A VPN hides your browsing from your internet provider and the local network you're on, and it hides your real IP address from the websites you visit. It does not make you anonymous. The VPN company can now see what your ISP used to see, and websites can still recognise you through logins, cookies and your browser itself.
Think of a VPN as moving trust, not removing the need for it. You stop trusting the coffee shop Wi-Fi and your ISP with your traffic, and start trusting one VPN provider instead.
What changes when you turn a VPN on at a café
Say you're on café Wi-Fi, reading a news site and then checking Gmail.
Without a VPN, your traffic goes from your laptop, through the café's router, through the café's internet provider, and out to the news site and Google. Each of those parties sits on the path and can see which sites you connect to, even when HTTPS hides what is on the pages.
With a VPN, your laptop builds an encrypted tunnel to a server run by the VPN company. Everything goes through that tunnel first. The café and its ISP now see one thing: an encrypted connection to a VPN server. The VPN server then fetches the news site and Gmail for you, so those sites see the VPN server's IP address instead of yours.
That is the whole trick. Everything a VPN does well, and everything it can't do, follows from that picture.
Can my ISP see my browsing with a VPN?
Mostly no. It can't see which sites you visit or what you do on them, because that is inside the encrypted tunnel.
The catch is that the VPN provider sits exactly where your ISP used to. It can see the sites you connect to. Whether it keeps records of that is a matter of its policy and how far you believe it. That's why choosing the provider is the real decision, not whether to use a VPN at all. The EFF's Surveillance Self-Defense guide to choosing a VPN walks through what to look for.
Does a VPN hide my IP address?
From websites, yes. A site you visit sees the VPN server's address, so it can't use your IP to place you on the map or tie visits from your home connection together.
But your IP address is only one of many ways a site recognises you, and often not the main one.
What websites and Google still see
Anything you log into. If you're signed in to Google, YouTube, Amazon or Facebook, they know it's you no matter which IP the request comes from. Your searches and watch history still land in your account. A VPN changes the address on the envelope; your account is the name inside.
Cookies. Cookies stored in your browser travel with you through the tunnel. A site or ad network that set a cookie last week can recognise you this week, VPN or not.
Your browser's fingerprint. Sites can combine details about your browser, screen, fonts and settings into something close to a unique ID. A VPN doesn't touch any of that.
What you tell them. Your email address, shipping address and payment card identify you directly.
So if your goal is to stop Google knowing what you search, a VPN does little while you're signed in. Signing out, using a separate browser profile, or clearing cookies matters more.
VPN vs private browsing: they solve different problems
Private or incognito mode is about your own device. It doesn't save history or keep cookies after you close the window, so the next person using your computer doesn't see where you've been. It does nothing about your ISP or the network, which still see your connections.
A VPN is about the network. It hides your traffic from the Wi-Fi and the ISP but leaves your browser history and cookies exactly as they were.
They stack. Private mode plus a VPN means a fresh set of cookies and a hidden IP, which is closer to what most people imagine either one does alone. If you sign in to an account, though, you've identified yourself again.
Do I need a VPN on public Wi-Fi?
It helps, but less than it used to. Most sites, including banks and email, now use HTTPS, which already encrypts the content of your connection, so someone on the same café network can't read your passwords or messages on those sites.
What HTTPS doesn't hide is which sites you're connecting to. On a network you don't trust, such as hotel, airport or café Wi-Fi, a VPN hides that list from whoever runs the network. If that matters to you, turn it on. If you're only reading the news, the gain is small.
Those attacks come through the tunnel along with everything else.
Is a free VPN safe?
Ask how it pays for its servers. Running a VPN costs money, and a free service has to cover that somehow, whether through ads, upselling, or the data passing through it. Since a VPN provider can see every site you connect to, it is the one company you most need to trust, and "free" gives you the least information about why you should. Use the EFF checklist linked above before installing any VPN, free or paid.
What to do differently now
- Use a VPN for the network, not for anonymity. Turn it on for public Wi-Fi or when you don't want your ISP seeing where you go online.
- Choose the provider like you'd choose a bank. You're handing it the view your ISP had. Read its logging policy and check who runs it.
- Handle tracking separately. Sign out of accounts, clear cookies, or use a separate browser profile when you want sites not to connect your activity.
- Spend your security effort on your accounts. If you use passkeys, know what happens to your Google passkey if you lose your phone.
