What a VPN Actually Does to Your Internet Traffic
A Virtual Private Network (VPN) creates an encrypted tunnel between your device and a VPN server, routing all your internet traffic through that server before it reaches its destination. The practical effects of this routing: your ISP (and anyone else who can observe your network traffic) sees only that you are connecting to the VPN server, not what websites you are visiting or what content you are accessing; websites you visit see the IP address of the VPN server, not your actual IP address; and your traffic is encrypted between your device and the VPN server, preventing eavesdropping by anyone on the network between you and the server (such as the operator of a public Wi-Fi network).
The VPN limitation that most VPN marketing obscures: a VPN does not make you anonymous on the internet. It shifts the trust from your ISP to your VPN provider — your VPN provider can see all the same traffic your ISP could see, and the VPN provider’s privacy policy and technical practices determine what they do with that information. The VPN that logs your browsing activity and sells it to data brokers has merely replaced your ISP’s surveillance with the VPN provider’s surveillance. The VPN that keeps no logs and operates under a jurisdiction that does not require data retention provides a more genuine privacy benefit — but verifying these claims requires trust in the provider’s representations and, where available, independent audits.
When VPNs Provide Genuine Security and Privacy Benefits
The use cases where VPN technology provides genuine security or privacy value: on public Wi-Fi networks (which may be operated by malicious actors who intercept unencrypted traffic or may be subject to passive monitoring — the VPN encrypts traffic between the device and the VPN server, preventing the Wi-Fi operator from seeing the traffic content), for bypassing geographic content restrictions (accessing streaming libraries, websites, or services that are restricted to specific geographic regions by routing traffic through a VPN server in the permitted region), and for hiding browsing activity from an ISP in jurisdictions where ISPs sell browsing data to advertisers or share it with government agencies.
The privacy threat that VPNs do not address and that VPN marketing often implies they do: the tracking by websites and advertisers through cookies, browser fingerprinting, and logged-in account activity. The website that you visit through a VPN still receives a request that includes your browser fingerprint, your cookies, and if you are logged in, your account identity — the VPN changes the IP address the website sees but does not prevent any of the other tracking mechanisms that advertisers and analytics companies use to identify and track users across the web. The user who believes a VPN provides comprehensive privacy while remaining logged in to their Google account and browsing with a unique browser fingerprint has a significantly overstated understanding of what the VPN is doing for their privacy.
Choosing a VPN Provider
The VPN provider selection criteria that most reliably predict whether the service provides the privacy benefit it claims: the no-logs policy (the explicit commitment to not storing logs of user browsing activity, with audits by independent security firms that verify the technical implementation of the policy rather than only the policy statement), the jurisdiction (the country in which the VPN provider is legally incorporated determines which government data requests it must comply with — providers in countries without mandatory data retention laws and without extensive intelligence-sharing agreements with other countries provide stronger privacy protections), and the ownership structure (the VPN provider owned by an advertising or data company has a business model that may be in tension with the privacy promise).
The free VPN service evaluation that most VPN experts reach: free VPN services almost universally monetise through the collection and sale of user data — which is in direct conflict with the privacy purpose of using a VPN. The free VPN user who is not paying for the service is often the product rather than the customer. The exceptions are the free tiers offered by established paid VPN providers (which provide limited features as a trial of the full service) and open-source, self-hosted VPN solutions (which require technical setup but provide full control). For most consumers who want genuine privacy benefits, a reputable paid VPN service is the appropriate choice.
VPN Performance and Practical Limitations
The VPN performance impact that most affects everyday usability: the additional latency introduced by routing traffic through a VPN server. The VPN server adds a network hop to every request, increasing the round-trip time for each request by the time required to reach the VPN server and back. The VPN server in a geographically close location may add only 5-10ms of latency; the one on the other side of the world may add 100-200ms. For general browsing, the latency addition is barely perceptible; for latency-sensitive applications like online gaming or real-time video calls, a poorly placed VPN server can produce a noticeably degraded experience.
The VPN use case consideration that most affects throughput performance: the encryption and decryption overhead that VPN protocols impose on every data packet. Modern VPN protocols (WireGuard being the most efficient) add minimal overhead on modern hardware; older protocols (OpenVPN) can be significantly more CPU-intensive, particularly on lower-powered devices or on VPN servers that are heavily loaded. The VPN connection that produces download speeds 60% of the non-VPN speed is not providing adequate performance for use cases that require maximum throughput; the WireGuard-based VPN that achieves 90-95% of non-VPN speeds on a nearby server is performing at a level that most users would find imperceptible.
VPNs for Business Use
The business VPN use case that most differs from consumer VPN use: the enterprise VPN that provides remote employees with secure access to internal company resources (internal servers, file shares, business applications) that are not accessible from the public internet. This use case — commonly called remote access VPN — is fundamentally different from the consumer privacy VPN in that its purpose is to extend the corporate network to remote locations rather than to provide privacy from the ISP or to bypass geographic restrictions.
The enterprise VPN evolution that has most changed how organisations approach remote access security: the transition from traditional VPN architectures (which provide broad network access once the tunnel is established) to Zero Trust Network Access (ZTNA) solutions (which provide application-level access to specific approved resources without providing network-level access to the broader network). The ZTNA approach is more consistent with zero trust security principles because it enforces least-privilege access at the application level rather than providing the broad network access that compromised VPN credentials can be used to exploit — a transition that accelerated during the pandemic-driven increase in remote work and that most enterprises with significant remote workforces are actively implementing.