Key Takeaways
- A VPN encrypts your traffic to its own server and masks your IP address — but everything your ISP could see simply becomes visible to the VPN provider instead; you move trust, you
- A VPN does nothing against malware, phishing, trackers or logged-in accounts, and on modern HTTPS-heavy Wi-Fi it adds less protection than ads claim
- When researchers tested 283 free Android VPN apps, 18% had no encryption at all and 75% contained third-party trackers
Your VPN Is Not an Invisibility Cloak. It's a Tunnel With a Landlord.
VPN ads promise total anonymity, military-grade protection and freedom from every online threat. The Electronic Frontier Foundation — which actually recommends VPNs for specific jobs — puts it bluntly: the ads "vastly oversell" the tool. Here is what you actually bought.
What a VPN Does
A virtual private network routes your device's traffic through an encrypted tunnel to a server run by the VPN company. Your data then heads to its destination from that server, so:
- Websites see the VPN server's IP address and location, not yours
- Your internet provider and the local network owner (the coffee shop, the hotel) can't read the content of your traffic or see which sites you're visiting
- Your traffic on an untrusted network is shielded from local snooping
That is a real, useful service. It is also the entire service.
The Part the Ads Skip: You Moved Trust, You Didn't Delete It
Everything your ISP used to see, your VPN provider can now see. As the EFF explains, a VPN doesn't remove trust from your internet use — it relocates it, from the ISP to the provider. "No-logs" is a policy promise, not a technical property: it means the company says it won't record your traffic, not that it's incapable of seeing it. That's why the choice of provider — its business model, jurisdiction and independently audited claims — matters more than its feature list.
What a VPN Does Not Do
- Make you anonymous. If you're logged into Google, Google knows it's you. Cookies and browser fingerprinting identify you regardless of your IP — for genuine anonymity, the EFF points to Tor, not VPNs.
- Stop malware, phishing or scams. A tunnel encrypts whatever passes through it, including your click on a fraudulent link and the malware you download at the other end.
- Shield you the way it did in 2012. Most web traffic is already encrypted by HTTPS, so the EFF notes a VPN is no longer necessary against most public Wi-Fi threats — it still protects the unencrypted remainder, but the coffee-shop panic in the ads is dated.
- Erase your digital identity. Using a VPN doesn't remove the traces your browser, apps and accounts already create — it only hides where your traffic appears to come from.
Free VPNs: The Research Is Ugly
When CSIRO and university researchers analyzed 283 free Android VPN apps (ACM, 2016), they found 18% implemented their tunnel with no encryption at all, 75% embedded third-party tracking libraries, and most leaked traffic outside the tunnel in testing. The study is a decade old and Android-only — but its lesson is structural and permanent: running servers costs money, and if you're not paying, your traffic is the likely product.
When a VPN Is Genuinely the Right Tool
- On restrictive networks — censorship or geo-blocking
- To reach a work intranet or your home network securely from outside
- To keep your browsing destinations away from your ISP, accepting that the provider takes its place
- For the remaining unencrypted traffic on networks you don't trust
Under the hood, prefer modern protocols: WireGuard (a fixed, modern cipher suite in under 4,000 lines of code, built into the Linux kernel since 2020) or OpenVPN (the older, highly configurable standard). Both are sound; the provider running them is the variable.
The Twikup Take
Buy a VPN the way you'd hire a landlord for your traffic: boring, paid, audited, and clear about what it keeps. Use it for tunnels and untrusted networks. Get your anonymity from Tor, your malware protection from updates and scepticism, and your scam protection from the pause before you click. The VPN was never the whole toolbox — it's one good wrench.
Image: AI-generated illustration.