VPNs are useful. They are also massively over-marketed. VPN services are often presented as the ultimate solution to online privacy. We all heard it - Your ISP can see what you do. Advertisers are tracking you. Governments are watching you. Public Wi-Fi is dangerous. Luckily, you can just install a VPN and all of those problems disappear. Right? - Not quite. A VPN can absolutely be a useful privacy and security tool. But it is nowhere near the magic privacy button that VPN advertising sometimes makes it out to be. The most important thing to understand is actually very simple - A VPN does not remove the need to trust someone. It just changes who you have to trust.

What Exactly Is a VPN?

VPN stands for Virtual Private Network. The technology was originally developed for things such as allowing employees to securely access corporate networks over the internet. Today, commercial VPN services are also widely used by consumers who want to hide their public IP address, protect traffic on networks they do not trust, or make their internet traffic appear to originate from another location. In very simple terms, a VPN creates an encrypted connection between your device and a VPN server. Your traffic then leaves the VPN server and continues to its destination.

How Does a VPN Actually Work?

Without a VPN, the connection looks roughly like this: When you enable a VPN, it changes to something more like this: Your ISP can still see that your device is communicating with a VPN server. It can also see connection metadata such as when the connection is active and how much data is being transferred. What it generally cannot see in the same way is where your traffic goes after it enters the VPN tunnel. The website you visit, meanwhile, sees the VPN server's public IP address rather than your normal public IP address. And that is where the most important part of the VPN discussion begins.

A VPN Moves Trust

Without a VPN, you are essentially trusting your ISP with your network connection. With a VPN, you are asking a third-party VPN provider to handle your internet traffic instead. Your ISP gets less visibility into your internet destinations. But your VPN provider now sits in a very privileged position. You have not stopped trusting a third party. You have changed which third party you trust, from ISP to VPN provider. This is one of the most important points that gets lost in VPN advertising.

So Can the VPN Provider See Everything?

The exact answer depends on the technology being used, the services you access and the VPN provider itself. But the important thing is that a VPN provider operates the servers through which your traffic is passing. That means choosing a VPN provider is fundamentally a trust decision. The Electronic Frontier Foundation, or EFF, makes this point very clearly in its guidance on VPNs. EFF is a US-based nonprofit organization that focuses on digital rights, privacy, free expression and technology. It runs its Surveillance Self-Defense project, which provides practical guidance on protecting yourself against digital surveillance and other security threats. Rather than presenting VPNs as magical anonymity tools, EFF emphasizes their limitations and the importance of understanding what a VPN provider can and cannot protect you from.

And That Makes the VPN Provider's Business Model Important

Imagine a company offering a free service that handles a huge amount of your internet traffic. That company has to pay for:
  • Servers
  • Data centers
  • Bandwidth
  • Software development
  • Support
  • Maintenance
So how does it make money? That does not automatically make a free VPN malicious. There are legitimate ways of funding free services - But it is a question worth asking. If a company sells subscriptions, its business model is fairly straightforward, as the customers pay for the service. If a company gives you a free service while simultaneously gaining access to potentially valuable information about your internet activity, the situation changes. And this is one reason why simply downloading whichever VPN appears first in an app store is a terrible way of choosing one.

"No Logs" Is Not a Magic Phrase

A claim you often see on VPN advertisements are: 
NO LOGS!
Sounds great - But a sentence on a website is still just a claim. A VPN provider saying that it does not log your activity does not, by itself, prove that it does not log your activity. This is why independent audits, transparency, open-source applications and a history of responsible operation can matter. There is a big difference between: 
"Trust us. Seriously. Please?"
, vs. 
"Here is our privacy policy.
Here is how our infrastructure works.
Here is our software.
Here is an independent audit."
... Transparency and evidence are what make a claim meaningful. The latter gives you considerably more to work with when deciding whether a provider deserves your trust.

What About 4G and 5G?

This is another area where VPN discussions sometimes get confusing. A VPN works over 4G and 5G in essentially the same way it works over Wi-Fi or a wired internet connection. Your mobile operator still knows that your phone is connected to its network. It can still see network-level information such as the connection, data usage and the fact that your device is communicating with a VPN server. What the VPN changes is what the mobile operator can see beyond that VPN connection. Instead of seeing your device directly communicating with: 
youtube.com
reddit.com
example.com
some-other-service.com
the operator primarily sees an encrypted connection between your phone and the VPN server. A VPN hides your internet destinations from your mobile operator. It does not hide the existence of your phone from your mobile operator.

But Isn't 4G and 5G Already Encrypted?

Yes. And this is another reason why VPN marketing needs some context. Modern mobile networks already use encryption as part of the communication between your device and the cellular network. On top of that, most websites and services you use today rely on HTTPS, which encrypts the actual contents of your web traffic between your device and the destination service. A VPN adds another encrypted layer between your device and the VPN server. That additional layer is absolutely no harm, but it does not mean that your internet connection was previously just an unencrypted stream that anyone could read.

