Do You Need a VPN? When It Helps and When It Doesn't

A VPN is a tunnel, not a shield. It carries your internet traffic past the network you are sitting on and hands it to a company’s server, which sends it on from there. That one move explains both what a VPN is good for and why so much of its advertising promises too much.

So, do I need a VPN? For everyday browsing at home, on a network you run yourself, probably not: most web traffic is already encrypted. The Electronic Frontier Foundation’s Surveillance Self-Defense guide, reviewed in July 2026, says advertising vastly oversells VPNs, which are best suited to one thing: routing your connection through a different network.¹ A VPN earns its place on networks you don’t trust, for reaching a home or work network while away, and for keeping your browsing from your internet provider. It adds little against phishing, malware and stolen passwords, which the six habits that protect you most online deal with first.

What a VPN does

A VPN (virtual private network) sends all your web traffic through an encrypted tunnel to the VPN company’s server; from there, traffic goes to its destination and websites see the server’s IP address and location instead of yours. The EFF adds that the tunnel also hides your traffic from your internet provider and from whoever runs the local network, like a café or hotel.¹

The catch is that the traffic has to come out somewhere. The EFF says that whatever a VPN hides from your internet provider is all visible to the VPN provider, which could sell that information just as an internet provider could.¹ Consumer Reports put it the same way: a VPN stops your mobile network and internet provider from seeing the internet domains you visit, but the VPN itself gets that data instead.²

By using a VPN, a user essentially transfers trust from their network provider to the VPN provider.

Say you spend a week in a hotel. Without a VPN, the hotel’s network and its internet provider can see which sites you connect to and when, though not what you read or type on sites that use encryption (the padlock in the address bar). With a VPN, the hotel sees only a stream of scrambled data going to one server. The VPN company, though, now sees the list of sites the hotel no longer can.

So the practical question is “Do I trust this company more than the network I’m on?” At home, on your own broadband, the answer is often no. In a hotel you know nothing about, it may well be yes.

Do I need a VPN? Only for a handful of jobs

A VPN is worth switching on for a handful of specific jobs, not as an always-on default. The EFF names the cases where it helps: a network you don’t trust, run by someone you don’t know; connecting to an office or home network while you are away; and getting around a network that blocks sites. It also hides your browsing from your internet provider.¹

Untrusted networks come first because they are where a stranger could sit between you and the internet. Even there, the EFF says the old advice to always use a VPN on shared networks is less necessary for everyone than it used to be, because most web traffic is now encrypted. What remains visible on an encrypted connection is the metadata: the names of the sites you visit, when, and how much data moves.¹ Whether that matters depends on who you are and where you are. A journalist in a country with heavy surveillance weighs it differently from a tourist checking a train time.

Privacy from your internet provider is the second reason, and for some people the main one. In the US, a 2021 staff report from the Federal Trade Commission, based on orders sent to six large providers, found that many collect and share far more data than customers may expect, including access to all their internet traffic and real-time location data.³ What your own provider may keep or share depends on your country’s privacy law, so check it; the trade, as always, is that the VPN company takes over that view.

Work is the plainest use. The UK’s National Cyber Security Centre (NCSC), in guidance for organizations last reviewed in 2025, describes VPNs as a way for organizations to let remote staff reach internal services securely across untrusted networks, and says an organization with no need for those benefits has no need for one.⁴ If your employer gives you a VPN, use it as instructed, and remember that whoever runs it can see what passes through it.

What a VPN won’t do for you

A VPN does not make you anonymous and does not protect your accounts or devices. The EFF says it is not a tool for anonymity: companies can still follow you through GPS, cookies, tracking pixels and browser fingerprinting.¹ And once you sign in to an account, that service knows who you are, whatever IP address it sees.

It also does nothing about the ways most people get hurt online. Consumer Reports notes that your data can still be compromised through phishing, malware and other methods VPNs can’t address.² A fake bank login page works just as well through a tunnel, and a malicious download installs itself either way. The EFF lists steps it calls more impactful than a VPN in many situations: strong passwords, two-step verification, software updates, device encryption, HTTPS-only mode in your browser and secure messaging apps with end-to-end encryption.¹

Myth

With a VPN on, I am anonymous and safe from attacks.

Fact

A VPN hides your IP address and your traffic from the local network. Cookies, sign-ins, fake login pages and malware work the same with it on.

If you have an hour to spend on your safety online, spend it on the first items of the EFF’s list, strong passwords and two-step verification, before shopping for a VPN.

Why VPN advertising promises more than a VPN delivers

VPN marketing often claims protections the technology cannot give, and independent testing has caught it doing so. Consumer Reports, the US nonprofit product tester, evaluated VPN services in 2021, with comments from researchers on the University of Michigan’s VPNalyzer project.

