What a VPN Can and Can’t Hide

A VPN will hide information like your IP address and geographic location from the websites and apps you use, and your and web browsing activity from your ISP.

A VPN does this by encrypting your traffic, and using a remote VPN server as the middleman between your device and the destination website or app.

Here’s a table summarizing exactly what a VPN hides and from who:

Data Type	Your Internet Service Provider (ISP)	The Websites & Apps You Use	Governments & Police	Hackers (on Public WiFi)	Employers & Other WiFi Admins
Your IP Address	No	Yes	Sometimes	No	No
Your Physical Location	No	Yes, with IP-based geolocation	Sometimes	No	No
Websites/Apps You Visit	Yes	No	Mostly	Yes	Yes (but be careful)
Time Spent on Websites/Apps	Yes	No	Mostly	Yes	Yes, with obfuscation (but be careful)
Search History	Yes	Yes	Mostly	Yes	Yes, with obfuscation (but be careful)
Downloads	Yes	No	Mostly	Yes	Yes, with obfuscation (but be careful)
Torrenting	Yes, with obfuscation	Yes, with Static IP	Yes, with obfuscation	No	Yes, with obfuscation (but be careful)

The tricky part is understanding who can and can’t see some of this information.

It’s not enough to know that a VPN hides your location, you also need to know who it is and who it isn’t hidden from. Otherwise, you could put yourself at risk by believing you’re protected when you’re not.f

We’ll now take a more in-depth look at each of these:

1. Your IP Address from Websites & Apps

A virtual private network (VPN), if working properly, hides your public IP address from the websites and applications you use.

Your IP address is tied to sensitive information, such as your Internet Service Provider (ISP) and your rough geographic location.

If someone knows your IP address, they can scan your router for open ports, which are vulnerable to malware.

Websites and apps use your IP address to register when you visit their site. This means they can record your activity and then link it back to you each time you return.

Websites regularly share this information with other websites, advertising networks, data brokers and online trackers, too. Collectively, they form profiles of you and your browsing habits, using your IP address to tie it all together.

These entities can then track you across the internet, targeting you with personalized ads, collecting additional information about you, and monitoring your browsing activity.

A VPN protects you from these advertising and surveillance networks by hiding your IP address as you browse.

When you use a VPN, your traffic travels via a VPN server on its way to the web service you’re accessing. This makes your traffic appear as if it’s coming from the VPN server, therefore hiding your personal IP address.

Using a VPN doesn’t stop websites and advertisers from seeing what you do online, but it stops them from linking that activity back to you via your IP address and makes it much harder for them to gather information about you.

Hiding your IP address from websites and apps also allows you to bypass IP bans. Often websites, such as forums, use your IP address to issue suspensions to individuals who have broken their terms of use.

If you have been mistakenly banned, then using a VPN will let you regain access to the service because it hides your original, banned IP address from the website.

2. Your Real Location from Websites & Apps

By replacing your IP address with the VPN server’s IP address, a VPN will hide your real location from the websites you visit. This means you can trick streaming services into thinking you are physically located wherever the VPN server is.

Websites and apps can vary their content based on your geographic location. Netflix, for example, has a different catalog of movies and TV shows for US users than it does for UK users.

Streaming websites use your IP address to determine which country-specific content to show you. By changing your IP address with a VPN, you can for instance change your Netflix region and access content unavailable in your country.

But streaming isn’t the only reason to hide your physical location from websites. Other forms of internet censorship typically rely on IP-based geolocation too. For example, Microsoft Bing has been found to

EXPERT ADVICE: IP-based geolocation isn’t the only way that websites and apps can track your physical location. Apps like Uber and Google Maps use GPS data to determine your location. Most VPNs don’t spoof your GPS location, although there are some exceptions.

3. Your Browsing Activity from Your ISP

A good VPN hides your web browsing activity from your ISP, including:

• The websites you visit and the apps you use
• What you do on those websites and apps (if they are not HTTPS encrypted already)
• How long you spend on them
• The timestamps for when your session started and ended
• Any files you download or upload

A VPN does this by encrypting your traffic, converting its contents into an unintelligible string of letters and numbers that only the VPN server knows how to interpret.

Instead of seeing details about which websites you’re using, your ISP will only see a stream of indecipherable jargon, the IP address of the VPN server, and the total amount of data transferred. The same is true for anyone with router-level access, such as employers, parents, landlords, school and college administrators.

