What a VPN Can and Can’t Hide

A virtual private network (VPN), if working properly, hides your public IP address from the websites and applications you use.

Your IP address is tied to sensitive information, such as your Internet Service Provider (ISP) and your rough geographic location.

It also gives attackers something to aim at: anyone who knows your IP address can scan your router for open ports and probe them for weaknesses.

Websites and apps can log your IP address when you use their site. This means they can record your activity and then link it back to you each time you return. They typically use your IP and additional information available from your browser, such as cookies and fingerprinting.

Websites regularly share this information with other websites, advertising networks, data brokers and online trackers, too. Collectively, they build profiles of you and your browsing habits, using your IP address as a thread that ties it all together.

These entities can then track you across the internet, targeting you with personalized ads, gathering more information about you, and monitoring what you do.

A VPN cuts that thread by hiding your IP address as you browse. Your traffic travels via a VPN server on its way to the site you’re using, so it appears to originate from the server rather than from you.

Using a VPN doesn’t stop websites and advertisers from seeing what you do online, but it does stop them from linking that activity back to you via your IP address, and makes building a profile of you far harder.

Hiding your IP address also lets you get around IP bans. Forums, and other sites, often use your IP address to suspend individual users, so if you’ve been banned by mistake, a VPN will restore your access by giving you a fresh IP address.

By replacing your IP address with the VPN server’s IP address, a VPN will hide your real location from the websites you visit – which is what lets you convince a streaming service you’re geographically sitting wherever the server is.

Websites and apps can vary their content based on your geographic location. Netflix, for example, has a different catalog of movies and TV shows for US users than it does for UK users.

Streaming websites use your IP address to determine which country-specific content to show you, so changing that IP address with a VPN lets you change your Netflix region and watch content that isn’t available where you live. I see this with HBO Max: when I connected through Surfshark’s servers in different countries, the app’s library changed each time to match the server location rather than mine.

Streaming isn’t the only reason to hide your physical location. Most other forms of internet censorship typically rely on IP-based geolocation too. For example, Microsoft Bing has been found to censor autofill suggestions whenever the user’s IP address places them in China.

Before I get to what a VPN hides here, it’s worth laying out what your ISP can actually see without one – because a lot of guides on this subject are describing the internet of fifteen years ago.

Almost every website and app now connects over HTTPS, which encrypts the contents of the connection at the website’s end. Your ISP cannot read the pages you load, the search terms you type, the messages you send, or the specific URLs you request. That was true before you ever installed a VPN.

What HTTPS doesn’t encrypt is the addressing information needed to deliver your traffic in the first place. So without a VPN, your ISP can still see:

• The domain behind every site and app you connect to – that you opened netflix.com, though not which show you watched
• The timestamps for when each connection started and ended
• How long you stayed connected
• How much data you sent and received
• The broad category of what you’re doing – streaming, gaming, or P2P – which it can infer from connection patterns and destination networks

Your ISP picks up the domain in one of three ways: your DNS lookups, the Server Name Indication field that your browser sends unencrypted during the TLS handshake, or simply the destination IP address. Switching to encrypted DNS (DoH or DoT) closes the first of those. The other two still give the game away.

That’s more restricted than “your ISP sees everything you do online” – but don’t mistake this for harmless. A list of every domain you’ve connected to, timestamped and measured, still exposes your bank, your health worries, your politics, your dating life, and the shape of your day. It’s exactly the sort of data that advertisers pay for.

A VPN fixes this. It encrypts your traffic a second time, and routes all of it through one server, so the addressing information HTTPS leaves exposed disappears along with everything else. Instead of a list of domains, your ISP sees a single continuous connection to one VPN server IP, and a running total of data transferred. It can’t tell whether you’re streaming, banking, or just reading the news.

The same is true of anyone else with router-level access, including employers, parents, landlords, and school and college administrators.

That matters because ISPs keep records of the connections you make whenever you don’t use a VPN, and in some countries they’re legally required to. UK ISPs, for instance, must retain 12 months of Internet Connection Records under the Investigatory Powers Act – logged at domain level precisely because HTTPS puts anything more granular out of reach.

Those records create several distinct risks:

1. Privacy. ISPs can share their connection logs with whoever they choose. In practice, your ISP is likely passing information about your browsing habits to data brokers, who then sell it on to willing buyers – usually advertising companies. The list of domains you visit is enough to place you in an advertising segment without anyone ever reading a word you typed.
2. Freedom. ISPs can be compelled to share those records with government agencies and police forces. That not only facilitates mass surveillance, it also lets governments run censorship regimes that limit your freedom online. Blocking works at the same level the logging does: an ISP doesn’t need to read your traffic to stop you reaching a domain, which is why domain-level visibility is worth removing.
3. Security. Your ISP likely holds those connection records in a database, and if cybercriminals break into it, they gain access to all of them.

