The VPN Privacy Myth I Believed Until I Actually Ran the Tests

I ran a VPN on every device for two years on a quiet, unexamined assumption: that it made me invisible online. Not just private — invisible, a step ahead of anyone trying to watch what I did. I never actually tested that belief until the week I logged into Gmail with the VPN switched on and got served the exact same targeted ad I'd seen three days earlier, on a completely different network, with the VPN off. That shouldn't have been possible if the VPN was doing what I thought it was doing. So I stopped assuming and started checking.

I want to be upfront that this isn't an anti-VPN piece. I still run one every day. What changed is that I now know precisely why, instead of carrying around a vague, comforting idea of a privacy shield that follows me everywhere. The gap between those two things turned out to be bigger than I expected.

The test that started it

Once I noticed the Gmail ad, I ran the actual checks instead of guessing. A DNS leak test confirmed my DNS queries were routing through the VPN's own servers rather than leaking out to my ISP, which was genuinely reassuring. A WebRTC leak test on a couple of browser tabs came back clean too. On paper, the VPN was doing exactly what it claimed at the network level: my real IP wasn't visible to the sites I visited, and my ISP couldn't see which domains I was requesting.

None of that explained the ad. So I looked at what actually survives a VPN untouched, and the answer was almost everything that makes tracking work in practice: cookies, browser fingerprinting, and — the big one — being logged into an account. My IP address had changed. I hadn't. Google didn't need my network location to know who I was; it needed my email address, and I'd handed that over the moment I signed in.

What a VPN genuinely does

Stripped of the marketing, a VPN does two specific things well. It encrypts your traffic between your device and the VPN's own server, so anyone sharing your network — the other people on café or airport WiFi, most obviously — can't casually snoop on what you're sending. And it replaces your IP address with the VPN server's, so the sites you visit see that IP instead of your home or mobile connection, and your own internet provider only sees encrypted traffic going to the VPN, not the individual sites behind it.

Both of those are real, useful protections. Neither of them is anonymity, and I'd let the two blur together in my head for two years without ever being forced to separate them.

"I hadn't been lied to by a VPN provider. I'd been lying to myself about what 'private' actually meant."

What it never touched

The honest list of what a VPN doesn't do turned out to be longer than the list of what it does. It doesn't stop cookie-based tracking or fingerprinting, both of which identify your browser regardless of which IP it's connecting from. It doesn't scan downloads for malware, warn you off a phishing site, or fix a password you've reused six times — that protection lives in your browser, your antivirus, and, frankly, in something like a proper password manager, not in an encrypted tunnel. It doesn't stop a company you're logged into from knowing exactly who you are. And a VPN provider that claims never to log your activity is making a promise you have no way to verify unless that claim has been independently audited — most haven't been, which is worth remembering before trusting one with every website you visit.

Free VPNs deserve a specific mention here, because I used one for a year before switching. Running servers costs real money, and a free provider with no subscription income has to make it back somehow — usually by logging your browsing and selling it on, or by quietly injecting its own ads into your traffic. That's precisely the behaviour I'd installed a VPN to get away from, and I'd been paying for it with my data instead of my card.

What I actually changed afterwards

I kept the VPN. What I stopped doing was treating it as the whole job. I started logging out of accounts I didn't need open while researching something sensitive, which sounds obvious written down and genuinely wasn't part of my habit before. I picked a paid provider with a published, independently audited no-logs policy rather than the cheapest option, because "trust us" isn't a privacy policy. And I finally sorted out the weak, reused passwords sitting behind the accounts a VPN was never going to protect anyway — the same fix I wrote about after switching to 1Password, which turned out to matter far more for my actual privacy than which server my traffic bounced through. If you're still deciding which manager to trust with that job, here's how 1Password and Bitwarden actually compare once you've lived in both for a month.

It's the same pattern I found writing about the Screen Time app myth: a tool I'd assumed was doing the whole job on its own, when the real change only showed up once I understood exactly what it did and didn't cover, and did something about the gap myself.

The phone itself was the other half of this I'd been ignoring. A VPN says nothing about who can see your saved locations or your deleted photos if the phone itself is unlocked, which is a separate, more basic exposure — a handful of iPhone settings actually close that gap in about ten minutes.

Is a VPN worth running

Yes — for the two things it's actually built for. If you regularly work from public WiFi, or you'd simply rather your internet provider not see the shape of every site you visit, a decent paid VPN with an audited no-logs policy earns its subscription. But if you're expecting it to make you anonymous, stop malware, or erase the tracking tied to accounts you're logged into all day, it was never going to do that, and no VPN ever will. Know which job you're actually asking it to do, and it stops feeling like it's letting you down.

This one belongs to a small run of the same shape — things I had accepted without checking. Blue light glasses got the same treatment, with a similarly awkward result. If you want the next honest test written up as soon as I've actually lived with it rather than just installed it, join the Brite newsletter.

If the goal is genuinely fewer ways to be got at, the login is where the real gap sits rather than the connection — and the honest comparison of the two options there is passkeys versus a password manager, and which I actually use.

Questions people actually ask

Does a VPN actually make me anonymous online?

No, and this is the single biggest misconception about them. A VPN hides your IP address from the sites you visit and hides your browsing from your internet provider, but the moment you log into Google, Amazon or Facebook with a VPN switched on, that account still knows exactly who you are. Anonymity and encrypted transit are two different things, and a VPN only ever gives you the second one.

Can a VPN stop websites from tracking me with cookies?

No. Cookie-based tracking and browser fingerprinting work independently of your IP address, so a VPN does nothing to stop them. I still saw the same retargeted ads with the VPN on that I'd seen without it, because the tracking was tied to my logged-in account and my browser's fingerprint, not to my network location.

Does a VPN protect me from malware or phishing?

No. A VPN encrypts your connection; it doesn't scan downloads, block malicious sites or stop you clicking a convincing phishing link. That protection comes from your browser, your antivirus and your own judgement, all completely separate from whether a VPN is running.

Are free VPNs actually private?

Treat that claim with real suspicion. Running VPN servers costs money, and a free provider with no subscription revenue often makes it back by logging your browsing and selling it on, or by injecting its own ads — which is the exact behaviour you installed a VPN to avoid. If privacy is the actual goal, a paid provider with an independently audited no-logs policy is worth the subscription.

So what is a VPN actually good for?

Two things, honestly: stopping your internet provider from seeing every domain you visit, and encrypting your traffic on a network you don't control, like café or airport WiFi, so anyone else on that network can't casually snoop on it. Both are genuinely useful. Neither is anonymity, and I'd stopped being clear with myself about the difference.