What a VPN Does and Does Not Do

VPNs are marketed as general-purpose privacy and security. What they actually do is narrower and worth understanding, because the gap between the marketing and the mechanism leads people to rely on them for things they do not provide.

What it does

Encrypts traffic between your device and the VPN provider's server, and sends it out from there.

Two consequences follow.

Your internet provider sees encrypted traffic to one server instead of which sites you connect to.

Websites see the VPN server's address instead of yours, which means your approximate location appears to be wherever the server is.

That is the mechanism. Everything else claimed follows from those two, or does not follow at all.

What that genuinely buys you

On an untrusted network — a café, hotel or airport — it prevents anyone on that network from observing your traffic. This was the original and strongest case, and it has weakened as most of the web moved to encryption by default.

Hiding browsing from your internet provider, which matters where providers log and sell activity, and where that is a genuine concern for you.

Appearing to be elsewhere, for content that varies by region. Effective, frequently against the service's terms, and increasingly detected.

Avoiding provider-level throttling of particular traffic types, sometimes.

Some protection on a network you do not control where you cannot verify what else is connected.

What it does not do

It does not make you anonymous. You sign in to accounts, and those accounts know who you are regardless of where the connection appears to come from.

It does not stop tracking. Cookies, browser fingerprinting and account-based tracking work exactly as before. A content blocker does far more for this. See internet privacy.

It does not protect against malware. Encrypted delivery of a malicious file is still delivery.

It does not protect against phishing. The fake site loads exactly as well through a VPN.

It does not secure a compromised device.

It does not hide activity from the sites you use. They see everything you do there.

And it moves trust rather than removing it. Your provider no longer sees your traffic; the VPN company does. Whether that is an improvement depends entirely on which you trust more.

The trust question

The central issue, and it is rarely discussed in the marketing.

A VPN provider can see everything your internet provider could see. Which sites, when, how much.

"No logs" is a claim, and claims vary in verifiability. Some providers have been independently audited; some have had claims tested in court; many simply assert it.

Free VPNs are the clearest case. Running the infrastructure costs money, and if you are not paying, the business model is something else — frequently the data itself.

Jurisdiction matters, because it determines what a provider can be compelled to retain or disclose.

The practical position: using a VPN means choosing a company to trust with your browsing. That is a real decision and it should be made deliberately.

When it is worth having

You regularly use networks you do not control, and you handle things you would rather not expose.

Your internet provider's visibility genuinely concerns you — because of where you live, what you do, or their retention practices.

You need to appear in another region and accept the terms and reliability implications.

You are on a network that blocks things you legitimately need.

Your work requires it, which is a different kind of VPN — connecting to an office network rather than routing traffic through a commercial provider.

When it is not

As a general security measure. Updates, a password manager and two-factor authentication do vastly more. See security software.

As a privacy measure on its own. A content blocker and account settings do more.

Because a video told you to. The category is heavily promoted through sponsorship, and the claims made in those promotions are frequently the ones above that do not stand up.

On a home network you control, for ordinary browsing, where it adds latency and cost for very little.

Choosing one, if you decide to

Independently audited no-logs claims, not just asserted ones.

A clear ownership structure. Several apparently independent brands share owners.

Jurisdiction you are comfortable with.

Not free.

Speed and server locations appropriate to what you need.

And check what happens when the connection drops — a kill switch prevents traffic leaking outside the tunnel, and without one the protection lapses silently.

Practical notes

It slows things down, because traffic takes a longer route.

Some services block known VPN addresses, including banks, which may lock you out.

It can break local network access, including printers and network storage.

Turn it off when you do not need it rather than running it permanently, unless you have a reason.

The short version

It encrypts traffic to the provider's server and sends it out from there. That is the whole mechanism.

It moves trust from your internet provider to the VPN company — it does not remove it.

It does not make you anonymous, stop tracking, or protect against malware or phishing.

The strongest case is untrusted networks, and it has weakened as the web encrypted by default.

And a free VPN is being paid for somehow — running the infrastructure costs money.

For broader technical standards and computing references, see NIST Information Technology Laboratory.