What Does a VPN Hide? Privacy, Trust and Choosing a Provider

Additional resource for the lesson “Introduction to VPNs: Safeguarding Privacy and Security Online” — Online Privacy course

What does a VPN hide? Less than the adverts suggest, and more than nothing. It can keep your browsing out of sight of the network you are on and of your internet provider, but it hands that view to the VPN company. This resource helps you decide whether you need one, and whom you would be trusting.

A. Why this matters

A VPN, or virtual private network, is often sold as a single switch for privacy: tap it and you are hidden. In reality, a VPN protects you from some observers, not from others, and adds a new one: the VPN company itself.

Privacy, in this course, means three questions: what is known about you, by whom, and what you choose to let them know. A VPN changes the “by whom”, not how much is known. Seeing that turns a VPN from a product you are sold into a tool you choose.

What the sources say

The Electronic Frontier Foundation (EFF), a digital rights organisation, explains in its Surveillance Self-Defense guide that a VPN “hides your outgoing traffic from your ISP and the local network owner”, such as a café or hotel, and adds the other half: “while a VPN hides your browsing data from the ISP, it’s all visible to the VPN provider.” Its advice is direct: “Do not use a VPN that you do not trust.”

“A VPN is not a tool for anonymity,” the guide says, listing other ways companies may track you, “including GPS, web cookies, tracking pixels, or fingerprinting.” It also notes that, because “the majority of web traffic is now encrypted using HTTPS”, a VPN on public Wi-Fi “isn’t as necessary for everyone anymore.”

The US Federal Trade Commission (FTC) turns the trust question into a short checklist for anyone choosing a VPN app: research the app before you get it, review the permissions it asks for, make sure it encrypts your information, and check whether it shares your information with third parties.

A guest post on the blog of the Office of the Privacy Commissioner of Canada, now archived, concluded that “VPNs are a poor way of guaranteeing online anonymity.”

B. Key concepts

Five ideas that answer what a VPN hides, and from whom.

The encrypted tunnel: what it hides, and from whom

A VPN creates an encrypted connection between your device and a server run by the VPN provider. Your traffic goes through it first, then on to the sites you use, and appears to come from the VPN server rather than your own internet address. Without a VPN, the local network (the hotel or café Wi-Fi) and your internet provider can see the names of the sites you visit even over HTTPS, as the HTTPS resource in this section explains; with one, they see only a connection to the VPN server.

Why it matters to you: The tunnel covers one stretch: from your device to the VPN server. If your concern is the network around you or your internet provider, a VPN addresses it directly. Name your concern first.

What it does not hide

A VPN does not hide you from the services you sign in to. Your email, social network or search engine know it is you, whatever address you appear to come from; the EFF gives the example of your search history when you are logged in. Nor does a VPN stop cookies, tracking pixels, GPS location or fingerprinting (recognising your browser from its particular combination of settings).

Why it matters to you: Much of what is known about you online is known by the services you use, not by the network you use them on. A VPN does not change that layer.

Shifting trust, not removing it

Whoever runs the VPN server now sees which sites you connect to, and when, in place of the network and your provider. The Canadian blog post mentions retained metadata “such as websites visited”.

Why it matters to you: You are choosing which company has the view, so the provider’s behaviour, not its speed, comes first.

How a “free” VPN app pays for itself

The EFF describes services that “can be entirely free, but sell your data.” On a phone, the app may also ask for permissions, such as contacts or location, that carrying your traffic does not need.

Why it matters to you: A VPN app paid for with your data sees more than the network you wanted to avoid. “Who pays for this, and why does it need that permission?” are privacy questions.

No-logs claims, audits and jurisdiction

A “log” is a record a provider keeps of your activity or connections. The EFF warns that a VPN company “might log your data if it doesn’t specifically rule it out in its privacy policy”, that a claim is not a guarantee, and that a provider is subject to the laws of the countries where it does business.

Why it matters to you: What a provider says it keeps, whether anyone independent has audited it, and which laws apply are things you can check in its own documents.

C. A practical example: Luca’s hotel Wi-Fi

Luca is 36, lives in Milan and travels often. In a hotel abroad, the Wi-Fi login page made him uneasy, so he installed the first free VPN in his app store, whose description promised “total anonymity”. It asked for his contacts and location, and he tapped “Allow”: it was a privacy app, after all. That evening he checked his bank, posted a photo and searched for restaurants, and felt invisible.

Nothing Luca did was unreasonable, but “invisible” was not quite true. His bank, social network and search engine all knew it was him, because he was signed in. The hotel network could no longer see which sites he visited, but the VPN company could see every one. And he had no idea who that company was, how it earned money, or why it needed his contacts.

What changed when Luca looked again

Back home, Luca did the exercise in section D, curious rather than alarmed:

• He wrote down what he had wanted: to keep his browsing away from hotel and airport networks, not from his bank.
• The free app’s privacy policy allowed sharing usage data with partners and did not rule out logs. He found no independent audit.
• He took back the permissions and removed the app.

He made one decision: before the next trip he would compare two or three providers against the same five questions; until then, for anything sensitive on the road, he would use mobile data. Not a VPN by default, nor no VPN on principle, but a choice he could explain.

D. Try it yourself: a VPN decision check (15 minutes)

Four short steps. You do not need a VPN to do them, and “I do not need one” is a perfectly good result.

Step 1 — Name what you want to hide, and from whom (3 minutes)

• Write one sentence: “I want to keep ___ away from ___.”
• If the second blank is the local network or your internet provider, a VPN can help. If it is the sites you sign in to, or advertisers, look instead at your account and browser settings.
• If you cannot finish the sentence, you may not need a VPN at all.