Most ISPs keep logs of your browsing history whenever you don’t use a VPN. In many countries, such as the UK and Australia, they are required to do so by law. This poses a number of different risks:

1. Privacy. ISPs can share these browsing history logs with anyone they choose to. It’s likely that your ISP is passing over information about your browsing habits to data brokers who then sell on to willing buyers – usually advertising companies.
2. Freedom. ISPs may be compelled to share your browsing records with government agencies and police forces too. Not only does this facilitate global mass surveillance, it also allows governments to implement censorship regimes that limit your freedom online.
   
   ISPs often work with governments to censor content and penalize individuals who access restricted information. They may even allow police to monitor your web traffic in real-time.
3. Security. Your ISP likely keeps logs of your historical web browsing activity in a database. If cybercriminals were to hack into these servers, they would gain access to that sensitive information.
   
   Unfortunately, these security breaches are not unheard of, either. Austria’s largest ISP, A1 Telekom, suffered one in 2019. In 2017, 8.9 million people had their data exposed when a Russian ISP was breached.
4. Performance. ISPs have been known to throttle the speeds of internet users engaging in high-bandwidth activity, such as online gaming and P2P file-sharing. There are suspicions that ISPs sometimes use throttling to undermine competitors.

But if your ISP can’t see what you’re doing online, then it can’t throttle your gaming traffic, work with governments to implement censorship measures, or let police track you in real-time.

Moreover, since a VPN prevents your ISP from logging your browsing history, there will be less data susceptible to data breaches, shared with advertising networks, or used to aid government surveillance. However, VPNs can’t erase ISP records of your previous, unprotected search history.

And while a VPN can protect from internet throttling, ISPs can still see the total amount of bandwidth you’re using and may still throttle your connection if it deems that you’re using too much data.

4. Your Sensitive Data from Hackers & Cybercriminals

Using a VPN helps to keep your personal and sensitive data hidden from hackers and cybercriminals in a number of different ways.

We’ve already established that hiding your internet activity from your ISP can reduce the risk of data theft from security breaches, and that hiding your IP address protects from vishing, doxing and DDoS attacks.

Additionally, a VPN keeps sensitive data transfers concealed on open WiFi networks. In particular, it protects you from two main forms of man-in-the-middle attack:

1. DNS Spoofing: On unsecured public WiFi networks, it’s relatively easy for attackers to hijack your DNS requests. They can then re-route your connection to a website under their control, without you knowing.
   
   A good VPN for public WiFi can protect you from these DNS spoofing attacks by encrypting your requests and resolving them on the VPN provider’s own DNS server. This stops the attacker from seeing your DNS request, let alone spoofing it.
2. Session Hijacking: Hackers might also steal the ‘session cookies’ that appear temporarily whilst you’re connected to a website’s server. These are small text files stored in your browser that authenticate and facilitate an individual session on that website.
   
   On unsecured WiFi networks, attackers can use packet sniffing or fake hotspots to steal these cookies and take over your session. If you were online banking, then they could even make bank transfers from your account.

By encrypting your connection, a VPN makes your traffic unreadable to everyone except the VPN server. This includes hackers on a public WiFi connection. It therefore keeps your personal information safe and hidden from criminals.

5. Your Torrenting Activity from Your ISP, Police, & Copyright Holders

A good VPN hides your torrenting downloads and P2P file-sharing activity from your ISP. This is helpful because ISPs often throttle (or even block) P2P traffic due to its high-bandwidth nature.

By encrypting your data, however, a VPN can hide the fact you are torrenting from your ISP, leaving you free to enjoy fast download and upload speeds.

It also means your torrenting activity stays hidden from police and copyright holders, too. Your ISP would typically work with law enforcement to issue you with DMCA notices, fines and legal action, should you ever mistakenly download any copyrighted material. VPN encryption stops your ISP from logging your P2P activity in the first place, which means it has no relevant information to pass on to these authorities.

Using a VPN will also help keep you safe from other torrent users on the P2P network. That’s because downloading and uploading torrent files normally means exposing your IP address to everyone in the ‘torrent swarm’.

A VPN keeps you safe while torrenting by hiding your IP address behind the IP address of your VPN server. This means that the IP address seen in the torrent swarm, and the one associated with the torrents you download, is the VPN server’s IP address and not your real one.

6. The VPN Traffic Itself from Your ISP

ISPs and WiFi administrators can’t see the details of your browsing activity when you use a VPN, but they can see that a VPN is being used. To do this, they can check the connection’s port number or, most commonly, use a tool known as Deep Packet Inspection.

Deep Packet Inspection (DPI) is an advanced method for analyzing network traffic. It uses sophisticated pattern-matching techniques to classify and categorize the ‘type’ of data being transmitted over the network, and is very effective at identifying normal VPN traffic.

The best VPN services can hide the fact you’re using a VPN from your ISP, government, and WiFi or network administrator. To do this, they use VPN obfuscation.

