What Does a VPN Actually Protect Against?

A VPN protects against exactly two categories of observer: the network you’re connected to, and your internet provider. It also hides your real IP address from the sites you visit. That’s the honest scope. Everything else attributed to VPNs in marketing is either a side effect, a different product, or untrue.

The useful way to think about this is by threat: name who you’re worried about, then ask whether a VPN sits between you and them.

Threats a VPN genuinely addresses

The local network. On public Wi-Fi, in a hotel, on a network someone else controls, the operator can see which sites you connect to. A VPN encrypts that traffic so the local network sees only an encrypted connection to your VPN server. This is the original and still the strongest use case.

Worth noting the caveat that has grown over time: nearly all web traffic is now encrypted in transit by default, so the local network already can’t read the contents of what you do. What it can still see is which sites you’re connecting to, via DNS lookups and connection metadata. A VPN closes that gap. That’s a real benefit, but it’s narrower than the “hackers on public Wi-Fi stealing your passwords” framing, which describes a threat that modern transport encryption already handles.

Your ISP. Your internet provider can see every domain you connect to, and in many jurisdictions retains that data, and in some may sell or be compelled to share it. A VPN moves that visibility to the VPN provider instead. Whether that’s an improvement is genuinely a judgement call — see the trust section below.

IP-based identification by sites you visit. Sites see the VPN server’s address rather than yours. This obscures your approximate location and stops your IP being used as a straightforward identifier across sites.

Region-locked content, sometimes. A side effect of the above. Services actively work against it, results vary constantly, and we don’t cover it here because doing so honestly requires ongoing testing.

Threats a VPN does not address

This is the longer list, and the part the marketing tends to skip.

Being identified by sites you log into. If you sign into an account, the service knows who you are. Your IP address is irrelevant at that point. A VPN does nothing here, and nothing can — that’s what logging in means.

Tracking and fingerprinting. Cookies, browser fingerprinting, tracking pixels, and advertising identifiers work at the application layer. They don’t care what your IP is. A VPN provides essentially no protection against commercial tracking, and this is the single most common misunderstanding about what these products do. Browser choice, tracker blocking, and container or isolation features are the relevant tools.

Malware and phishing. A VPN carries whatever you download and does not inspect it. Some providers bundle a blocklist feature — that’s a separate product bolted on, not the VPN doing the work.

Weak passwords and account compromise. Unaffected. Use a password manager and multi-factor authentication.

Anything on your own device. Malware, a compromised browser extension, or someone with physical access all operate before the VPN tunnel begins.

Legal exposure. A VPN is not immunity. Providers can be subject to legal process in their jurisdiction, and payment records, account details, and connection metadata may exist regardless of what a policy says.

A state-level adversary. If your threat model includes a government with serious technical capability — because you’re a journalist, an activist, or living under a censorship regime — a commercial VPN is not sufficient protection. Traffic correlation, provider compulsion, and endpoint compromise are all realistic against that adversary. That situation needs tooling and operational practice designed for it, and advice from organisations that specialise in protecting people in your position. Please don’t take a consumer VPN as adequate.

The trust relocation

The central point, and the one worth carrying away:

Without a VPN, your ISP and the local network can see the destinations of your traffic.

With a VPN, they can’t — and your VPN provider can instead.

You have not eliminated an observer. You’ve chosen a different one. Whether that’s an improvement depends on which you’d rather trust, and that depends on your actual situation. On a hotel network, almost certainly yes. On your own home connection with an ISP you consider unremarkable, the answer is much less obvious, and “a company whose entire marketing budget is spent telling you they don’t log” is not automatically more trustworthy than a regulated utility.

This is why the evaluation question isn’t “which VPN is best” but “do I trust this provider more than the party they’re replacing” — which is what no-logs claims and audits is about.

Deciding whether you need one

Ask yourself, concretely:

1. Who am I trying to hide this traffic from? Name them. If the answer is “advertisers”, a VPN is largely the wrong tool. If it’s “the coffee shop’s network”, it’s the right one.
2. Do I use untrusted networks regularly? Frequent public Wi-Fi is the clearest case in favour.
3. Do I have a specific concern about my ISP? Retention, sale of browsing data, or throttling based on destination are real reasons in some markets.
4. Would I rather my VPN provider held this data than my ISP? An honest answer here decides most of it.
5. Is my actual risk higher than consumer-grade? If yes, stop and get specialist advice.

If you concluded you do want one, the next questions are mechanical: what the tunnel actually does (here), and whether the implementation leaks (here).