Step 2 — See what is already on your phone (3 minutes)

• On Android, Google’s help page puts VPN settings under Settings › Network and Internet › VPN; if you cannot find it, search the Settings app for “VPN”. On iPhone, searching Settings for “VPN” usually finds it too.
• Look for VPN apps or profiles you no longer use or recognise.
• For any VPN app you keep, check whether each permission makes sense for a tool that only carries your traffic.

Step 3 — Ask one provider five questions (6 minutes)

Choose one VPN you use or are considering, open its privacy policy and website, and look for answers:

1. What does it say it records about your connections and activity? Does it rule out keeping logs, in writing?
2. Has an independent company audited the service, and is the report public? How recent is it?
3. In which country is the company based, and where does it do business?
4. How is it paid for: a subscription, a limited free plan, or by advertising and data?
5. Does it share data with “partners” or third parties, and for what?

Where you find nothing, write “not found”. That is an answer of a kind.

Step 4 — Make one decision (3 minutes)

• Keep it: the provider answered well enough and covers the concern from step 1.
• Replace it: the concern is real, but this provider did not convince you.
• Remove it: you do not need a VPN for your concern, or no longer use this one.

One decision you can explain beats a VPN switched on out of habit.

Already covered in the Online Security course

VPN on Home Router: What It Does, and What It Does Not
It covers a VPN on the router for every device at home, with its speed and compatibility trade-offs, and already goes through the trust questions (who sees your traffic, funding, logs, audits, jurisdiction, what a VPN does not stop); this resource adds VPN apps on your phone, their permissions and a check of one provider.

E. Videos, articles and further resources

Institutional sources first, then digital rights guides and platform help. All in English.

Institutional sources

FTC (US) — FTC Provides Tips for Using VPN Apps
What to look at before choosing a VPN app: research it, review its permissions, check that it encrypts your information and whether it shares it with third parties.
https://www.ftc.gov/news-events/news/press-releases/2018/02/ftc-provides-tips-using-vpn-apps

Office of the Privacy Commissioner of Canada — The actual privacy benefits of virtual private networks
An archived blog post on what a VPN protects, what providers may retain and why a VPN is not anonymity.
https://www.priv.gc.ca/en/blog/20170210/

Information Commissioner’s Office (UK) — Cookies
What cookies and third-party cookies are, and how to control them: tracking a VPN does not stop.
https://ico.org.uk/for-the-public/online/cookies/

Digital rights guides and tools

Electronic Frontier Foundation — Choosing the VPN That’s Right for You
What a VPN hides and from whom, business models, logs, audits and jurisdiction, in one clear guide.
https://ssd.eff.org/module/choosing-vpn-thats-right-you

Electronic Frontier Foundation — Cover Your Tracks
A free test that shows how trackers see your browser, including through fingerprinting.
https://coveryourtracks.eff.org/

Platform documentation

Android Help — Connect to a virtual private network (VPN) on Android
Where VPN settings live on Android and how VPN apps connect to them.
https://support.google.com/android/answer/9089766?hl=en-GB

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Skills pillar at level FL2 – Beginner: judging a tool by what it does, not by what it promises.

Skills

• Working out who can see your traffic on a given network, with and without a VPN.
• Reading a provider’s privacy policy for logs, sharing and funding.
• Finding the VPN settings and VPN app permissions on your own phone.

Awareness

• Understanding that a VPN changes who can see your traffic, rather than hiding it from everyone.
• Knowing that a VPN does not hide you from the services you sign in to, or from cookies and fingerprinting.
• Recognising that a “free” VPN is paid for somehow, and that the answer matters.

Secure Behaviour

• Using a VPN for a reason you can name, not as a habit.
• Choosing a provider whose claims you have checked; removing unused VPN apps.
• Keeping sensitive tasks for connections you trust, with HTTPS, VPN or not.

G. Questions to sit with

• Whom would you rather trust with the list of sites you visit: your internet provider, a hotel network or a VPN company?
• What would a VPN provider need to show you before you trusted it?
• Which things you most want to keep private are known by services you sign in to, where a VPN changes nothing?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Before you reach for a VPN

• R9 — Browse only over HTTPS: it protects what you send to a site on any network, VPN or not.
• R13 — Check what your apps can do: a VPN app already sees your traffic, so check its other permissions.
• R22 — Remove apps you no longer use, including VPN apps installed for one trip.

Minimum commitment: today, finish the sentence from step 1: “I want to keep ___ away from ___.”

2. If you decide a VPN is for you

• R11 — Use a VPN for sensitive traffic on networks you do not trust, from a provider checked against the five questions in step 3.
• MS10 — A VPN on the router covers every home device at once: a more advanced step, once you have a provider you trust (see the Online Security resource above).

Minimum commitment: before you install or renew a VPN, check one thing in its privacy policy: whether it rules out keeping logs, in writing.

In short

• What does a VPN hide? Your browsing, from the local network and your internet provider, and your address, from the sites you visit.
• It does not hide you from services you sign in to, cookies or fingerprinting, and does not make you anonymous.
• A VPN shifts trust to the provider: its logs, audits, funding and jurisdiction are what you are really choosing.
• “I do not need one” can be an informed answer. So can “this one, for this reason”.

Related resources in this course

• Public Wi-Fi Privacy: What an Open Network Learns About You
• Password-Protected Public Wi-Fi: What the Password Really Covers
• What Is HTTPS? What the Padlock Tells You, and What It Doesn’t
• What Can My Internet Provider See? Home Connection Privacy

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.