The study

Limited evidence

Twelve of sixteen VPNs overpromised in a 2021 lab test

Consumer Reports’ Digital Lab tested 16 VPN services on Windows 10 for security leaks and read their privacy policies and marketing. It found that 12 of the 16 either misrepresented their products and technology or made hyperbolic or overly broad claims about the protection they offered, such as complete anonymity or untraceability.²

The headline finding was about marketing claims rather than broken encryption, and it is now a few years old. Its lesson has held up: the EFF’s guide, reviewed in 2026, still warns that a VPN claiming the impossible may not be trustworthy in other ways either.¹ Consumer Reports singled out “military-grade encryption” as a phrase that many security professionals treat as a red flag, because no single standard of military encryption exists.²

Treat big promises as a test of honesty. A provider whose website says a VPN will stop criminals, scams and all tracking is telling you something about how it treats facts. One that explains its limits plainly is giving you a reason to trust it with your traffic.

How to choose a VPN provider you can trust

Choose a VPN provider the way you would choose anyone you let see your mail: by how it earns money, what outsiders have checked, and whose laws it answers to. The EFF and Consumer Reports point to the same markers, and none of them is a guarantee on its own.

Start with the business model. The EFF asks how a VPN pays its bills if it doesn’t charge you: some are “freemium”, free up to a data limit, and some are free because they sell your data.¹ A paid plan is no proof of good behavior, but a free one with no visible way of making money deserves a closer look at its privacy policy.

Then look for published, independent security audits. Consumer Reports found that half of the services it tested had no current public third-party audit of their core product, and called audits a sign of trustworthiness rather than proof of no flaws.² The EFF adds the limit that matters: an audit checks the service at one moment, and nothing stops a company from changing its practices afterwards, especially under government pressure.¹

Jurisdiction is the third check. A provider is bound by the laws of the countries where it does business, including laws that let officials demand data, sometimes without telling you. The EFF suggests reading the privacy policy for when the company hands data to governments, looking for a transparency report on such requests, and remembering that a “no logs” claim is a claim, not a guarantee.¹

Finally, check the technology and the exit. The EFF names OpenVPN and WireGuard as the common modern protocols and says data sent over the old PPTP protocol can be easily decrypted by your internet provider or government.¹ Consumer Reports also found services that made cancelling a subscription hard, so read the cancellation terms before you pay.²

Before you trust a VPN provider

• I can see how it makes money, and it is not selling my data
• It has a recent, public audit by an independent security firm
• Its privacy policy says what it logs and when it hands data over
• I know which country it operates from, and it publishes a transparency report
• It uses WireGuard or OpenVPN, not PPTP
• Its marketing does not promise anonymity or total protection
• I have read how to cancel before paying

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

Why a free VPN can cost more than it saves

A free VPN can expose you to more risk than no VPN at all, because the app you install can see and handle all of your traffic. The US Federal Trade Commission’s 2018 tips on VPN apps tell people to research an app before installing it, review the permissions it asks for, check that it encrypts your data, and check whether it shares your information with third parties.⁵

The risks are not hypothetical. A 2016 peer-reviewed study by researchers at Australia’s CSIRO and in the US found 283 free-to-download Android apps on Google Play that used the VPN permission. In network tests on about half of them, roughly one in five used tunnels without encryption despite promising security or anonymity, and many of the apps embedded third-party tracking code.⁶ The study dates from 2016, so today’s app stores may look different; the EFF still warns that a listing in an official app store does not make a VPN safe.¹

The worst case is a VPN that recruits your device. In 2024 the FBI and two other US agencies described a criminal network that spread free, illegitimate VPN apps inside pirated games and software. The apps quietly turned victims’ devices into relays for other people’s crimes, and the agencies counted it among the largest such networks, with more than 19 million compromised IP addresses in over 190 countries. Crimes routed through those relays appeared to come from the victims’ devices.⁷

If you can’t tell who runs it and how it pays for its servers, don’t give it your traffic. A free tier from a provider that also sells a paid plan is a different case from an anonymous app with no business behind it.

Check the law and the service’s terms first

Some countries restrict or ban VPN use, and services you use through one may forbid it. Rules range widely: Russia banned various VPN providers in 2021 and, under a 2017 law, requires VPN services to block sites on a government list; Iran’s Supreme Council of Cyberspace prohibited unlicensed circumvention tools such as VPNs in 2024; and North Korea bans unapproved use of foreign networks outright.⁸ Those examples come from an encyclopedia summary checked in September 2026, and laws change, so treat them as a sign of how far rules differ rather than a current list.

Service terms are the other limit. Netflix’s terms of use, last updated in April 2026, for example say members may watch primarily in the country where they set up their account, and only where Netflix offers its service and has licensed the content; the same terms let Netflix restrict or end the service for anyone who breaks them.⁹ The EFF notes that streaming platforms increasingly block VPN users, so a VPN is no reliable way around regional limits.¹ Read a service’s terms before you try.

The bottom line

A VPN moves who can see your browsing from the network you’re on to the VPN company. Use one when you don’t trust the network, when you need to reach a home or work network, or when you want your internet provider out of your browsing, and only with a provider whose business model, audits and jurisdiction you have checked. For everything else, two-step verification and prompt updates, steps the EFF calls more impactful than a VPN, do more.