VPN obfuscation refers to the capacity of a VPN server to disguise your traffic as regular HTTPS traffic. When you use VPN obfuscation, DPI is much worse at detecting and identifying the VPN because your traffic becomes camouflaged amongst normal web traffic.

Here is our DPI analysis of VPN traffic without obfuscation:

And here is our DPI analysis of VPN traffic with obfuscation:

As you can see, our DPI tool was unable to detect VPN traffic when the connection was obfuscated.

A VPN can therefore hide itself from ISPs, governments, employers and WiFi administrators by using obfuscation.

VPN services can help to hide all of the information listed above, but they can’t make you completely anonymous online.

Here’s an overview of the things a VPN can’t hide, and who from:

Your IP Address or Physical Location from Your ISP

To supply you with an internet connection, your ISP has to know your physical location and assign you an IP address. There is therefore no way to hide these details from your ISP – not even by using a VPN.

In many countries, there is very little stopping them from sharing this information with governments, police, and any other third-parties willing to pay for it.

A VPN stops your ISP from monitoring and recording what you actually do online. When you use a VPN, your ISP knows who you are, but not what you’re doing.

Your Browsing Activity from the Websites and Apps You Visit

Using a VPN hides your browsing activity from your ISP and WiFi administrator, but it doesn’t hide that activity from the website or app you’re using – they can still see exactly what you do on their service.

They can also track your browsing behavior using cookies, which are small files set into your web browser whenever you visit a website. They send information back to the website when you return, enabling it to re-identify you.

Using a VPN doesn’t hide you from cookies because cookies aren’t linked to your IP address. That’s why it’s important to delete cookies regularly, or to use Incognito mode in your browser.

Nevertheless, with a VPN turned on, websites and apps are less likely to be able to trace your activity back to you because they can’t see your IP address. They can see what you do, but not who you are.

Your GPS Location or WiFi Location

While many websites and services use your IP address to determine your physical location, it’s also possible to use your device’s GPS data or WiFi location tracking. This is how navigation apps and food delivery services find your location.

Most VPN services work by changing your IP address, which means they won’t successfully hide your location from websites and apps that use GPS tracking.

There are only four VPN services capable of hiding your GPS location: Surfshark VPN, Windscribe, IVPN, and TorGuard. Of these, we prefer Surfshark, in part thanks to its very effective GPS spoofing setting on Android.

If your website or app uses WiFi Location Tracking, then there are no VPNs that will hide your location. WiFi location tracking uses the WiFi access points (e.g. routers and smart devices) around your device to triangulate its location.

Google and Apple both use WiFi location tracking. It’s an incredibly precise and robust way to track your location and, currently, there are no VPNs that can hide you from it.

Your MAC Address

Your device’s MAC address (Media Access Control address) is the unique, 12-character code that identifies the device on your local network.

It’s used to coordinate the transmission of information between local devices and to help prevent unauthorized access to the network.

Using a VPN doesn’t hide your MAC address. However, even without a VPN, your MAC address isn’t visible to anyone outside of your local network so isn’t something to really worry about.

Your Total Data Usage from Your ISP or Mobile Carrier

VPN encryption prevents cell phone carriers and ISPs from being able to monitor your online activity. With a VPN turned on, they can no longer see which websites you visit, when you visited them, and how long you spent there.

However, a VPN doesn’t hide how much data or bandwidth you’re consuming. ISPs and mobile carriers can still see exactly how much data is being transferred along your connection when you use a VPN. In fact, our research has shown that using a VPN can increase cellular data consumption by 4-20%.

You therefore can’t use a VPN to hide from monthly data caps or get unlimited roaming data. On the contrary, you’ll actually end up reaching your data cap faster and scoring more expensive roaming charges.

Your Identity & Activity from the VPN Service Itself

When you use a high-quality VPN, the only entity capable of seeing both who you are and what you do online is the VPN service itself. Essentially, you are opting to show everything to the VPN company in order to stay hidden from everyone else.

Using a VPN therefore requires a huge amount of trust in your VPN provider. If it wanted to, it could see:

• Your name
• Your email address
• Your IP address
• Information about your devices
• Which websites and apps you use
• The timestamps for each session on these websites and apps
• Your download activity
• Any P2P and torrenting traffic
• The contents of any HTTP traffic (incl. usernames and passwords)

An untrustworthy provider might then sell that information on to criminals and advertisers, or even use it to carry out cyber-attacks against you. Indeed, this is precisely the business model for many unsafe free VPNs.

VPNs have also been known to install backdoors into their service so that governments and law enforcement agencies can spy on user traffic. This is particularly common in countries where VPN use is restricted, such as in China.