VPN and Online Privacy: What They Can and Can't Do
VPN advertisements promise total privacy with one click. The reality is more nuanced — a VPN is one tool in a box, excellent for some jobs and useless for others. This guide gives you an honest picture: what a VPN actually hides, what it does not, how it compares with Tor, and how to pick a provider that deserves your trust.
What is a VPN, really?
A VPN (Virtual Private Network) creates an encrypted tunnel between your device and the VPN provider's server. Everything you send travels through that tunnel, emerges from the server's IP address, and travels onward to the website. To the website, you appear to be at the VPN server's location.
That's the whole mechanism. Everything a VPN does — and everything it fails to do — follows from this single design.
What a VPN can do
- Hide your IP from websites. The site sees the server's IP, not yours. This blocks basic IP-based tracking and location targeting.
- Encrypt traffic on public Wi-Fi. On a coffee-shop network, a VPN stops nearby sniffers from reading your data.
- Change your apparent location. Useful for streaming libraries or bypassing regional blocks (where the service's terms allow it).
- Throttle evasion. Some ISPs slow down specific traffic; a VPN hides what kind of traffic it is.
What a VPN cannot do
This is the part every advertiser hopes you skip:
- It cannot make you anonymous. The VPN provider can see exactly what you do. If they keep logs (many do), that's a treasure chest for police or hackers.
- It cannot protect you from websites. A VPN hides your IP, but cookies, browser fingerprints, and logged-in accounts still identify you to the sites you visit.
- It cannot protect you from malware. A VPN does not scan your downloads or stop phishing. That is antivirus and common sense.
- It cannot protect your account passwords. If a website is breached or a phishing page tricks you, no tunnel helps.
The core insight
A VPN moves your trust from your ISP to the VPN company. That is sometimes smart — and it is not the same as privacy. True privacy means nobody in the chain can connect the dots, which is what Tor is designed for.
VPN vs Tor: which one when?
| VPN | Tor | |
|---|---|---|
| Hides IP from websites | Yes | Yes |
| Hides activity from provider/ISP | No — the VPN company sees it | Yes — no single party sees the whole path |
| Speed | Fast (single server hop) | Slow (three relays worldwide) |
| Economic model | Paid service | Free, volunteer network |
| Best for | Everyday browsing, streaming, public Wi-Fi | Dark web, whistleblowing, censorship circumvention |
Some people run a VPN and Tor together ("Tor over VPN"). That can defeat ISP-level observation of Tor usage, but it is not automatically more private — the order matters, and the VPN company still sees your traffic. For most users this is unnecessary complexity. The Tor Project has warned that VPN+Tor combos often reduce anonymity when done wrong.
How to choose a VPN in 2026
There are hundreds of VPN providers and almost no way to verify their claims from the outside. These are the questions that matter:
- Headquarters and jurisdiction: Is it based in a country with mandatory data retention or data-sharing agreements? Providers in privacy-friendly jurisdictions (e.g., Switzerland, Iceland) face fewer forced-logging demands.
- Independent audits: Has the provider published security audits by a recognized firm? Audits don't prove everything, but their absence is a red flag.
- Logging policy: Do they claim "no logs"? No-log claims matter, but you cannot verify them; audits help. Avoid free VPNs almost universally — they monetize your data in ways that defeat the purpose.
- Open protocol support: WireGuard is the modern standard, with audited open-source implementations.
- Reviews you respect: Look at technical reviews from sources like Kaspersky's resource center or independent privacy blogs, not SEO listicles full of affiliate links.
One more honest point: no VPN, however good, turns you into a ghost. Combine the right tool with the right habits — unique passwords, two-factor authentication, and a browser with strong privacy defaults.
VPNs and the dark web
People often ask whether they "need" a VPN to visit the dark web. You do not — Tor Browser itself is designed for that. There are two legitimate scenarios where a VPN matters on the dark web:
- Your ISP or government actively monitors Tor connections (a bridge or a VPN in front of Tor may help — with the caveats above).
- You are doing open-source research and want an extra layer before any traffic leaves your machine.
Everything else is marketing. Remember: the risk on darknet marketplaces is not that your IP is visible — it's the scams inside them. Read how scams work before considering anything there.
Frequently asked questions
Is a VPN legal?
In the US and most of the EU, yes, VPNs are legal. A few countries restrict or ban them — check local law wherever you travel.
Do I need a VPN for banking?
No. Your bank already encrypts the connection (HTTPS). A VPN adds nothing there and may even trigger fraud flags when you connect from unusual locations.
Can police track me through a VPN?
If the provider logs, they can request the logs via legal process. No-log providers under favorable jurisdiction make this much harder. That's why provider choice matters.
Which is safer: VPN or Tor?
For hiding your activity from a third party, Tor wins by design — no company holds the keys. For protecting your data on public Wi-Fi or hiding your IP from a website at full speed, a VPN wins. Different jobs, different tools.
Further reading: VPN (Wikipedia) · EFF: top 12 ways to protect privacy · Tor Project
