--- title: "Your VPN Doesn't Make You Private" author: "Sanju Singh" published: "2026-10-26T03:07:17.388Z" updated: "2026-10-26T03:07:17.388Z" url: "https://zyvop.com/your-vpn-doesn-t-make-you-private-xqj5f" canonical: "https://zyvop.com/your-vpn-doesn-t-make-you-private-xqj5f" tags: ["security","vpn","Tailscale","Networking","privacy"] --- # Your VPN Doesn't Make You Private A VPN changes who can see your traffic and which IP address websites see. It doesn't make you anonymous, and it isn't the privacy tool most ads claim it is. ![Cover image]() Every VPN ad makes the same promise. Click one button and you're private. I don't buy it. I recently built a static IP setup with a VPN and Tailscale, and I found the whole project really interesting. It also got me thinking about what a VPN actually does, and what it doesn't. A VPN is a useful tool. It just isn't a privacy strategy, and treating it like one leaves most people less protected than they think. ## What a VPN actually does Your traffic goes through an encrypted tunnel to the VPN's server, and then out to the internet from there. Websites see the server's IP address instead of yours. Your internet provider sees that you're connected to a VPN, but not which sites you're visiting. That's the whole trick. It's useful, but it's narrow. ## You moved the trust, you didn't remove it Before the VPN, your ISP could see where your traffic was going. After the VPN, the VPN company can. You haven't escaped anyone. You've picked a different party to trust. That's fine if you pick well. The catch is that nearly every provider says it keeps no logs, and you usually can't check. Sometimes the claim gets tested. In 2017, the FBI was investigating a cyberstalking case in Massachusetts and got help from PureVPN. The company advertised that it didn't keep logs that could identify or monitor a user's activity. According to reporting on the FBI's court filing, PureVPN was still able to confirm that the suspect's home IP address had connected to the VPN addresses involved, around the times investigators asked about. The records showed when he connected, not what he did online, but matched against logs from other services, that was enough. Its privacy policy did mention connection logs, a detail the marketing skipped. To be fair, PureVPN has since commissioned independent audits of its no-logs claims, which is the right move. But the case shows how thin a marketing line can be. Now compare that with Mullvad. In April 2023, Swedish police arrived at its Gothenburg office with a search warrant, looking for customer data. According to Mullvad, the officers left without taking anything, because its systems don't hold that kind of data. The point isn't that one brand is good and another is bad. "No logs" is a claim, and what counts is how the service is built, whether outsiders have audited it, and what happened when someone tested it. ## Your IP address was never the main thing Websites don't need your IP address to know who you are. If you're logged in to Google, Amazon or Instagram, they know exactly who you are, whatever address you connect from. Cookies follow you around. On your phone, your advertising ID follows you from app to app. Then there's browser fingerprinting. Your browser quietly shares details like your screen size, fonts, graphics hardware, language and time zone. Put together, they can make your browser look unique among millions of others. A VPN changes none of that. Neither does a private browsing window. You can see your own fingerprint on the EFF's Cover Your Tracks site. Run it with your VPN switched on and look at what comes back. ## Free VPNs are often the worst offenders Running servers around the world costs real money. If an app is free, ask how it pays for itself. Researchers from the University of Michigan, the University of New Mexico and IIT Delhi tested 281 popular free Android VPN apps and presented the results at the NDSS security conference in February 2026. They found that 246 of the apps contacted known advertising or tracking servers, and 76 sent the phone's advertising ID. Twenty-nine leaked traffic outside the encrypted tunnel, including the DNS lookups that reveal which sites you visit. People install a VPN to stop exactly this kind of thing. The Hacker News reported that the flagged apps have been installed more than 2.4 billion times. It isn't a new problem. Researchers at Australia's CSIRO and partner universities looked at 283 Android VPN apps back in 2016 and found that three out of four used third-party tracking libraries. ## The public Wi-Fi argument is weaker than it used to be A lot of VPN marketing still leans on coffee shop Wi-Fi. That made sense when most of the web ran over plain HTTP. It doesn't anymore. Google's Chrome security team says roughly 95 to 99 percent of page loads in Chrome use HTTPS on most platforms. The connection between you and the site is already encrypted, no VPN needed. A VPN still hides which sites you visit from whoever runs the Wi-Fi, so it isn't useless there. It's just not the emergency it was sold as. ## A static IP is the opposite of anonymous This is the part my own project makes obvious. A static IP never changes. If you route your traffic through one, every website sees the same address for you, every time. That's a stable identifier. It's great for things like allowing only your own address to reach a server, or getting back into your home network. It's terrible for blending in. Most commercial VPNs at least put you in a crowd, because many people share the same exit address. A VPN address that only you use takes the crowd away. ## When a VPN does make sense - You want to hide your browsing from your ISP or from a network you don't control. - You need to get around IP-based blocking, censorship or a region lock. - You want a private path to your own things, like a home server or an office network. Tools like Tailscale are built for this, and it's a different job from privacy. - You need a fixed address so you can allowlist yourself somewhere. ## What actually helps - **Decide who you're hiding from.** Your ISP, advertisers, a specific website and a government are different problems, and they need different tools. - **Pick a provider with published independent audits and a real track record.** Skip the one with the biggest ad budget, and be very careful with free apps. - **Use a browser with fingerprinting protection and a tracker blocker.** - **Log out, or use separate browser profiles,** for accounts you don't want tied to everything else you do. - **Turn on HTTPS-only mode** in your browser. ## The bottom line A VPN moves trust around and changes the address websites see. Sometimes that's exactly what you need. But privacy comes from a stack of habits and tools, and a VPN is one small layer of it. The next time an ad says one click makes you private, ask the obvious follow-up: private from whom? * * * ## Sources - Mullvad, "Mullvad VPN was subject to a search warrant. Customer data not compromised" (April 2023): [https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/]() - ProPrivacy, "FBI Solves Case Thanks to PureVPN Lies": [https://proprivacy.com/privacy-news/fbi-solves-case-vpn-lies]() - TechRadar, "Are VPNs safe? Not when you're a cyberstalker": [https://www.techradar.com/news/are-vpn-safe-not-when-youre-a-cyberstalker]() - TechRadar, "PureVPN backs up no log claim with independent audit": [https://www.techradar.com/news/purevpn-backs-up-no-log-claim-with-independent-audit]() - CSIRO and partners, "An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps" (2016): [https://research.csiro.au/isp/wp-content/uploads/sites/106/2016/08/paper-1.pdf]() - NDSS Symposium 2026, "MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs": [https://www.ndss-symposium.org/ndss-paper/mvpnalyzer-an-investigative-framework-for-auditing-the-security-privacy-of-mobile-vpns/]() - The Hacker News, "Study of 281 Free Android VPN Apps" (July 2026): [https://thehackernews.com/2026/07/study-of-281-free-android-vpn-apps.html]() - EFF, Cover Your Tracks: [https://coveryourtracks.eff.org]() - Google Online Security Blog, "HTTPS by default" (October 2025): [https://security.googleblog.com/2025/10]()