VPN and Privacy Protection: What a VPN Hides and What It Doesn't

The word "privacy" pops up in VPN ads more than any other. "Complete anonymity," "no one will know what you do," "protection from any kind of surveillance." The reality is more modest. A VPN is one tool in a privacy toolkit, and understanding its limits matters more than believing the marketing.

Let's break it down step by step: what a VPN protects you from, what it doesn't, and what else you need for serious privacy.

What "online privacy" means

Before judging a VPN, you need to understand who you want privacy from. The possible "adversaries," in order of how often people ask about them:

• Your internet provider. It sees every request you make, keeps logs, and in many countries is required by law to store them.
• The websites you visit. They see your IP, your browser fingerprint and your habits, and use all of it for advertising.
• Ad networks. They track you across sites using cookies and trackers.
• Social networks and big platforms. They know everything you've told them yourself, plus a lot you haven't.
• The government. Surveillance capabilities vary from country to country, from minimal to extensive.
• Specific bad actors. Hackers, exes, people with a grudge — narrow scenarios involving targeted surveillance.

A VPN solves a different part of the problem for each of them.

What a VPN protects you from well

From your internet provider

This is the biggest advantage of a VPN. Without a VPN, your provider sees every site you open, the time and length of each visit, and your total traffic volume. With a VPN, all the provider sees is: "you connected to VPN server X at such-and-such a time and transferred Y gigabytes." Specific sites, search queries and the apps you open are invisible.

From "incidental" observers on the network

The café's Wi-Fi operator, the hotel owner, the IT department at the office, a government filter — these are all "incidental" observers along your traffic's path. A VPN fully protects you from them.

From basic profiling by websites

A site you open without logging in sees your IP — but it's the VPN's IP, not your real one. This makes it harder to link what you do in one browser with what you do in another by IP, and harder to pinpoint your location.

What a VPN protects you from poorly or not at all

From sites you're logged in to

If you're logged in to Google, Facebook or Amazon, they know it's you. Your IP changed? Doesn't matter — you have an account. From there, the usual profiling kicks in.

From ad trackers

These days, ad networks identify users mainly through cookies and browser fingerprinting. A VPN changes neither. To protect yourself from trackers, you need dedicated browsers (Brave, or Firefox with the right settings) or extensions (uBlock Origin, Privacy Badger).

From social networks

A social network knows everything you do on it and everything you've voluntarily told it. A VPN doesn't hide your profile from your own account.

From serious targeted attacks by a government

If you're not an ordinary user but a specific target of intelligence services, a VPN helps, but it doesn't solve the problem. Some countries have the capability to de-anonymize people comprehensively even through a VPN: traffic analysis, legal requests to the VPN provider itself (which is why jurisdiction matters), and physical access to devices.

What "privacy" actually means for you

Ask yourself: who are you hiding from? Different answers call for different practices:

• "I don't want my provider to see what I'm doing." A VPN — yes, that's enough.
• "I don't want ads following me around." A browser with tracking protection. A VPN is secondary here.
• "I want social networks not to know who I am." Create accounts under a pseudonym and don't give your real details. A VPN is just a thin layer on top.
• "I'm worried the government can see what I search for." It depends on the country. In most cases, a VPN with a no-logs policy and a jurisdiction outside your country is enough.
• "I want anonymity because I'm doing something specific." A VPN isn't the right tool. You need Tor + an isolated device + a clean OS, or specialized approaches.

Layers of privacy that work together

Real privacy is built from a stack of tools:

1. A VPN with a no-logs policy. The bottom layer — protecting the connection.
2. A browser with tracking protection. Brave, Firefox with the right settings, or Chrome + uBlock Origin + Privacy Badger.
3. A search engine that doesn't track you. DuckDuckGo, Brave Search, Kagi.
4. Separate accounts. Don't use one Google account for everything — it ties together your work, your personal life and your searches.
5. 2FA everywhere. A leaked password without 2FA = a compromised account. With 2FA, it doesn't.
6. Data minimization. Don't give sites more than they need. Don't provide your real age, phone number or birthday unless you have to.

A VPN is the foundation; the rest are the walls and the roof.

The VPN provider's jurisdiction

This is one of the most important factors when choosing a VPN specifically for privacy. The country where the company is registered determines:

• Which laws require it to keep logs.
• Who can legally demand user data from it.
• What happens if it receives a request from a government.

Good jurisdictions for a VPN are outside the "14 Eyes": Panama, Switzerland, the British Virgin Islands, Iceland. More on this in our guide on how to choose a VPN.

"No-logs" — what it means in practice

The claim "we don't keep logs" can be interpreted in different ways. Serious providers spell it out:

• They don't keep activity logs: sites, IPs, session timestamps. This is critical.
• They don't keep connection logs: the user's original IP at the time of connection. Also critical.
• They keep the bare minimum for billing: the mere fact of an active subscription and a payment. That's normal — the service can't work without it.

The best proof of a no-logs policy is an independent audit, not an unsupported promise. So when choosing a service, check whether it publishes the results of such a review and what exactly was examined.

RAM-only servers — a serious technical bonus

This takes the no-logs idea further. The servers run entirely from RAM, without writing anything to disk. When a server reboots, all memory is wiped. This means that even if a server is physically seized (by the police, competitors or hackers), there's no way to pull activity history from it — it simply isn't there.

It's technically more expensive than a conventional setup, but for privacy it's the standard of a "high-quality" service. Ask the provider how its servers are set up.

The bottom line

A VPN is a real and effective privacy tool, but within its niche: protecting your connection and hiding your activity from your provider. It isn't enough for complete privacy — for that you also need a browser with tracking protection, data minimization and a mindful approach to your accounts. But as the first, foundational layer of protection, a VPN is irreplaceable.

You can try VolnaLink with its no-logs policy free for 8 hours, no card required.

Further reading

• Is a VPN safe?
• How to choose a VPN
• Free vs. paid VPN