   Unfortunately, these breaches are far from unheard of. Austria’s largest ISP, A1 Telekom, suffered one in 2019, and in 2017, a breach at a Russian ISP exposed the data of 8.7 million people.

4. Performance. ISPs have been known to throttle the speeds of internet users engaging in high-bandwidth activity, such as online gaming and P2P file-sharing. There are suspicions that ISPs sometimes use throttling to undermine competitors.

If your ISP can’t see what you’re doing online, it can’t single out your gaming traffic for throttling, work with governments to implement censorship measures, or let police track you in real-time. And because a VPN stops your ISP from logging your browsing history in the first place, there’s simply less data available to be breached, sold to advertising networks, or handed to government agencies.

There are two limits worth being clear about. A VPN can’t erase any records your ISP has already collected from your unprotected browsing. And while it can help stop activity-based throttling, your ISP can still see the total volume of data you’re moving – so if it throttles heavy users regardless of what they’re doing, a VPN won’t get you around that.

A VPN helps keep your personal and sensitive data hidden from hackers and cybercriminals in several ways.

I’ve already covered two of them: hiding your browsing from your ISP reduces the amount of data that can be stolen in a breach, and hiding your IP address makes it much harder for anyone to scan your router, dox you, or hit you with a DDoS attack.

The third is what a VPN does on open Wi-Fi networks, where it protects you from two main forms of man-in-the-middle attack:

1. DNS Spoofing: On unsecured public Wi-Fi networks, it’s relatively easy for attackers to hijack your DNS requests and re-route your connection to a website under their control, without you noticing.

   A good VPN for public Wi-Fi can protect you from DNS spoofing by encrypting your requests and resolving them on the VPN provider’s own DNS servers. The attacker can’t see your DNS request, let alone spoof it.

2. Session Hijacking: Hackers might also steal the ‘session cookies’ that appear temporarily while you’re connected to a website’s server. These are small text files stored in your browser that authenticate and facilitate an individual session on that website.

   On unsecured Wi-Fi networks, attackers can use packet sniffing or fake hotspots to steal these cookies and take over your session, for any site that doesn’t use HTTPS.

By encrypting your connection, a VPN makes your traffic unreadable to everyone except the VPN server. This includes hackers on a public Wi-Fi connection. It therefore keeps your personal information safe and hidden from criminals.

Torrenting is the one area where the HTTPS caveat above doesn’t apply, and where your ISP can genuinely see a great deal. BitTorrent doesn’t have the blanket encryption the web does: your ISP can identify P2P traffic by its distinctive connection pattern, see the trackers and peers you’re talking to, and in many cases work out what you’re sharing. Using a VPN can make a big practical difference.

A good VPN hides your torrenting downloads and P2P file-sharing activity from your ISP entirely. This is helpful because ISPs often throttle (or even block) P2P traffic on account of how bandwidth-hungry it is.

Encrypting and rerouting prevents your ISP from identifying your traffic as torrenting, so it can’t be singled out for throttling. (Bear in mind that an ISP which throttles based on total data volume can still act on that, since it can always see how much you’re transferring.)

It also means your torrenting activity stays hidden from police and copyright holders, too. Ordinarily, your ISP would typically work with law enforcement to issue you with DMCA notices, fines and legal action, should you ever mistakenly download any copyrighted material. VPN encryption stops your ISP from logging your P2P activity in the first place, which means it has no relevant information to pass on to these authorities.

A VPN protects you from other torrent users, too. Downloading and uploading torrent files normally exposes your IP address to everyone in the ‘torrent swarm’. With a VPN, the address visible in the swarm – and the one associated with the files you download – is the VPN server’s, not yours. The exception is a static or dedicated IP address – a service you would sign up to with the VPN provider. Because it’s assigned to you alone, it can be traced back to you in a way a shared server IP can’t.

ISPs and Wi-Fi administrators can’t see the details of your browsing activity when you use a VPN, but they can see that a VPN is being used. They do this by checking the connection’s port number, or more commonly, by using a tool known as Deep Packet Inspection.

Deep Packet Inspection (DPI) is an advanced method for analyzing network traffic. It uses sophisticated pattern-matching to classify the ‘type’ of data being transmitted over the network, and is very effective at identifying normal VPN traffic.

The best VPN services can hide the fact you’re using a VPN from your ISP. They do it with VPN obfuscation, which disguises your traffic as regular HTTPS traffic, so that DPI has nothing distinctive to latch onto.

I tested this myself with a packet inspection tool, first on a standard connection, and then with obfuscation enabled.

And my DPI analysis of VPN traffic with obfuscation:

As you can see, my DPI tool identified the OpenVPN connection immediately, and saw nothing but normal web traffic once obfuscation was switched on.

