A VPN Changes Who Can See Your Traffic—Not Who You Are
A VPN can hide the café from the website and the website from the café. It can't hide you from an account you sign into. That small distinction is the difference between useful privacy and an expensive invisibility costume.
Maya opens her laptop at an airport gate. Before connecting, her browser, mail app, cloud drive, and messaging client all want the internet. The airport network sits between those apps and every service they contact.
Tap Connect in a trustworthy, properly configured VPN app and the route changes. Covered traffic travels through an encrypted tunnel to the VPN server before continuing to its destination. The network at the gate sees the tunnel connection; the sites see the VPN server's public IP.
That is real protection. It just isn't the whole privacy story.
The Tunnel Changes the Route, Not the Person
Follow one request without a VPN. Maya's laptop sends it through the airport network and internet provider toward a shopping site. HTTPS protects the page contents in transit, but the local network still carries a direct connection toward that service. The shopping site receives the airport's public IP along with any cookies, browser signals, and account details it collects.
Now follow the same request through a full-device VPN. The local network sees Maya connect to the VPN server, plus timing and volume. The VPN provider receives the tunnel and forwards the request. The shopping site sees the VPN exit IP—but it still receives Maya's signed-in account, her cart, and the cookies stored in her browser.
The FTC's VPN guidance makes the core tradeoff plain: a VPN can obscure traffic from the local network or internet provider, but it generally doesn't make the user anonymous. Routing, encryption, a changed IP address, and anonymity are four different outcomes.
That distinction also explains why a VPN can't erase a home address typed into a checkout page, a location permission granted to an app, or a search saved to an account. The tunnel transports those choices. It doesn't undo them.
Public Wi-Fi Is a Good Scene, Not a Scare Story
Most mainstream websites now use HTTPS, so the old picture of anyone in a coffee shop casually reading every password is dated. HTTPS encrypts the connection between the browser and the website. A VPN adds another encrypted route between the device and the VPN server.
Those layers answer different questions. HTTPS protects the contents from intermediaries on the path and keeps the VPN provider from reading properly protected page contents. The VPN can keep the local network from seeing the covered destinations directly. The website still sees what Maya sends to it, because it must process the request.
A travel router can place laptops, phones, streaming sticks, and other compatible devices behind one VPN connection. That helps when a device has no trustworthy VPN app, but it also makes the router a shared control point that needs current firmware and a tested failure rule.
- Combines Wi-Fi 6 with a 2.5-gigabit WAN port in a compact travel-friendly body
- Runs OpenVPN and WireGuard profiles from compatible VPN providers across connected devices
- Adds WPA3, encrypted DNS, captive-portal support, and a configurable privacy switch
At the gate, Maya should still verify the Wi-Fi name, distrust unexpected certificate warnings, keep file sharing off, and use HTTPS. If the VPN drops, a kill switch can block covered traffic rather than letting the device quietly return to the ordinary route. Test that behavior before the urgent trip, not during it.
You Didn't Remove the Middleman
Without a VPN, the local internet provider occupies a powerful position in the route. With one, the VPN provider occupies a new position. The provider knows the source IP needed to accept the connection and controls the server that forwards covered traffic.
Encryption doesn't make that company disappear.
Read its policy for specific data categories: browsing activity, DNS requests, source and assigned IP addresses, connection timestamps, bandwidth, device identifiers, crash reports, payment records, and support messages. “No logs” means little until the provider says which logs, for how long, and in which systems.
Look for public audits that cover the claims you care about, not merely a penetration test of one app. Read transparency reports and ownership history. The Electronic Frontier Foundation's VPN checklist recommends examining claims, data collection, security, and transparency rather than trusting a ranking or slogan.
A free service still has servers, developers, support, and bandwidth bills. Free doesn't automatically mean dishonest, and paid doesn't automatically mean private. It does mean you should understand the business model. If the answer is advertising, analytics, or data sharing, decide whether that bargain defeats the reason you wanted a VPN.
