If you watch any amount of video online, you have been told to buy a VPN. The pitch is always the same. Hackers are watching. Your data is exposed. One subscription and you become invisible. It is one of the most heavily sponsored product categories online, and the marketing has drifted a long way from what the technology does.
We want to be fair, because VPNs are real tools with real uses. Plenty of people have good reasons to use one. But the gap between the advertised benefits and the actual ones is wide enough that many people pay for protection they do not have. Here is the honest version, with no products named and nothing to sell you.
What a VPN Actually Does
A VPN, short for virtual private network, reroutes your internet traffic. Instead of your device talking directly to the websites and apps you use, everything goes through a server run by the VPN company first, and that server passes it along.
The Federal Trade Commission put it plainly in its 2018 consumer guidance on VPN apps: a VPN app can make traffic from your phone to a website you visit appear to come from a server operated by the VPN provider, rather than directly from your phone. That sentence contains both real benefits.
- The sites you visit see the VPN company’s address, not yours. Your home connection has an address attached, like a return address on an envelope. Websites normally see it. With a VPN running they see the VPN server’s address, so they usually cannot tell what city you are in.
- Your internet provider cannot see which sites you visit. Without a VPN, the company selling you internet service can see the names of the sites you connect to. With one, they see an encrypted connection to the VPN company and little else.
That is the honest list. Two things, both genuinely useful, and if either matters to you a VPN delivers. The trouble is everything people assume comes with them.
What It Does Not Do
This is where the advertising and the reality separate. A VPN moves your traffic. It does not inspect it, clean it, or judge it.
- It is not antivirus. If you download something harmful, the VPN carries it to you just as fast as your normal connection. It has no opinion about what is inside.
- It does not stop phishing. A convincing fake email asking you to log in works identically whether a VPN is on or off. This is the attack that reaches ordinary people, and a VPN is irrelevant to it. We covered why they keep getting through in our piece on the surge in phishing attacks.
- It does not make you anonymous. The FTC’s 2018 guidance is direct: a VPN app generally is not going to make you entirely anonymous, sites may be able to tell you are using one, and they can still use identifying information you hand them. The moment you log in with your email address, the VPN stops mattering for that site.
- It does not protect an account you log into. If someone has your password, they can use it. The VPN protects the road, not the destination. Two step login does far more, and we compared the options in YubiKey versus passkey versus MFA.
- It does not stop tracking. Cookies, browser fingerprinting, and the account you are signed into all keep working. Hiding your address removes one signal among many.
One more thing. The same FTC guidance warns that some VPN apps use protocols that do not encrypt your traffic, or encrypt only some of it. Not every app labeled VPN does what the label implies.
The Trust Question Nobody Advertises
Here is the part that deserves more attention, and the FTC said it in one line: when you use a VPN app, you are giving the app permission to intercept all of your internet traffic.
Read that again. A VPN does not eliminate the company that can see where you go online. It changes which company that is. You move trust from your internet provider, regulated and with an address you could sue, to a VPN company that may be based anywhere and whose business model you have probably not examined.
Plenty of these companies are run responsibly, and some publish independent audits, which is a good sign. But “we keep no logs” is a promise, not a technical guarantee, and the free ones deserve real skepticism. Running servers costs money. If you are not paying, it is fair to ask what is. That is also why we name no providers here: the answer depends on how much you trust a particular company, and that is your call.
The Genuinely Good Reasons to Use One
All that said, there are real reasons, and we would not talk anyone out of a tool that fits.
- You do not want your internet provider building a profile of you. The strongest everyday reason. A privacy preference rather than a security threat, and completely legitimate.
- You are on a network you have no reason to trust. A conference network, an unfamiliar hotel, anywhere you have specific concerns. A VPN is a reasonable precaution.
- You want to reach devices at home while traveling. Many home routers and storage devices can run their own VPN so you can safely connect back to your house. A different use than the subscription services advertise.
- You are researching something sensitive. Journalists, people dealing with harassment, and anyone with reason to separate their activity from their home address.
Worth revisiting is the coffee shop argument, which was much stronger fifteen years ago. The FTC’s consumer guidance on public Wi-Fi states that connecting through a public Wi-Fi network is usually safe, because most websites now use encryption, and it tells people to look for a lock symbol or https in the address bar. The picture of someone at the next table reading your banking session no longer matches how the web works. That does not make public Wi-Fi risk free. The FTC also notes that encryption protects data on its way to a site, so if you land on a scammer’s website your information arrives safely at the scammer. A VPN does nothing about that either.
Your Work VPN Is a Completely Different Thing
This confuses people constantly, understandably, because both are called VPNs. They do almost opposite jobs.
A consumer VPN is about privacy. It sends traffic through a stranger’s server so websites and your internet provider learn less about you. A work VPN is about access. It builds a secure tunnel into your employer’s private network so you can reach the file server, the accounting system, or whatever else lives inside the office.
One practical consequence: while the work VPN is connected, your employer can typically see traffic passing through it, the opposite of the privacy the consumer product sells. Not sinister, just how the tool works, and a good reason to keep personal browsing off the work connection. A consumer subscription also gives you none of that access, and running both at once is a common cause of the mysterious “I cannot reach the office files” call.
The Bottom Line
A consumer VPN hides your address from the websites you visit and hides your browsing from your internet provider. Those are the two things it does. If you want either, buy one, and choose the company carefully, because you hand them everything your internet provider used to see.
If what you want is to be safer online, the money goes further elsewhere. Turn on two step login for your email and your bank. Use a password manager so every account has a different password. Keep your devices updated. Slow down on unexpected messages asking you to log in or pay. Those habits stop what actually happens to people. A VPN, whatever the sponsorship read says, does not.
We write these because friends and family ask this exact question and deserve a straight answer rather than an affiliate link. If something here raised a question about your own setup, we are happy to talk it through, no strings attached. Contact us today.
Sources:
Comments are closed