VPN Privacy: What a VPN Actually Hides (and Doesn't)

In short: A VPN hides your browsing activity and IP address from your internet provider and local network, but it does nothing to stop cookies, browser fingerprinting, or tracking tied to accounts you're logged into, according to the Electronic Frontier Foundation. Even the Federal Trade Commission warns that "a VPN app generally isn't going to make you entirely anonymous," per its guidance for consumers.

A VPN is sold as a one-tap fix for online privacy. It isn't. It does one job well — hiding your traffic from the network you're connected to — and leaves several others completely untouched. Understanding the line between those two groups is the difference between picking a VPN that actually improves your privacy and one that just gives you a false sense of safety.

What exactly does a VPN hide from my internet provider?

A VPN routes your device's traffic through a server run by the VPN company, so to your internet provider and anyone on your local network, your activity looks like it's going to the VPN's server, not to the actual websites you're visiting. The FTC describes the mechanism directly: "When you use a VPN app, data sent from your phone – for example, your browsing data or the apps you're using – is first routed through servers controlled by the VPN provider," and that routing "can make traffic from your phone to a website appear to come from the VPN's servers," according to the FTC's VPN guidance.

EFF frames the same mechanism in terms of what it hides from your router and ISP specifically. "Using a VPN masks the IP address assigned by your ISP from the sites that you access, adding a layer of privacy," EFF writes, and the VPN is "hiding information such as metadata and page level information from the user's router and ISP," according to EFF's analysis of VPN limitations. In plain terms: your ISP can no longer see which sites you visit or read the contents of your traffic. It can still see that you're connected to a VPN server — the VPN hides the destination and content, not the fact that a VPN is running.

Why doesn't a VPN stop websites from tracking me with cookies?

Because a VPN only protects data while it's traveling between your device and the VPN server — it doesn't change anything about what a website does once your browser actually loads its pages. Cookies, trackers, and ad scripts are placed by the site itself, inside the encrypted tunnel, and the VPN has no say over them. That's a separate privacy problem with its own mechanics, covered in Privacy Unpacked's guide on how tracking cookies work even with a VPN.

EFF goes further, noting that encryption doesn't erase your identifiability on the sites you visit: "Even though your browsing data is encrypted, it doesn't mean that a VPN entirely shields who you are. You could still be subject to different kinds of tracking such as browser fingerprinting," per EFF. Browser fingerprinting builds a unique profile from things like your screen size, fonts, and browser settings — none of which a VPN touches, since it operates at the network level, not inside your browser.

If I'm logged into Google or Facebook, can the VPN still hide what I do?

No. A VPN changes what your network sees, not what the account you're logged into sees. If you're signed into Google, Facebook, or any other account while browsing, that service already knows who you are regardless of which IP address or server your traffic is routed through — the login itself is the identifier, and a VPN doesn't remove it. This is arguably the single most common misunderstanding about VPNs: people expect "anonymous browsing" and get IP masking instead. The FTC's blunt framing applies directly here — "a VPN app generally isn't going to make you entirely anonymous," per the FTC — and staying logged into an account while using a VPN is the clearest example of why.

How do I know if a VPN's 'no-logs' promise is real?

You check whether an independent auditor has actually verified it, rather than taking the provider's marketing at face value. EFF's guidance to users is to favor providers with "transparent policies on usage and storage of user logs," arguing this "will help foster a more informed user base on how much of their information they are agreeing and trusting you to store," according to EFF. EFF also cautions against being swayed by marketing language like "military grade encryption," since "strong ciphers are accessible to if not all, most major VPN services" — cipher strength alone says nothing about a company's actual privacy practices or infrastructure.

Two providers illustrate what a real audit looks like. In 2024, independent auditor Securitum spent six person-days on-site in Geneva reviewing Proton VPN's infrastructure and confirmed the company does not log DNS traffic, does not log which server a user connects to, and does not log usernames or IP addresses of connecting users — details laid out in Securitum's published audit report. Proton VPN itself acknowledges the underlying risk that makes such audits necessary: "When you connect to a VPN, it effectively becomes your internet provider, meaning any VPN provider is technically capable of tracking and logging what you do online," the company writes in its audit announcement. Proton also says its no-logs claim has been tested legally: "Proton VPN's strict no-logs policy has been tested in over 400 legal cases so far. We were ordered to turn over logs to help identify our users, but we were unable to comply because these logs did not exist," per the same post.

