge cases. They apply to most people in most situations.

It cannot make you anonymous to sites you log into

If you open your browser, connect to a VPN, and then log into Google, Facebook, your bank, or any other service, that service knows exactly who you are. You told them. The VPN changed your IP address, but your account is your identity. A different IP address attached to your known account is not anonymity. It's just a different postcode on an envelope with your name on it.

It does not stop tracking by cookies or browser fingerprinting

The advertising and analytics industry tracks people primarily through cookies, tracking pixels, and browser fingerprinting, not through IP addresses. A VPN doesn't touch any of those mechanisms. Your browser's fingerprint, the combination of your browser version, installed fonts, screen resolution, timezone, and dozens of other signals, travels with you regardless of which IP address you're connecting from. If you want to understand how pervasive this kind of tracking is, our piece on how companies track you online covers the detail. A VPN is simply not designed to address it.

It does not protect you from scams, phishing, or malware

A VPN encrypts your traffic in transit. It does nothing to evaluate the content of what you're receiving. If you visit a convincing fake banking site, a VPN will encrypt your connection to that fake site just as happily as it encrypts your connection to the real one. If you download a file containing malware, the VPN has no mechanism to detect or block it. Some VPN providers offer add-on features that claim to block malicious domains, but these are separate tools bolted onto the VPN product, not properties of a VPN itself.

It does not make public Wi-Fi completely safe

A VPN on public Wi-Fi is genuinely useful, as discussed above. But it doesn't neutralise every risk. Social engineering, phishing links, and malicious apps operate above the network layer. A VPN can't help with those.

It does not hide your activity from your employer's network

If your employer provides your device and manages it with corporate software, they may have tools that operate at the device level, not the network level. A VPN on a managed corporate device may not protect your activity from your employer's monitoring tools. This is worth understanding clearly if that's your concern.

Takeaway: Write a list of what you're actually worried about. Then check whether each item on that list is something a VPN addresses. You may find the list splits into "VPN helps" and "VPN doesn't help" more evenly than the adverts suggest.

The trust transfer: you are choosing who sees your traffic

This is the point most VPN marketing doesn't just understate. It actively obscures it.

Without a VPN, your internet provider can see your traffic. With a VPN, your internet provider cannot see your traffic, but your VPN provider can. You haven't removed a point of trust. You've moved it. Your ISP is replaced by the VPN operator as the entity with visibility into your network activity.

This matters because ISPs in the UK operate under a legal and regulatory framework. They're subject to UK GDPR, overseen by the ICO, and accountable to Ofcom. A VPN provider, particularly one incorporated in a different jurisdiction, may operate under very different rules, or under rules that are harder for a UK resident to understand or enforce.

A VPN provider that keeps detailed logs of your activity and hands them to third parties on request is, from a privacy standpoint, potentially worse than your ISP. The claim that a provider "keeps no logs" is easy to make and difficult to verify. Some providers have had their no-logs claims tested by legal requests and held up. Others have not. Independent audits exist for some providers, and they're worth looking for, but audits have limits too. An audit is a snapshot, not a permanent guarantee.

The honest framing is this: a VPN is a privacy tool only to the extent that the VPN provider is trustworthy. Choosing a VPN is choosing a new custodian for your traffic data. That decision deserves the same scrutiny you'd apply to any other service you're trusting with sensitive information.

Takeaway: Before signing up for any VPN, spend ten minutes reading their privacy policy. Look specifically for what data they log, how long they keep it, under what circumstances they share it, and which jurisdiction's laws govern them.

Do you actually need one? An honest decision guide

Most privacy guides at this point would tell you that everyone needs a VPN. We're not going to do that, because it isn't true.

Here are the situations where a VPN provides genuine, proportionate value for a typical UK reader.

• You regularly use public Wi-Fi for anything sensitive. Online banking, work email, anything involving a login or personal information. This is the strongest everyday case.
• You want to prevent your ISP from building a profile of your browsing destinations. Whether for personal comfort or a more specific reason. A VPN addresses this directly.
• You're travelling abroad and want to access UK services that are geographically restricted. Subject to those services' terms of use.
• You're in a profession or situation where the specific knowledge of which sites you visit carries real risk. Journalists, activists, researchers, whistleblowers. For these users, a VPN is one layer of a broader operational security approach, not a complete solution on its own.