What Is a VPN Actually Good For?

Hiding Your Public IP Address

Websites normally see the public IP address your connection is coming from. With a VPN, they generally see the VPN server's IP address instead. This can make IP-based geolocation and IP-based tracking less useful. It can also prevent websites or other internet services from seeing your normal home or mobile public IP address.

Reducing What Your ISP Can See

Your ISP still knows that you are using a VPN. But it generally cannot inspect the traffic inside the VPN tunnel in the same way it could inspect unencrypted network metadata outside it. Important to say that HTTPS traffic is already encrypted and can not be inspected either. For someone specifically concerned about their ISP being able to see their internet destinations, this can be a legitimate privacy benefit.

Using Networks You Don't Trust

Public Wi-Fi is another classic use case. Hotels, airports, cafés and other shared networks are environments where you do not control the network infrastructure. A VPN provides an encrypted connection between your device and the VPN server, which can reduce what the local network operator can observe or interfere with. However, there is an important caveat here, as mentioned: HTTPS already protects the contents of most modern web traffic. A VPN is therefore an additional layer of protection, not the thing that suddenly makes HTTPS secure. Personally, I use a VPN to my home network when I am on public Wi-Fi, but I do not use a VPN for every connection I make.

Changing the Apparent Location of Your Connection

Connecting to a VPN server in another country makes your traffic appear to originate from that server's IP address. This can be useful for privacy, testing websites from different locations, or accessing services that are legitimately available in another region. It can also be used to bypass geographical restrictions, although streaming services and other providers may explicitly prohibit or block VPN traffic. ... Or maybe you just enjoy your ads in another language - couldn't afford travelling this year? - Change your VPN server to a different country and enjoy the experience of "browsing in Rome".

A VPN Does Not Make You Anonymous

This is probably the biggest misconception about VPNs. Imagine you connect to a VPN and then open Google while logged into your Google account - Google still knows who you are. The VPN does not change that. The same applies to Facebook, Microsoft, Amazon, Reddit, your email provider and practically every other service where you voluntarily identify yourself. And there are plenty of other ways to track a browser or device:
  • Cookies
  • Browser fingerprinting
  • Tracking pixels
  • Logged-in accounts
  • Device identifiers
  • Location permissions
  • Advertising IDs
A VPN does not make any of these things disappear. Changing your IP address is not the same thing as becoming anonymous.

Can a VPN Make Your Internet Faster?

A curious thing I heard come up once, someone stating that a VPN makes your internet faster. This is a misconception, and the answer is - No. A VPN adds another step between you and the destination. Depending on the VPN server, distance, protocol and network conditions, this can introduce additional latency and sometimes reduce your maximum throughput (especially on free services). Your connection will never be faster than the maximum speed of your internet connection, and a VPN cannot change that.

VPNs and Traffic Throttling

Internet service providers have historically used various forms of traffic management. In some cases, certain types of traffic or specific services could be identified and treated differently. For example, traffic could potentially be classified based on its destination, protocol or other characteristics. If an ISP knows that a particular connection is going to a specific service, it can technically apply different policies to that traffic. A VPN makes this much harder because the ISP sees an encrypted connection to the VPN server rather than the individual destinations inside the tunnel. So instead of traffic looking like this:
  • You can imagine your device connecting to your ISP, and then the ISP seeing the traffic going to various services like YouTube, Netflix, or other websites.
  • With a VPN, the ISP sees the traffic going to the VPN server, but it cannot easily see what specific services you are accessing beyond that point.
Therefore - If the ISP's throttling decision depends on identifying the destination, the VPN can make that classification significantly more difficult.

Does That Mean Your ISP Is Throttling You?

No. So... While it is technically possible for a VPN to help bypass certain forms of traffic-based throttling. That does not mean that your ISP is throttling everything you do based on your traffic. And this is particularly important for readers in the European Union. EU net neutrality rules establish an open internet framework under which internet service providers are generally not allowed to block, slow down, alter, restrict or degrade internet traffic based on its content, application, service, device or source/destination, subject to specific exceptions. (Source if you're interested in reading more on EU Law: European Union Law (EUR-Lex)) Those exceptions include things such as legal obligations, network security and exceptional or temporary network congestion. 
"Your ISP is slowing down Netflix.
Buy our VPN!"
A good old VPN sales pitch, but should not simply be taken as fact.

What About Mobile Networks?

Historically, traffic management has also been particularly relevant to mobile networks because operators have finite radio capacity. A cell tower does not have infinite bandwidth. During periods of congestion, operators need mechanisms to manage network resources. A VPN does not magically give you more capacity from the cell tower. If your 5G connection is slow because the cell you're connected to is overloaded, routing the traffic through a VPN does not create additional spectrum or radio capacity. Similarly, if your mobile subscription is capped at a particular speed, a VPN cannot turn a 50 Mbit/s plan into a 500 Mbit/s plan.

