A VPN makes you completely anonymous
VPNs encrypt internet traffic between a device and the VPN provider's server and mask the user's IP address from websites visited, but they do not make a user fully anonymous online, since the VPN provider itself can typically see the user's real traffic, and login-based tracking and browser fingerprinting still function normally.
What we know
Virtual private networks, or VPNs, route a user's internet traffic through an encrypted tunnel to a server operated by the VPN provider before it reaches its final destination, which has two main practical effects: it hides the browsing traffic's content from anyone observing the local network, such as on public Wi-Fi, and it masks the user's real IP address from the websites they visit, showing the VPN server's IP address instead. These are genuine and useful privacy benefits, but they fall well short of the complete anonymity that VPN marketing sometimes implies.
The most significant limitation is that the VPN provider itself sits in the position previously occupied by the user's internet service provider, meaning the VPN company can, in principle, see the same browsing traffic and destination information that an ISP could see without a VPN, unless the provider maintains and enforces a genuine no-logs policy. Several VPN providers have faced scrutiny over logging claims; a notable case involved PureVPN, which advertised a strict no-logs policy but was found in 2017 to have provided connection logs to the FBI that helped identify a criminal suspect, according to court documents reviewed by multiple technology news outlets, illustrating that a marketing claim of no-logs status is not always independently verified or legally binding. Some VPN providers have since undergone independent third-party audits of their logging practices to substantiate these claims more credibly, though the quality and scope of these audits vary.
A VPN also does nothing to prevent tracking that occurs after a user logs into an account. If a user logs into Google, Facebook, or any other service while connected to a VPN, that service can still associate the session with the user's actual identity through the account login itself, entirely independent of the IP address masking a VPN provides. Browser fingerprinting techniques, which identify a device through characteristics like screen size, installed fonts, and browser configuration rather than IP address, also continue to function normally regardless of VPN use, since fingerprinting does not rely on IP address as its primary identifying signal.
VPNs are also legally required in some jurisdictions to retain certain user data or connection logs under local data retention laws, meaning the jurisdiction where a VPN company is legally based can materially affect how much genuine anonymity the service can offer, a factor privacy researchers and organizations such as the Electronic Frontier Foundation recommend considering when evaluating a VPN provider's actual privacy protections rather than relying solely on marketing claims.
VPNs remain a legitimate and useful tool for specific purposes: encrypting traffic on untrusted networks such as public Wi-Fi, masking a general location from websites for privacy or to access geographically restricted content, and adding a layer of protection against ISP-level traffic monitoring. They are not, however, a complete anonymity solution, and users seeking stronger anonymity typically combine a reputable, audited VPN or the Tor network with additional practices such as avoiding logged-in account use and minimizing identifying information shared with visited websites.
Common claims
- A VPN makes you completely anonymous onlineFalse. VPNs mask your IP and encrypt traffic but cannot prevent tracking via cookies, fingerprinting, or logged-in accounts.
- VPN providers never log your activityMixed. Many providers claim no-log policies, but some have been found to retain logs or comply with law enforcement.
- A VPN is useful for privacyTrue in limited ways. It prevents ISP surveillance and hides your IP, providing meaningful but incomplete privacy.