A VPN encrypts your device's traffic and sends it through the provider's servers, hiding what you do from the local network — coffee-shop Wi-Fi, your ISP — and swapping your IP address for the provider's. That is genuinely useful in specific situations and genuinely useless in others, because a VPN changes who can see your traffic, not what the internet does with you once you arrive. The five things it does not do: make you anonymous, stop online tracking, block malware, prevent account compromise, or substitute for HTTPS. Both lists below are the entire decision.
What a VPN actually protects
- Your traffic on hostile local networks. Airport, hotel, and cafe Wi-Fi operators — and anyone snooping them — see only an encrypted tunnel to your VPN provider. This is the original, real use case.
- Your browsing from your ISP. In the U.S., where ISP privacy rules were repealed in 2017, your provider can monetize your DNS requests and traffic metadata; a VPN moves that visibility to the VPN provider instead — a trade whose value depends entirely on the next section.
- Your IP address from the sites you visit. Sites see the VPN's exit IP, which defeats IP-based identification of your household — though far less than people assume, given fingerprinting and login-based tracking.
- Traffic metadata from network observers — which domains you connect to, though HTTPS already hides page content from everyone on the path.
- Geographic shifting — accessing services available in the exit country, with each service's terms applying to you.
The five things it doesn't do
1. Make you anonymous. A VPN shifts trust from ISP to provider; it does not remove identity from the equation. You are logged into Google, Amazon, and Facebook — they know exactly who you are regardless of IP, and the VPN provider itself sees everything your ISP used to see. Anonymity requires the Tor network's design, not a commercial tunnel.
2. Stop online tracking. Cookies, browser fingerprinting, cross-site identifiers, and logged-in profiles track you right through a VPN. The tracking industry identifies you by your browser and your accounts, not only your IP; a VPN without tracker blocking changes almost nothing for ad tracking.
3. Block malware or phishing. A VPN tunnels traffic; it does not inspect it for danger (a few consumer suites bolt on filtering, separately). Malicious downloads and phishing pages arrive through the tunnel with full honors.
4. Prevent account compromise. Stolen passwords, infostealers, SIM swaps, and phishing are indifferent to your IP address. The defenses there are passwords, MFA, and device hygiene — no VPN subscription substitutes.
5. Add safety to HTTPS. The web is already encrypted end-to-end via TLS: the padlock means your bank traffic's content is unreadable to the network with or without a VPN. What HTTPS does not hide — the domains you visit — is the narrow gap a VPN genuinely closes.
The trust question you must answer
Every VPN argument reduces to: do you trust this provider more than your ISP? The provider can see your traffic metadata, DNS requests, and account identity. The market's history demands skepticism — consumer VPN review sites are largely advertising operations, free VPNs have repeatedly been caught selling traffic or worse, and law-enforcement records show "no-logs" claims failing under audit for some providers. Choose on verifiable attributes: independently audited no-logs policies, court-tested claims where they exist, transparent ownership, and paid rather than ad-supported models. Reputation earned over years — the leading audited providers — beats every affiliate-list ranking.
So do you need one?
Genuinely useful: regular users of public Wi-Fi; people wanting ISP metadata out of the equation; journalists, activists, and others facing network-level adversaries; remote workers whose employer requires one. Mostly unnecessary for the average home user whose threat model is ad tracking and phishing — tracker blocking, good passwords, and MFA address those directly, and HTTPS already covers content. If you buy one, use it consistently on untrusted networks, verify the kill switch works (it should cut traffic when the tunnel drops), and pair it with browser-level protections — because the VPN does the one job it has, while everything else still depends on the rest of your stack.
For more context, read Cookies and trackers explained: what actually follows you around the web.
For more context, read private messaging apps.
For more context, read health app privacy.