NordVPN commissioned a similar review at the end of 2024, hiring Deloitte Audit Lithuania to assess "the configuration of our IT systems, supporting infrastructure, and no-logs claims," covering its standard, Double VPN, Onion Over VPN, obfuscated, and P2P servers, according to NordVPN's own account of the audit. Deloitte's researchers "interviewed our employees and inspected our server infrastructure and technical logs" over a set review window. Worth knowing before you sign up: NordVPN says "the full report is available after logging in to your Nord Account user control panel" — it isn't posted publicly the way Proton's is, so you can't read the full findings until you're already a customer.

Even a clean audit has limits. EFF points out that because "commercial VPNs often have servers in different countries, their logs may be subject to law enforcement requests," meaning "VPNs cannot fully prevent surveillance or access from law enforcement, nor can they completely anonymize your identity," per EFF. And a VPN never protects you from attacks on the destination site itself — "VPNs cannot protect you from malicious attacks to a site's servers or their compromised networks," EFF writes. A no-logs audit tells you the VPN company itself isn't recording your activity; it doesn't make the sites you visit or the governments with jurisdiction over those servers disappear.

The FTC also flags a more basic risk: a 2018 study of roughly 300 VPN apps "found potential privacy and security risks with some VPN apps," including that "some VPN apps didn't use encryption" at all, according to the FTC. Plenty of VPN apps on app stores fail the most basic test of what a VPN is supposed to do.

What's a DNS leak, and does my VPN actually stop it?

Every time you type a web address, your device looks up its IP address through the Domain Name System — and if that lookup bypasses the VPN tunnel and goes straight to your ISP's DNS servers, your browsing destinations leak outside the VPN's protection even while the rest of your traffic stays encrypted. DNS "plays an integral role in every organization's security posture by translating domain names into IP addresses," the National Institute of Standards and Technology notes in its Secure DNS Deployment Guide. Whoever handles your DNS queries — your ISP or your VPN — can potentially see and log every domain you look up, which is exactly why DNS leaks matter. NIST's guide covers "protecting the confidentiality of client DNS queries" and, in its latest version, "minimizing information leakage in DNS queries and responses." In practice: open your VPN app's settings, confirm DNS leak protection (often under advanced or connection settings) is switched on, then run a DNS leak test while connected and check that none of the servers listed belong to your ISP.

This is also part of what a credible no-logs audit should check. Securitum's 2024 review of Proton VPN specifically confirmed the company does not log DNS traffic or other metadata that could be tied to a user, per the audit report — a direct test of whether the provider's DNS handling matches its privacy promises.

What else should I do besides a VPN to protect my privacy?

Treat a VPN as one layer, not the whole stack. It hides your browsing and IP address from your ISP and local network — genuinely useful on public Wi-Fi or against a nosy internet provider — but it does nothing about cookies, fingerprinting, or accounts you're signed into, and it can't fully guarantee anonymity given that VPN servers sit under real-world legal jurisdictions, as EFF notes. A short checklist for picking one:

• Look for a published, independent audit — like Securitum's review of Proton VPN or Deloitte's assessment of NordVPN — rather than taking a "no-logs" claim on faith.
• Check whether the full audit report is public or locked behind a login; a provider that only shows the report to paying customers is harder to independently verify from the outside.
• Ignore marketing terms like "military grade encryption" as a selling point on their own — EFF notes strong ciphers are already standard across most major VPNs, so that phrase tells you nothing about the company's actual privacy practices.
• Be skeptical of VPN apps generally; the FTC cites a study of roughly 300 VPN apps that found some didn't encrypt traffic at all or shared data with third parties for advertising.
• Remember what a VPN can't do: it won't stop cookies, browser fingerprinting, or tracking by any account you're logged into — for that layer, see Privacy Unpacked's guide on how tracking cookies work even with a VPN running.

A VPN earns its place in a privacy routine by closing one real gap: what your ISP and local network can see. It was never built to close the others.