What a VPN Actually Does
When you connect to a VPN, your traffic gets routed through an encrypted tunnel to a server operated by your VPN provider. Your real IP address — the one assigned to you by your ISP — gets replaced with the IP address of the VPN server. To the websites and services you visit, it appears as though your traffic originates from that server rather than your home or office.
This is genuinely useful. It prevents websites from tagging you with your real IP address, prevents your ISP from reading your web traffic, and allows you to appear to be in a different geographic location. But it is important to understand exactly what this protection covers, because it is narrower than many VPN marketing materials suggest.
A VPN encrypts the path between your device and the VPN server. It does not encrypt your data end-to-end — the VPN server decrypts your traffic and then forwards it to its destination. The owner of that VPN server can, depending on their logging policies and technical architecture, see a great deal about what you are doing online.
What Can Be Tracked Even with a VPN
Browser Fingerprinting
Every browser has a unique configuration based on installed fonts, screen resolution, installed plugins, canvas rendering characteristics, WebGL capabilities, and dozens of other signals. Websites use this fingerprint to identify and track you across sessions, and it persists regardless of whether you use a VPN. Using a privacy-focused browser and blocking JavaScript where possible are the most effective countermeasures, but even then, perfect anonymity is difficult to achieve.
The Electronic Frontier Foundation's Cover Your Tracks tool lets you see how unique your browser is. In most tests, even VPN users with Tor Browser produce identifiable fingerprints — though Tor Browser's noise injection does make correlation harder.
Cookies and Local Storage
Cookies are small files stored in your browser that websites use to remember your login state, preferences, and browsing history. They are tied to your account when you log in, not your IP address. Clear your cookies regularly or use a separate browser profile for sensitive browsing to prevent this tracking vector.
Third-party cookies set by advertising networks are particularly insidious — they follow you across websites even when you are not logged in. Most modern browsers block these by default, but some ad networks have moved to fingerprinting-based alternatives that are much harder to defeat.
Logged-In Accounts
If you log into your Google, Facebook, or Amazon account while connected to a VPN, those companies now have a complete record of your activity tied to your identity. A VPN masks where you are connecting from but it does not make your behavior anonymous to services you voluntarily identify yourself to. This seems obvious but it is one of the most overlooked tracking vectors — people who carefully route their traffic through a VPN in Chrome but stay logged into their Google account in the same browser.
IPv6 Leaks
Many VPNs still do not properly handle IPv6 traffic. If your ISP uses IPv6 and your VPN only routes IPv4 traffic, your real IP address could be exposed through an IPv6 leak. Quality VPN providers block IPv6 entirely or route it through the tunnel, but budget and free VPN services frequently fail to handle this properly. You can test for leaks at our IPv6 leak test page.
What a VPN Genuinely Protects
VPNs are excellent at their core job: hiding your IP address from the websites you visit and encrypting your traffic from your ISP, local network operators, and WiFi hotspot owners. On a public WiFi network at a coffee shop or airport, a VPN prevents other users on that same network from intercepting your traffic — a real and documented threat that affects anyone using unsecured networks without protection.
A VPN also prevents your ISP from building a detailed behavioral profile of your browsing habits. Without a VPN, ISPs have visibility into every domain you visit (via DNS queries), every cleartext HTTP request, and the timing patterns of your activity. In the United States, this data can be sold to advertisers and bundled into behavioral profiles. In other jurisdictions, it can be accessed directly by government agencies without warrants.
VPNs also prevent DNS leaks when configured correctly. Your DNS queries — the lookups that translate domain names into IP addresses — reveal which websites you intend to visit, often before the connection itself is established. Quality VPN apps intercept these queries and route them through the encrypted tunnel as well.
The Logging Question
Not all VPN providers are equal when it comes to what they keep. A VPN that logs your real IP address, connection timestamps, and bandwidth usage is in a fundamentally different position than one that keeps no logs at all. If law enforcement or a court order arrives at a no-log VPN provider's door, there is nothing to hand over.
The problem is that "no-log" is a marketing claim that is hard to verify independently. There have been cases where VPN providers claimed to keep no logs and were later shown to have maintained records that led to arrests. The most credible providers have undergone independent security audits of their infrastructure — companies like ExpressVPN, NordVPN, and Mullvad have all had their claims verified by third-party firms. Look for providers that have published detailed logging policies and commissioned public audits.
Government and Law Enforcement Tracking
VPN traffic can be identified and blocked by governments that maintain sophisticated internet filtering infrastructure. China, Iran, and Russia all have systems capable of detecting and throttling VPN protocols that lack obfuscation. This is a cat-and-mouse game: providers that take censorship evasion seriously release obfuscated versions of their protocols or operate on ports that are difficult to block.
For law enforcement within the Five Eyes intelligence alliance (US, UK, Canada, Australia, New Zealand), the situation is more nuanced. VPN providers operating in these countries can be compelled to produce records. If a provider genuinely keeps no logs, there is nothing to produce — but the investigation simply moves to other vectors: timing correlation attacks, malware on the user's device, or cooperation from the website being accessed.
Maximizing Your Privacy with a VPN
Using a VPN correctly requires attention to more than just the connection itself. Here are the settings and habits that actually matter:
Enable the kill switch. This feature cuts your internet connection if the VPN tunnel drops, preventing your real IP from leaking during reconnection events. It is not enabled by default in all VPN apps — make sure it is active in your settings.
Use DNS leak protection. Combined with a VPN's own DNS servers, this ensures your DNS queries do not bypass the encrypted tunnel. Some VPN apps include this automatically; others require manual configuration.
Prefer providers with audited no-log policies. As mentioned, look for independent security audits published on the provider's website. Mullvad and NordVPN are among the most transparent providers in this regard.
Keep your VPN on at all times when privacy matters. Connection patterns reveal information. If you only activate your VPN for specific sessions, the timing of those sessions is itself a data point that can be correlated with activity on the destination server.
Separate your VPN browser from your normal browser. Use a dedicated browser profile with strict privacy settings and no login integrations when you need anonymity. Keep your normal browsing separate.
The Bottom Line
A VPN is one of the most effective tools for protecting your privacy from ISP surveillance, network eavesdroppers, and casual IP-based tracking. It is not, however, an anonymity solution. Understanding the difference is essential: a VPN says "here is where I am connecting from" without saying "here is who I am." Websites, services, and investigators can still piece together your identity through the breadcrumbs you leave behind — browser fingerprints, logged-in accounts, behavioral patterns, and metadata.
For most users, a quality no-log VPN with a kill switch, proper DNS handling, and an audited infrastructure provides exactly the protection you need: privacy from your ISP, security on public networks, and geographic flexibility. If your threat model includes sophisticated adversaries like nation-state actors, you will need additional layers — the Tor network, Tails OS, air-gapped devices, and operational security practices that go well beyond what any VPN can provide.
Choose a reputable provider, understand what it does and does not protect you from, and combine it with good browser hygiene and smart account management. A VPN used correctly is far better than no VPN at all — but it is one tool in a larger privacy toolkit.