What Is a VPN and Do You Actually Need One?

A Virtual Private Network encrypts the connection between your device and the VPN server, then forwards your traffic to its destination through that server. Websites and services see the VPN server's IP address rather than yours. Your internet service provider sees encrypted traffic going to the VPN server but cannot read its contents or see which sites you are visiting.

This has two practical effects. First, it hides your browsing activity from your ISP and anyone else monitoring your local network — useful on public Wi-Fi networks in cafés, hotels, and airports where the network operator could potentially inspect unencrypted traffic. Second, it makes your apparent location match the VPN server's location rather than your actual location, which allows access to geo-restricted content.

What a VPN does not do: it does not make you anonymous. The VPN provider itself sees your traffic and knows your real IP address. It does not protect against tracking by cookies, browser fingerprinting, or logged-in account activity on platforms that know who you are. And it does not protect against malware or phishing — a VPN has no effect on whether you are tricked into downloading malicious software or submitting your credentials to a fake login page.

Public Wi-Fi networks are the clearest legitimate use case for a VPN. Coffee shops, hotel lobbies, airports, and conference centres all operate networks where the infrastructure is outside your control and the other connected devices are unknown. On an unencrypted public network, traffic to sites using only HTTP (not HTTPS) can be read by anyone else on the network. A VPN encrypts all your traffic before it leaves your device, preventing interception regardless of the network's security.

Most websites now use HTTPS, which encrypts the connection between your browser and the destination site without a VPN. On a fully HTTPS web, the main remaining exposure on a public network is your DNS queries — the lookups that translate domain names to IP addresses — and metadata about which sites you are connecting to. Some VPN implementations also encrypt DNS queries, closing that gap.

For journalists, activists, and others in locations where ISP-level surveillance is a real risk, a VPN provides meaningful protection for the browsing metadata their ISP would otherwise log. For the majority of users in jurisdictions with functional privacy laws, ISP surveillance is a lower-priority concern than the tracking done by the advertising platforms they visit voluntarily.

Choosing a VPN requires trusting the VPN provider with your traffic — you are redirecting your privacy problem from your ISP to the VPN company. A VPN provider that keeps connection logs, operates in a jurisdiction that compels data disclosure, or has a history of security incidents may offer weaker protection than your ISP. The most important criterion when selecting a VPN is their logging policy and whether it has been independently audited.

VPN speed penalties are real. Encrypting traffic and routing it through an additional server adds latency. Budget VPN services operating overcrowded servers can reduce connection speeds significantly. Premium providers with large server networks in multiple locations generally have smaller performance penalties, but some speed reduction is inherent to the technology.

Browser-level tracking — the kind performed by advertising networks through cookies, fingerprinting, and pixel tracking — is entirely unaffected by a VPN. A user visiting a website while using a VPN is still tracked by every analytics and advertising script on that site. The IP address that those scripts see changes, but the fingerprint of the browser, the cookies already set by the ad network, and any logged-in account state remain visible. A VPN addresses network-level privacy; browser-level privacy requires separate tools.

A VPN is worth using if you regularly connect to public Wi-Fi networks, if you need to access services from a country other than your current location, or if you are in a jurisdiction where ISP monitoring of browsing activity is a genuine concern. For users who work from home on a private connection, visit only HTTPS sites, and are primarily concerned about advertising tracking, a VPN addresses the wrong problem.

If you decide to use a VPN, select one with a published, audited no-logs policy operated by a company in a jurisdiction with strong privacy protections. Open-source VPN clients that allow independent review of the code are preferable to proprietary clients that cannot be verified. Avoid free VPNs — in most cases, the VPN provider's business model is the data, which directly undermines the privacy benefit you are seeking.

For the privacy concerns that a VPN does not address — browser fingerprinting, cookie tracking, and cross-site advertising profiles — the more effective tools are a privacy-focused browser with built-in tracker blocking, a reputable ad blocker extension, and regular clearing of cookies and site data. A local password generator and other privacy-preserving browser tools that process data without sending it to external servers also contribute to a reduced tracking footprint.