Obfuscation is therefore how a VPN hides itself from ISPs, governments, employers and Wi-Fi administrators.

To supply you with an internet connection, your ISP has to know your physical address and assign you an IP address. There is no way to hide those details from your ISP – not even with a VPN. You also pay them for service, so they have your billing information.

In many countries, there is very little stopping them from sharing that information with governments, police, and any other third-parties willing to pay for it.

What a VPN does do is stop your ISP from monitoring and recording what sites and apps you’re connecting to. With a VPN running, your ISP knows who you are, but not what you’re doing.

A VPN hides your browsing activity from your ISP and Wi-Fi administrator, but it doesn’t hide that activity from the website or app you’re using. They can still see exactly what you do on their service.

They can also track your browsing behavior using cookies – small files placed in your web browser when you visit a site, which send information back when you return and let the site re-identify you.

A VPN doesn’t protect you from cookie-based tracking, because cookies aren’t tied to your IP address. They are part of your browser and are sent to the website you’re accessing with every request. That’s why it’s important to delete them regularly, or browse in a private window that discards them when you close it.

Even so, with a VPN turned on, websites and apps are much less likely to trace your activity back to you, because they can’t see your IP address. They can see what you do, but not who you are.

Your account details do the same job as a cookie, and more reliably. The region you signed up in and the country your payment card was issued in stay attached to your account whatever your IP address says, which is why switching servers alone often isn’t enough to change what a service shows you.

Plenty of websites and services use your IP address to determine your physical location, but they can also use your device’s GPS data or Wi-Fi location tracking. It’s how navigation apps and food delivery services find you.

Most VPNs work purely by changing your IP address, so they won’t hide your location from websites and apps that use GPS tracking.

Of the VPNs I’ve tested, only four are capable of overriding your GPS location: Surfshark VPN, Windscribe, IVPN, and TorGuard. Of these, I prefer Surfshark – its GPS spoofing setting on Android was the most reliable of the four in my testing, holding the spoofed location consistently rather than reverting after a few minutes.

Wi-Fi Location Tracking is a different matter. It triangulates your position using the Wi-Fi access points around your device – routers and smart devices – and it’s both precise and difficult to defeat. Google and Apple both use it in their operating systems, and there are currently no VPN apps that can hide you from it. Apps on mobile devices take their geolocation from the operating system, but there are extensions that can override geolocation within your web browser, such as the Spoof Geolocation and ExpressVPN Browser Extension for Chrome, which work inside your browser to alter the GPS location it resolves.

Your device’s MAC address (Media Access Control address) is the unique, 12-character code that identifies the device on your local network. It’s used to coordinate the transmission of information between local devices and to help prevent unauthorized access to the network.

No VPN hides your MAC address. The good news is that it doesn’t need to: even without a VPN, your MAC address isn’t visible to anyone outside your local network as your router strips it out when it forwards packets to the internet, so it isn’t something to worry about. The only caveat to that statement is if you directly connect your device to the internet, without using a router, then your MAC address will be visible to your ISP.

VPN encryption stops cell phone carriers and ISPs from being able to monitor your online activity. With a VPN turned on, they can no longer see which websites you visit, when you visited them, and how long you spent there.

What a VPN doesn’t hide is how much data you’re consuming. ISPs and mobile carriers can see exactly how much data moves along your connection. Inside or outside a VPN tunnel – it’s just data. In fact, our research has shown that using a VPN can increase cellular data consumption by 4-20%.

You therefore can’t use a VPN to hide from monthly data caps or get unlimited roaming data. If anything, you’ll actually hit your cap sooner, and rack up more expensive data charges.

When you use a high-quality VPN, your provider is the one entity that knows what you do online and potentially knows who you are based on billing records. In effect, when using a VPN, you’re choosing to show everything to the VPN company in order to stay hidden from everyone else.

This makes your choice of provider the most consequential decision you’ll make here, because if it wanted to, it could see:

• Your name
• Your email address
• Your IP address
• Information about your devices
• Which websites and apps you use
• The timestamps for each session on these websites and apps
• Your download activity
• Any P2P and torrenting traffic
• The contents of any HTTP traffic (incl. usernames and passwords)

Look at that list again – it’s almost exactly what you stopped your ISP seeing at the top of this guide. That’s the difference a VPN actually makes: it doesn’t remove the visibility, it moves it to a company you chose. Which is why the choice of VPN provider matters so much.

An untrustworthy provider might then sell that information on to criminals and advertisers, or even use it to attack you. This is precisely the business model for many unsafe free VPNs.

Some VPNs have also been known to install backdoors into their service so that governments and law enforcement agencies can spy on user traffic. This is particularly common in countries where VPN use is restricted, such as in China.