You were not quite lied to. The ads are everywhere — on videos, in podcasts, between search results. The script is well-rehearsed: a café, an airport, a hotel, a hacker at the next table, and a button to lock everything down. The fear is plausible, the action reassuring, and “hide my IP address” sounds like taking back control. Nobody is naive for believing it. The confusion comes from the word itself.

Let us look at what a VPN actually does. It opens an encrypted tunnel between your device and a server, then exits onto the internet using that server’s address. Two concrete effects. Your local network and your internet provider no longer see which sites you visit — only that you are talking to that server. And the sites you visit see the server’s address instead of yours. That is useful, it is real, and it stops there.

What the Sales Pitch Adds

A VPN does not make you anonymous. Sites recognise you by your accounts, your cookies, and your browser fingerprint — that signature made up of your fonts, your time zone, your screen size, often unique. Logged into your account, you remain yourself, tunnel or not. The real anonymity tool is called Tor, and it operates in an entirely different category, with its own slowness and constraints.

On public network security, the argument has aged. Almost all of the web now runs over HTTPS, end-to-end encrypted, and the person at the next café table has little left to intercept. The VPN protects what remained visible — the list of sites, not the content, which is already covered without it.

The Real Issue: You Shift, Not Remove

A VPN does not lift a dependency — it shifts it. Without one, your internet provider sees your requests. It is an identified company, in your country, subject to your law. With one, that role passes to the company running the service. Often based elsewhere, under a different jurisdiction, with opaque governance, and a promise to retain nothing. That promise — the “no-log” policy — is rarely verified. In 2025, of around thirty services tested, only about ten passed an independent audit. The rest ask to be taken at their word. You have not gained control. You have changed your witness, and you know less about the new one than the old one.

The worst case is free. Running servers is expensive. When the service charges nothing, the model pays itself another way — and several free VPNs have been caught reselling their users’ bandwidth or data. The rest is shelf vocabulary. “Military-grade encryption” refers to a public standard that everyone uses. “Thousands of servers” are sometimes virtual machines stacked on the same rack. The language sounds serious and says nothing.

Neither Gadget Nor Shield

To be clear: a VPN has genuine uses. Bypassing a geographic block, circumventing censorship, connecting to a corporate network remotely, shielding yourself from a network you do not control. These are clean tasks, and it performs them well. The tool does its job. It is the promise attached to it that misleads.

The sovereignty of your data is not decided in a tunnel. It is decided in what you hand over, to whom, and under which law — territory we have already covered on the subject of legal sovereignty. A VPN shifts a thin thread of metadata from one actor to another. It does not touch what you feed your applications yourself, nor the law that may one day demand that data. Believing you take back control by renting a tunnel is confusing the curtain with the room.

Sources