VPNs have gone from being an obscure networking utility to big business. You’ve probably noticed the ads from your favourite YouTuber, on podcasts, or even during the Super Bowl with claims about how a VPN can make you anonymous or let you access free video streaming. Although VPNs can be useful tools for protecting your privacy, it’s important to understand how these tools work so you can decide whether they will help you. We break down how a VPN works to help you understand why you may want one and how to choose the best one for you.

What Is a VPN?

VPN stands for “virtual private network.” When we talk about VPNs, we usually refer to a commercial VPN selling its service directly to consumers. Still, VPNs have much broader applications and have been in use for decades. Corporations have long used VPN technology to let workers access digital resources no matter where they are, long before many of us started working from home.

When you activate a VPN, your device creates an encrypted connection (often referred to as a “tunnel”) that connects to a remote server operated by the VPN provider or your company. All your internet traffic is routed through this tunnel to the server, which sends the traffic off to the public internet as usual. Data coming back to your device makes the same trip: from the internet, to the VPN server, through the encrypted connection, and back to your machine.

Remember that you don’t need another company to set up a VPN. There are a few options to set up your own, such as OpenVPN, or you can build one with some know-how and spare PC parts. Doing so is fairly straightforward, but you’ll need to rent or maintain that VPN server on your own, which is more complicated than paying a VPN service to handle it instead.

Do VPNs Make You Anonymous Online?

Encrypting your traffic and routing it through a VPN server makes it harder (but not impossible) for observers to identify you and track your movements online. No VPN provides total anonymity, but it can help improve the strength of your overall online privacy toolkit.

For example, your home internet service provider (ISP) is probably the single entity with the most insight into what you do online, second only perhaps by your phone network carrier. If you don’t like that a company you’re already paying is profiting from your data, or if you have concerns about ISPs hoarding detailed information about your activities, a VPN will help. Not even your ISP can see your web traffic when you use a VPN.

VPNs also make it harder for advertisers and others to track you online. Normally, data is transmitted from the internet to your device, and vice versa, using the IP address that’s been assigned to your device by your ISP. When the VPN is active, your true IP address is hidden, and anyone watching you can only see the IP address of the VPN server.

However, as we mentioned, VPNs do not make you fully anonymous. Advertisers have plenty of ways to identify and track you as you move across the web. Website trackers and cookies try to identify you and then watch for where you appear next, and a VPN alone can’t do anything about that (although many offer tools to help).

Sites and advertisers can also identify through unique characteristics like your browser version, screen size, and so on. This information is harmless, but when companies compile enough of these identifiers, they form a unique signature—so much so that the process is called browser fingerprinting. Ad and tracker blockers, like those found in some browsers such as DuckDuckGo address some of these concerns. 

Do VPNs Keep You Safe Online?

A VPN will hide the contents of your web traffic from some observers and can make it harder for you to be tracked online. But a VPN can only, at best, provide limited protection against the threats you’re most likely to encounter on the web: malware, social engineering scams, and phishing sites.

Your VPN can consult a list of dangerous and fraudulent websites, blocking all access to those known undesirable domains. However, this is a heavy-handed approach and unsuitable for real-world situations, such as a phishing page injected into an otherwise safe site or malware distributed from a compromised domain.

There are better ways to address these threats. Your browser has built-in tools for detecting phishing sites, as do most antivirus suites. VPN suites that come with full-on antivirus protection typically build in detection of unwanted web pages as well, and some of them are quite successful such as NordVPN and Proton VPN. Use common sense if you see a suspicious pop-up window or receive an unusual email urging you to take some action.

Many people reuse or use weak passwords, so get a password manager to generate and store unique, strong passwords for each site and service you use. Finally, protect your online accounts and enable multi-factor authentication whenever available.

Can You Trust a VPN?

The biggest problem with VPNs isn’t technology but trust. Because all your traffic passes through its network, a VPN company is in the same position as an ISP. It could, if it wished, see everything you do online, sell that data, or use it to identify you if someone asks for it.

VPNs are eager to earn your trust, but proving they deserve it is difficult. When we review a VPN, we pore over its privacy policy and send out a questionnaire to get a sense of what efforts each company makes to protect customers’ privacy. We know they could lie to us, but our goal is to put them on record.

We want VPNs to take every possible measure to protect their customers, but we also want transparency. Even when we don’t agree with all their choices, we prefer companies that are up-front about their operations. A VPN should also issue a transparency report outlining what requests the company has received from law enforcement and how the company responded.

We also like to see third-party audits of VPN services that examine the policies and review the security of the company’s infrastructure. Audits are imperfect tools, partially because they’re commissioned by the VPN company, which also outlines the scope of the audit. Still, it’s a valuable way to demonstrate a company’s commitment to transparency.

Do I Need a VPN?

In years past, VPNs had a better-defined place in your privacy and security toolbox. Back then, most web traffic travelled via HTTP, sometimes without encryption. Today, most web traffic is sent via HTTPS, which is encrypted. However, an ISP or someone spying on your network can still see the highest level of your traffic’s destination, even if it’s HTTPS. For example, even though our site uses HTTPS, your ISP could see that you’ve visited AbsTechServices.co.uk but not AbsTechServices.co.uk/what-is-a-vpn.

Advertisers have also become more sophisticated. Browser fingerprinting and other techniques, like cookie storage, can circumvent a VPN’s anonymizing abilities. Even a VPN’s ability to spoof locations, bypass censorship, and unblock streaming is less certain as companies and governments have become increasingly aggressive in detecting and blocking VPN traffic.

The rise of sophisticated tracking methods and HTTPS are often cited as reasons VPNs aren’t worth the money. But ultimately, it all depends on why you need or want a VPN. If you want your traffic to appear to be coming from another country, a VPN will do that. If you want to make it a little harder for advertisers and others to track you as you move across the web, a VPN can help do that, too. And if you want to ensure your ISP knows as little about your online activity as possible, a VPN can also help there.

A VPN isn’t a perfect solution, but it’s still a powerful tool to protect your privacy online. It’s a valuable part of your toolkit, and like every tool, it works best when you use it for the right job.