I stopped using a VPN for privacy once I understood what it actually hides

If there's one piece of technology that even your least tech-savvy friend probably has at least a vague understanding of, it's a VPN. Sure, they might not necessarily know what the acronym stands for or how one actually works. However, what they likely do know is that using one is supposed to make their internet activity more private. Beyond privacy, they might also associate VPNs with accessing websites and streaming content that would otherwise be unavailable in their region.

There's nothing particularly surprising about this. Between the countless YouTube sponsorships, advertisements, and recommendations from just about every tech publication out there, VPNs have practically become synonymous with online privacy. When you're constantly being told that using one is essential to keeping your internet activity private, it's easy to assume that browsing without one means leaving yourself exposed.

For the longest time, I believed that too. That was until I started looking into what a VPN actually hides and realized that much of what I assumed about online privacy wasn't quite right.

Most people don't understand what a VPN really does

It's not just a big Connect button

While a VPN might seem like nothing more than an app that lets you choose from a selection of countries and connect to a server with a single click, there's actually a lot more going on behind the scenes. However, despite how complicated VPNs might sound, the basic idea behind them is surprisingly simple.

Normally, when you visit a website, your internet traffic passes through your internet service provider (ISP). Depending on how your connection is configured, your ISP can see information like the websites you're connecting to, when you're visiting them, and how much data you're transferring. However, that doesn't necessarily mean it can see everything you're doing on those websites.

Most modern websites use HTTPS, which encrypts the actual contents of your connection. For instance, if you're visiting XDA Developers, your ISP might be able to tell that you've connected to xda-developers.com, but that doesn't necessarily mean it can see which articles you're reading or what you're doing on the website.

This is where a VPN comes in. Instead of connecting to websites through your ISP alone, a VPN routes your traffic through an encrypted tunnel to a server operated by your VPN provider. Your ISP can still see that you're connected to a VPN, but it generally can't see which websites you're visiting through that connection.

The websites you visit also see the VPN server's IP address instead of your own. This is where the entire privacy argument surrounding VPNs comes from. By hiding your browsing destinations from your ISP and masking your actual IP address, a VPN makes it harder for certain parties to track your online activity.

A VPN simply changes who can see your internet activity

Your ISP's loss is your VPN provider's gain

While a VPN does hide certain information about your browsing activity from your ISP, that information doesn't just disappear into thin air. Remember how I mentioned earlier that a VPN routes your traffic through a server operated by your VPN provider? Well, that means your VPN provider is now in a position to see some of the information your ISP would otherwise have access to.

For instance, without a VPN, your ISP might be able to tell that you're visiting XDA Developers. Turn on a VPN, and your ISP generally loses that visibility. However, depending on how the VPN service is configured, your VPN provider may now be able to see that you're connecting to xda-developers.com instead.

Just like your ISP, it generally can't read the contents of your HTTPS-encrypted connections, but it can potentially observe information like the websites you're connecting to, when you're connecting to them, and how much data you're transferring. So essentially, your traffic is simply being redirected from your ISP to your VPN provider, which can now potentially see some of the same information yo'u're trying to hide from your ISP in the first place.

In other words, a VPN doesn't necessarily eliminate the need to trust someone with your internet activity. It largely just changes who you're trusting. Instead of relying on your ISP, you're now placing that trust in a company that operates VPN servers, and potentially paying a monthly subscription for the privilege.

Of course, VPN providers often advertise strict no-logs policies, which essentially means they claim not to store records of your browsing activity. Some even undergo independent audits to back up those claims. However, there's an important distinction between a company promising not to store your activity and being technically unable to see certain information about it in the first place. A no-logs policy doesn't automatically mean the provider has no visibility into the connections passing through its servers.

Hiding your IP address doesn't make you anonymous

Changing your IP doesn't change your identity

Another thing I hadn't really considered before was just how many different ways the entire internet can track you, even when you're using a VPN. Sure, masking your actual IP address makes it harder for websites to identify your location or associate your activity with a particular connection, but your IP address is far from the only information they can use to recognize you.

For instance, let's say you're using a VPN and decide to open YouTube. If you're already signed into your Google account, YouTube still knows exactly which account is watching those videos, regardless of whether you're connected to a VPN server in the United States, Germany, or anywhere else. The same applies to pretty much any website where you're logged into an account, whether that's Instagram, Amazon, or Facebook.

And even when you're not logged into anything, websites can still use tracking cookies and browser fingerprinting to recognize you. The latter is particularly interesting because it involves collecting information about your browser and device, such as your screen resolution, operating system, installed fonts, and other characteristics, to create a relatively unique identifier. None of that automatically disappears just because you've changed your IP address.

This was another realization that made me question how much privacy I was actually getting from keeping a VPN switched on all the time. While it was certainly hiding my real IP address, that didn't necessarily mean the websites I visited had no idea who I was.

VPNs aren't useless, but they're not essential either

All that to say, this made me realize a VPN isn't quite as important as I (and the internet) have always made it out to be. Yes, they still have their uses, whether that's accessing geographically restricted content, masking your IP address, or keeping your browsing destinations hidden from your ISP. However, that doesn't necessarily mean everyone needs to have one running all the time.

I'm not saying VPNs are useless, or that you should stop using one altogether. I've just come to realize that there's a pretty big difference between what a VPN actually protects and what years of marketing have led us to believe it does. For my everyday browsing, that difference was enough to make me reconsider whether I really needed one in the first place.