The VPN industry is built on fear. Here’s an honest threat model.
VPN companies spend enormous amounts on marketing that implies you’ll be hacked without one. The reality: VPNs solve specific, real problems — but not the ones most people think.
What a VPN Actually Does
A VPN encrypts your internet traffic between your device and the VPN server, then routes it to the destination. The effect: your ISP (Comcast, Verizon, AT&T) cannot see which sites you visit or what you download. Websites see the VPN’s IP address instead of yours.
That’s it. A VPN does not make you anonymous, protect against malware, secure your accounts, or prevent data brokers from collecting your information through other means (device fingerprinting, tracking pixels, logged-in accounts).
When a VPN Is Genuinely Useful
Public WiFi: Connecting to hotel, airport, or coffee shop networks exposes your traffic to anyone on the same network. A VPN on public WiFi provides real protection against passive eavesdropping.
Bypassing geographic restrictions: Accessing content libraries, avoiding regional price discrimination, or circumventing censorship (relevant for travelers to restrictive countries).
ISP snooping: Some ISPs sell browsing data to advertisers. A VPN prevents this — though so does using DNS-over-HTTPS, which is free and built into modern browsers.
Torrenting: Hiding your IP from copyright enforcement agencies. Not endorsing piracy, just stating a fact about why people use them.
The Best VPNs That Don’t Log Your Data
Mullvad ($5/month, accepts cash and cryptocurrency, no email required) is the gold standard for privacy. No accounts, no logs, audited independently. ProtonVPN ($4–10/month) is strong for privacy-conscious users who want a company they can audit — Proton is a Swiss nonprofit with a track record.
NordVPN and ExpressVPN are fine for streaming and basic privacy, but their ownership (Tesonet and Kape Technologies respectively) gives serious privacy advocates pause. Avoid free VPNs — they monetize your data.
What a VPN Won’t Save You From
Phishing attacks, malware downloads, Google tracking you through your Gmail account, Facebook tracking you across the web, or data breaches at companies that have your information. These threats require different solutions: password managers, 2FA, and being careful what you click.
- Best for privacy: Mullvad ($5/month)
- Best balance of privacy + features: ProtonVPN
- Best for streaming: NordVPN, ExpressVPN
- Free alternative for ISP snooping: DNS-over-HTTPS in Firefox
- Skip: Any free VPN
The Technical Reality: What a VPN Actually Does
A VPN creates an encrypted tunnel between your device and a server operated by the VPN provider. All your traffic routes through that server, which means: (1) your ISP can see you’re connected to a VPN but can’t see the content of your traffic; (2) websites see the VPN server’s IP address instead of your home IP address; (3) anyone on the same network as you (hotel WiFi, coffee shop) can’t intercept your traffic in readable form.
That’s a meaningful set of protections in specific scenarios. It is not anonymity. It is not protection from all surveillance. It is not a substitute for HTTPS (which most sites already use). Understanding what you’re actually buying helps you evaluate whether it’s worth paying for.
Where VPNs Matter Most in 2026
Public WiFi is the primary use case. If you regularly work from coffee shops, airports, hotels, or coworking spaces, a VPN prevents passive traffic interception on those networks. Hotel networks in particular are notorious for poor security — some run outdated firmware that makes man-in-the-middle attacks trivial. A VPN on any network you don’t control is a reasonable precaution.
Geographic content access is the second real use case. Streaming libraries differ by country — a VPN lets you access content available in the UK, Canada, or other markets not available in your region. This is technically against most streaming services’ terms of service, though enforcement is inconsistent.
Evaluating VPN Providers: What to Look For
The most important factor in a VPN provider is their logging policy — specifically, a verified no-logs policy that’s been audited by an independent third party. Providers claiming “no logs” without independent verification can’t be trusted on that claim. Mullvad, ProtonVPN, and ExpressVPN have all undergone third-party audits. NordVPN had a server breach in 2018 but has since completed multiple audits — track record matters.
Speed matters more than most reviews acknowledge. A VPN that drops your connection speed by 60% is genuinely unusable for video calls or large file transfers. Look for providers with servers near your location and check independent speed-test data (not the provider’s own benchmarks).
Jurisdiction matters if you’re concerned about government data requests. Providers based in Switzerland (ProtonVPN), Sweden (Mullvad), or Panama (NordVPN) operate under different legal frameworks than U.S.-based providers, who can be compelled to produce data under certain court orders.
Common Mistakes VPN Users Make
Assuming a VPN makes you anonymous is the most dangerous mistake. VPNs mask your IP address but don’t prevent tracking via browser fingerprinting, cookies, or account logins. If you log into Google while connected to a VPN, Google still knows who you are. Advertisers still build profiles based on your behavior. A VPN is one layer of privacy protection, not a comprehensive solution.
Using a free VPN is often worse than using no VPN. Several popular free VPN apps have been caught logging and selling user data — the very thing users install VPNs to prevent. If the product is free, your data is almost certainly the product. The legitimate free tier of ProtonVPN is an exception; it’s operated by the same privacy-focused organization as ProtonMail.
The Bottom Line: When You Need One, When You Don’t
If you only use the internet at home on a network you control, on devices with up-to-date security, you get limited benefit from a VPN. If you frequently use public networks, travel internationally, or are particularly concerned about ISP-level data collection (which is legal in the U.S. after the 2017 repeal of FCC privacy rules), a VPN is worth the $4–$10/month. Don’t buy a VPN because it sounds like something a tech-savvy person would do — buy it because you’ve identified a specific scenario where it protects you.
Setting Up a VPN Without Compromising Everything Else
A VPN that slows your connection by 40% isn’t useful for daily work. Test connection speed before committing to any paid plan — most legitimate VPN providers offer a 30-day money-back guarantee. Connect to a server in your country or the nearest geographic location; server distance is the primary determinant of speed penalty. Split tunneling, offered by most premium VPNs, lets you route only specific apps through the VPN while everything else uses your regular connection — keeping the speed penalty on traffic that actually needs the protection.
