What a VPN actually hides, and the myths that oversell it
A VPN does two genuinely useful things and gets sold as if it does ten. Here is the honest version: what it really hides, why it does not make you anonymous, and the tracking it cannot touch.
A VPN does two real things well: it hides your IP address and rough location from the sites you visit, and it encrypts your traffic so the network you are on and your internet provider cannot see what you are doing. It also lets you appear to be in another country. What it does not do is make you anonymous. Browser fingerprinting, cookies and your own logins still identify you, it will not stop malware or phishing, and you are trusting the VPN company itself with everything your ISP used to see. It is a useful layer, not an invisibility cloak.
"Stay anonymous online" is the promise on every VPN advert, and it is the most profitable half-truth in consumer tech. VPNs are genuinely useful. They are also oversold to the point of being misleading, and the gap between what they do and what people think they do is where the trouble starts. So here is the honest version, from someone who uses one every day and has no illusions about it.
What does a VPN actually hide?
Two things, and it does both well.
First, it hides your IP address from the websites and services you connect to. Normally a site sees your real IP, which reveals your rough location and ties your visits together. Route through a VPN and the site sees the VPN server's address instead, in whatever country you picked. That is what powers the region-shifting people use it for, from watching another country's streaming library to getting around a censored network.
Second, it encrypts the traffic between your device and the VPN server. On the untrusted wifi at a cafe, airport or hotel, that means the network operator and anyone else on it cannot read what you are doing. And your own internet provider, which can normally log every site you visit, now sees only that you are connected to a VPN, not where you went afterwards. For anyone who does not want their ISP building a profile of their browsing, that alone is the point.
Those two things are real, and for a lot of people they are reason enough. The problem is everything the marketing implies on top of them.
Does a VPN make you anonymous?
No. This is the myth that matters, so it is worth being blunt: a VPN hides where you are connecting from, not who you are.
The moment you do almost anything online, other identifiers give you away regardless of your IP:
- Your logins. If you are signed in to Google, Meta or your email, those companies tie your activity to your account whether a VPN is running or not. The IP is irrelevant when you have already told them your name.
- Cookies. Accept the tracking cookies on a site, or carry them from a previous visit, and the ad networks keep following you across the web, VPN or no VPN.
- Browser fingerprinting. This is the one most people have never heard of and it is the most stubborn. Websites can build a near-unique "fingerprint" from your device: your operating system, screen resolution, installed fonts, graphics quirks, browser version and dozens of other details. None of that changes when you switch your IP, because fingerprinting works at the level of your browser, not your network connection. It does not care where you connect from; it cares how your device behaves.
Change your IP all you like; if your browser looks the same and you are logged into your accounts, you are still you.
Does a VPN protect you from hackers, malware and scams?
Mostly no, and this is where the false sense of security gets dangerous.
A VPN does not scan for or block malware. If you download an infected file or install a fake app, the VPN sits there quietly encrypting the connection while the malware runs. It has no idea anything is wrong.
Phishing is the sharpest example. A VPN secures the pipe your data travels through, nothing more. So if you are tricked into typing your password into a convincing fake login page, the VPN faithfully encrypts that password and delivers it, safely and privately, straight to the attacker. Encryption does not help when you are the one handing over the keys. A VPN also does nothing about weak passwords, and it certainly does not make anything you do actually legal.
The catch nobody puts in the advert
Here is the part that should shape which VPN you trust: a VPN does not remove the middleman, it moves it. All that traffic your ISP used to see now flows through the VPN company instead. They can, technically, see it.
That is why the only claim that matters is a no-logs policy that has been independently audited. A promise not to keep records is worth exactly nothing without an outside firm checking it, which is precisely why we weight audits so heavily in our best VPN of 2026 test. It is also why a free VPN from a company you have never heard of is a genuinely bad idea: if you are not paying, your browsing history is a plausible product.
So what is a VPN actually good for?
Plenty, once you drop the anonymity fantasy:
- Public wifi, where it stops the network and its users from snooping on you.
- Your ISP, when you would rather it not log and sell your browsing.
- Region-shifting, for travel and streaming, which we cover in our best VPN for streaming guide.
- Censored or restricted networks, where it can get you a freer connection.
Those are real, worthwhile jobs. "Becoming invisible" is not on the list.
How to actually be private
If privacy is the goal, a VPN is one layer, not the whole coat. The combination that actually works is boring: a hardened browser that resists fingerprinting and blocks trackers, staying logged out of accounts you do not need, a password manager with multi-factor authentication, real security software for the malware a VPN ignores, and then a VPN on top for the network-level privacy it genuinely provides. Any single tool sold as the whole solution, including a VPN, is being oversold. For more, see the Privacy section.
Google just started using your IP address to track you for ads, a technique it once called 'wrong'
From 3 August 2026, Google began using the IP addresses of users in the UK, the European Economic Area and Switzerland to identify their devices for ad targeting and measurement. It is a quiet but significant reversal: the same company once said this kind of tracking was wrong precisely because, unlike a cookie, you cannot clear it. Here is what changed and what you can do.
Show your ID to see the internet: the age-verification era has arrived
Roughly half of US states and the UK now demand you prove your age, often with a government ID or a face scan, to reach legal content. Sign-ups for VPNs that sidestep the checks have surged. Here is what changed, why privacy experts are alarmed, and whether any of it actually works.
The best VPN of 2026, after six weeks of real testing
We ran the major providers as our only connection for six weeks and measured what actually matters: sustained speed, leak safety, and whether the no-log audits hold up. NordVPN won; Proton VPN is the value and privacy pick.