Privacy vs Security: A Real Distinction
Security means protection against unauthorized access to your data. Privacy means control over who can see what you do online. A VPN primarily addresses privacy by masking your IP address and encrypting your traffic from your ISP and anyone monitoring the network. It also provides some security benefits, but it is not a security product in the traditional sense.
What a VPN Protects Against
A VPN hides your browsing activity from your ISP, prevents coffee shop eavesdroppers from intercepting your unencrypted traffic, and prevents websites from seeing your real IP address. On public Wi-Fi, a VPN is essential: unsecured networks allow anyone nearby to monitor HTTP traffic and intercept session cookies on sites that do not enforce HTTPS everywhere.
What a VPN Does Not Protect Against
A VPN does not protect you from malware, phishing, or compromised websites. It does not prevent tracking cookies or browser fingerprinting. It does not anonymize you if you log into your Google or Facebook account, because those services know who you are regardless of IP address. And it does not protect against vulnerabilities in the VPN software itself.
The Logging Question
Your VPN provider can see all your traffic. If the provider logs your activity and shares it with authorities or advertisers, you have traded ISP surveillance for VPN provider surveillance. Choose providers with verified no-logs policies, ideally audited by independent security firms. ExpressVPN, Mullvad, and ProtonVPN have all undergone independent audits of their logging practices.