VPN advertising has performed one of history's great security upsells: a niche networking tool rebranded as daily armor against hackers, trackers, and surveillance. The result is millions of people paying monthly for protection they already have, while skipping measures that would actually help (like password managers). Let's establish what a VPN technically does — then grade the claims.
What a VPN actually is#
A VPN creates an encrypted tunnel from your device to a server operated by the VPN company; your traffic then continues to the internet from that server. Two concrete effects:
- Local-network and ISP visibility drops: your coffee-shop WiFi operator and internet provider see only an encrypted stream to one address — not which sites you visit.
- Websites see the VPN server's IP, not yours — masking your rough location from them.
That's the complete list of native functions. Everything else in the ads is either a different technology wearing VPN branding or fiction. Notably absent from that list: any power to anonymize you from sites where you log in, stop trackers, encrypt email, or remove malware.
The myths, graded#
"VPNs protect you from hackers on public WiFi." Mostly obsolete — grading: C-. The WiFi-attacks-of-legend targeted unencrypted traffic; today essentially all meaningful web traffic is HTTPS-encrypted anyway (your browser shows the padlock). A VPN adds marginal protection here — though it still neutralizes hostile-network snooping of DNS and non-HTTPS traffic, so it's not useless on airport WiFi, just far less critical than 2015-era ads imply.
"VPNs prevent tracking." Grading: D. Trackers follow you via cookies, browser fingerprints, and logged-in accounts — none of which care about your IP address. Log into any site through a VPN and that site knows exactly who you are. Anti-tracking comes from browser hygiene and content blockers.
"VPNs make you anonymous." Grading: F for consumers. Your VPN provider replaces your ISP as the party who can see your traffic metadata — you've shifted trust, not removed it. Providers keep logs (some despite "no-logs" claims; several have been demonstrated otherwise in court cases). True anonymity requires Tor-class tooling and behavioral discipline no commercial VPN provides.
"VPNs stop malware/viruses." Grading: F. Encryption transports malware as politely as anything else. That's antivirus and update-hygiene territory.
"Military-grade encryption!" Grading: meaningless marketing. HTTPS already uses comparable encryption standards; the phrase describes nothing unique about the product.
The genuine use cases (yes, they exist)#
- Remote work: connecting to company resources — this was VPNs' original job, done through corporate gateways.
- Securing non-HTTPS traffic and hostile networks — legitimate but increasingly narrow, per above.
- Region-shifting content and services (legality varies by service terms and jurisdiction).
- Avoiding ISP-level throttling or logging in specific situations.
- Comparing location-sensitive results for work (SEO, pricing research).
If none of these describe your week, a paid VPN subscription is currently protecting you mostly from imaginary hackers while your real exposure lives elsewhere.
What actually moves your privacy needle#
Ranked by impact-per-effort:
- Unique passwords + manager — ends credential-stuffing account takeover entirely
- Two-factor authentication everywhere important — survives phished passwords
- Browser content blockers — genuinely reduces tracker load, unlike VPNs
- Update discipline — patches the holes attacks actually exploit
- Phishing resistance — the habit that defeats most real attacks
- Then, if a use case above applies to you: pick a VPN with independent audits and a tested no-logs stance
The pattern across this whole series holds: effective security is boring, specific, and free more often than not — while the exciting branded version of safety tends to be a subscription to something you didn't need.
Related: security fundamentals rank the whole defensive stack, and password managers cover item #1 properly.