A VPN Can Also Make Things Worse

VPNs are not free from downsides. Depending on the provider and server, you may experience:
  • Higher latency
  • Lower maximum throughput
  • Additional battery usage on mobile devices
  • CAPTCHAs caused by shared VPN IP addresses
  • Websites blocking known VPN addresses
  • Streaming services refusing to work
  • Problems with services that rely on your real IP address
Modern VPN protocols such as WireGuard can be extremely efficient, so a good VPN does not necessarily introduce a noticeable performance penalty. But the idea that a VPN inherently makes your connection faster is simply wrong.

So How Do You Pick a VPN?

If you actually have a reason to use one, don't choose it purely because a YouTuber gave you a 90% discount code. Look at things such as:
  • Privacy policy: What information does the company actually collect?
  • Independent audits: Have its claims been independently examined?
  • Transparency: Who actually operates the company?
  • Business model: How does the service make money?
  • Modern protocols: Does it support technologies such as WireGuard?
  • Open-source software: Can the client applications be inspected?
  • Track record: Has the company previously had privacy or security issues?
There is no magical checklist that guarantees a VPN provider will never do anything wrong. Regardless, you are still trusting another company. You are simply trying to make that trust as informed as possible.

What About Established Providers Such as Proton VPN?

There is an important difference between blindly trusting a VPN provider and looking at the evidence available about how that provider operates. Proton VPN, for example, publishes information about its no-logs policy and has subjected its VPN infrastructure to independent audits. Don't ask whether a VPN company claims to respect your privacy. Ask what evidence it provides that it does.

Do You Actually Need a VPN?

For many people, the answer is ... Probably not. If you are sitting at home on a normal internet connection and primarily using modern websites over HTTPS, you may not gain enough from a VPN to justify running one permanently. If you frequently use public Wi-Fi, specifically want to hide your normal public IP address, don't want your ISP to have the same visibility into your internet destinations, or have a genuine need to route traffic through another location, a VPN can be very useful. So, the question isn't really whether a VPN is good or bad. It is whether it solves a problem you actually have.

The VPN Myth, Summed Up

Claim Reality
A VPN makes me anonymous No. Accounts, cookies, fingerprinting, device identifiers and other tracking methods still exist.
My ISP cannot see anything No. It can still see the VPN connection and network metadata.
The VPN provider cannot see my traffic Not necessarily. You are moving trust to the VPN provider.
A VPN makes my internet faster Usually not. It can sometimes bypass specific forms of traffic-based throttling.
VPNs only matter on Wi-Fi No. They work over wired connections, Wi-Fi, 4G and 5G.
5G makes VPNs pointless No. The fundamental trust relationship remains the same.
All VPN providers are basically the same Absolutely not. You are giving the provider a privileged position in your network connection.
A free VPN is just a cheaper VPN Not necessarily. Find out how the company makes money and what it does with your data.

A VPN Is a Tool, Not a Privacy Guarantee

The biggest problem with VPN marketing isn't that VPNs can protect privacy - They can. The problem is presenting them as the solution to every privacy problem on the internet.
  • A VPN can hide your normal public IP address.
  • It can reduce what your ISP can see about your internet destinations.
  • It can provide an additional layer of protection when using networks you don't trust.
  • It can make certain forms of traffic-based throttling more difficult.
  • But it cannot make Google forget your account.
  • It cannot stop browser fingerprinting.
  • It cannot stop an app with location permission from accessing your location.
And it certainly cannot stop the VPN provider itself from abusing the trust you have placed in it. So the next time a VPN advertisement promises "total privacy", remember the most important part: You have not stopped trusting someone. You have simply chosen who to trust.

Sources and Further Reading

  • Electronic Frontier Foundation (EFF) - Choosing the VPN That's Right for You
    EFF is a nonprofit organization focused on defending digital rights, privacy, free expression and innovation. Its Surveillance Self-Defense project provides practical guidance on protecting yourself against digital surveillance.
  • Electronic Frontier Foundation (EFF) - What Should I Know About Encryption?
    Further information about encryption, VPNs and the trust relationship between users, ISPs and VPN providers.
  • Federal Trade Commission (FTC) - In the Market for a VPN App?
    Consumer-focused guidance explaining what VPN applications can access and why choosing a trustworthy provider matters.
  • European Commission - Open Internet Access
    Information about the EU's open internet and net neutrality framework, including rules around traffic management, blocking and throttling.
  • BEREC - Introduction to Open Internet
    Information from the Body of European Regulators for Electronic Communications about open internet principles and traffic management.
  • Cloudflare - How VPNs Affect Internet Speed
    Technical information about VPN performance and circumstances where a VPN can potentially affect traffic-based throttling.
  • Proton VPN - No-Logs Audit
    Information about Proton VPN's independent audits and its approach to its no-logs policy.