A broader privacy framework helps because a VPN purchase is really a decision about who may observe which data. Carissa Véliz's Privacy Is Power develops that question beyond one app or one network route.
The goal isn't to find a company that asks for blind faith. It's to choose a provider whose narrow, testable promises fit the risk you actually want to reduce.
- Connects everyday data collection to real choices about freedom, power, and control
- Explains why privacy matters even when you have nothing to hide
- Turns a broad social issue into practical questions you can apply to your digital life
Coverage Ends Wherever You Put an Exception
“Connected” doesn't prove that every packet uses the tunnel. A browser extension may cover only browser traffic. Split tunneling deliberately sends selected apps or destinations outside. A device-level VPN may not cover another device on the same Wi-Fi. Some routers apply different policies to different networks or clients.
Mirror the route whenever you create an exception. If Maya excludes her banking app, the airport network again carries that app's direct connection, the bank sees the airport IP, and the VPN provider doesn't see that traffic. Her covered browser still goes through the VPN, so the airport sees the tunnel, the provider forwards the browser traffic, and websites see the exit IP.
Neither path is automatically wrong. The problem is forgetting which one you chose.
After setup, check the public IP and DNS resolver with the VPN on and off. Sleep and wake the laptop, change networks, and interrupt the connection. Repeat with a second browser. A green shield is an interface state; the route is the evidence.
A New IP Doesn't Defeat Old Identifiers
Websites can recognize people through signed-in accounts, first-party cookies, advertising identifiers, links containing unique codes, browser characteristics, and information entered into forms. A VPN changes the network address a destination receives. It doesn't clear those other identifiers.
This is why “I used a VPN but still saw local ads” isn't proof the tunnel failed. The site may know the account's saved location, the browser may have location permission, or the ad system may be using earlier activity. Conversely, seeing a distant IP doesn't prove that a site has forgotten the account.
Use browser privacy controls, review app permissions, reject tracking you don't want, separate identities when there is a real reason, and sign out where account history shouldn't follow the session. A VPN belongs beside those choices, not in place of them.
A VPN Can't Patch or Authenticate for You
If Maya enters her password into a convincing phishing page, the tunnel delivers it safely to the wrong destination. If malware already runs on her laptop, it can read data before the VPN encrypts it. If her software is missing a security update, the VPN doesn't install the fix.
Account protection therefore needs its own control. A hardware security key can add phishing-resistant authentication to supported services, so a stolen password alone isn't enough.
- Connects through USB-C or NFC, covering many newer computers and compatible phones
- Adds a phishing-resistant physical check to passkeys and supported multi-factor logins
- Works without a battery, code display, or wireless pairing process
Check USB-C, NFC, browser, and account compatibility before buying, and enroll a spare or confirm recovery first. The key protects access to supported accounts. It doesn't hide activity performed inside them or change what a service collects.
The same boundary applies to antivirus, encrypted messaging, full-disk encryption, and private browsing mode. Each protects a particular surface. Combining tools makes sense when their jobs are named; stacking icons and assuming they add up to anonymity doesn't.
Buy a Verifiable Route, Not a Personality
Start with the observer you want to limit. Is it the hotel network, the home internet provider, a website learning the household IP, or a censor on the local connection? Then ask whether a VPN changes that observer's view without creating a trust problem you consider worse.
Choose current protocols, clear ownership, precise retention language, useful independent assessments, and apps for every device that must be covered. Turn on the kill switch if its failure behavior fits your needs. Keep the app and router updated, and retest after major changes.
NIST describes VPNs as tools that protect communications carried across public networks from eavesdropping and interception. That secure-channel job is valuable precisely because it is limited and understandable.
At the airport, Maya doesn't need a promise that she has vanished. She needs her devices to take the route she chose, a provider worthy of the trust that route creates, and no illusion that a new IP erased everything else.