Here are the situations where a VPN probably isn't what you need.

• You want to stop being tracked by advertisers. Browser settings, tracker-blocking extensions, and careful cookie management are more relevant tools. A VPN won't make a meaningful dent in this.
• You want to be anonymous online. Anonymity is a much harder problem than a VPN solves. It involves your accounts, your behaviour, your device, and more.
• You're worried about hackers stealing your passwords. A password manager and two-factor authentication address this far more directly.
• You want protection from scams and phishing. Scepticism, good habits, and up-to-date software are your tools here. Not a VPN.

There's also a cost-benefit question that rarely gets asked honestly. A reputable VPN costs money. A poor one might cost you more in privacy than it saves. Free VPNs in particular have a troubled history: several have been documented collecting and selling the very data users thought they were protecting. The Electronic Frontier Foundation's guidance on privacy tools is a useful reference point for thinking about this category of tool more broadly.

Takeaway: If none of the genuine use cases above describes your situation, you probably don't need a VPN right now. Spend that energy on the privacy steps that actually match your threat model: strong passwords, two-factor authentication, browser privacy settings.

If you decide to get one: the questions that matter

If you've read the above and concluded that a VPN does address a real, specific need you have, here are the questions to ask of any provider you're considering. These are category-level questions, not a product comparison. No provider is named here and none will be.

Where is the company incorporated, and whose law applies?

A company incorporated in a country with strong privacy laws and no mandatory data retention requirements is, in principle, in a better position to protect your data than one incorporated somewhere with different rules. This doesn't guarantee anything, but jurisdiction is a real factor. Check where the company is registered, not just where it claims to operate from.

What exactly do they log, and for how long?

"No logs" is a marketing phrase. Read the actual privacy policy. Look for what they do retain: connection timestamps, bandwidth usage, payment information, account details. Some of these may be necessary for the service to function. The question is whether the logs they keep could, in combination, be used to identify your activity.

Have they been independently audited?

Some providers commission independent security audits of their infrastructure and privacy practices. These audits aren't perfect, and they're only as good as the auditor and the scope of the audit. But a provider that has undergone and published an independent audit is making a stronger claim than one that has not. Look for the audit report itself, not just a mention that an audit happened.

Have their claims ever been tested by a real legal request?

Some providers have faced legal demands for user data and have been able to demonstrate that they had nothing to hand over because they genuinely held no useful logs. Others have handed over data despite claiming not to keep logs. This kind of real-world test is more revealing than any marketing claim. It's worth searching for news coverage of any provider you're considering.

How do they handle DNS?

DNS queries, the lookups that translate website names into IP addresses, are one of the main ways your browsing destinations are revealed. A VPN that routes your DNS queries through its own servers keeps those queries inside the tunnel. A VPN that leaks DNS queries to your ISP's servers partly defeats the purpose. Look for providers that explicitly address DNS leak protection.

What is their business model?

A VPN costs money to run. If you're not paying for it, or if the price seems implausibly low, it's reasonable to ask how the business sustains itself. Advertising, data collection, and selling user data have all been documented in the free VPN market. The Mozilla Foundation's VPN resource centre has published useful thinking on what to look for in this category.

Do they have a kill switch?

A kill switch cuts your internet connection if the VPN connection drops, rather than allowing your traffic to revert to your normal unprotected connection without you noticing. If the reason you're using a VPN involves consistent privacy rather than occasional use, a kill switch is a meaningful feature to look for.

Takeaway: Before paying for a VPN, spend thirty minutes reading the provider's privacy policy and searching for independent coverage of their practices. The questions above give you a framework for what to look for. If a provider's privacy policy is vague, hard to find, or full of reassuring phrases with no specifics, that tells you something important.

A final word on proportion

VPNs are real tools with real uses. They're also one of the most aggressively marketed privacy products on the market, which means the gap between what they're claimed to do and what they actually do is unusually wide. The goal of this piece isn't to talk you out of using one. It's to make sure that if you use one, you're using it because it solves a problem you actually have, with realistic expectations of what it changes and what it doesn't.

Privacy online is built from many layers: good account security, careful browser settings, understanding how tracking works, and yes, sometimes a VPN. No single tool covers everything. The most useful thing you can do is understand what each tool addresses, so you can choose the right one for the right job.