What does a VPN hide? Full breakdown of what’s protected and what’s not

You may already know that a VPN hides your IP address, but did you know that it hides much more than that, too? Thanks to VPN encryption, your online activities are hidden from your internet service provider (ISP), Wi-Fi network admins, and other third parties.

However, while a VPN gives you greater online privacy and freedom, it can’t protect you against every online danger. This is why a good VPN should be combined with other privacy and security tools and practices.

In this article, we’ll describe exactly what a VPN hides, what it doesn’t, and how to combine a trustworthy VPN with other measures to help you stay more secure online.

What does a VPN actually hide?

Whenever you connect to a trustworthy VPN server, you can rest assured that the following details are hidden from your ISP, public Wi-Fi admins, and snoops.

Your IP address

Your ISP assigns you a unique IP address when you connect to the internet. This allows apps and websites to identify you and serve you personalized content. However, these services can also share your IP address and activity with trackers and data brokers, who then follow you around the internet.

But if you connect to a VPN server, you get assigned a new IP address, meaning you can hide your real IP address from online trackers and monitors. They just see the IP address of a VPN server, which can’t be used to identify you.

Your location

Your IP address contains location identifiers that can reveal your country, state, city, and even your neighborhood. Thankfully, connecting to a VPN server disguises your location, making it seem like you’re in the same location as the server you’ve chosen.

For example, if you’re in the U.S. and you connect to a Canada server location, websites and apps you interact with will think you’re in Canada.

ExpressVPN allows you to choose from VPN servers in 105 countries, so you can switch your virtual address to pretty much whichever location you like.

What websites you visit

Your ISP, web trackers, and public Wi-Fi admins can all follow you around the web to varying extents. But once you connect to a VPN, that becomes much harder.

This is because VPNs route your traffic through an encrypted tunnel, leaving third parties with no useful information about your browsing activity. The encryption process means that all they will see is unreadable ciphertext; your browsing history remains hidden.

ExpressVPN uses 256-bit AES encryption, which is trusted by security experts worldwide to protect sensitive information.

What you search

Want to use search engines without advertisers, marketers, or your ISP logging your activity? Using a VPN can help by encrypting your internet traffic and masking your real IP address. This prevents your ISP from seeing what you search for and makes it harder for third parties to link your searches directly to you.

However, it's important to know that a VPN doesn’t make you completely anonymous. For example, if you're logged into a search engine account (like Google), your searches can still be tied to your profile.

Also, cookies and trackers already stored in your browser can continue to monitor your activity, even when you're connected to a VPN. That’s why it’s a good idea to regularly clear your cookies and to combine a VPN with a privacy-focused search engine.

Your streaming and gaming activity

Some ISPs use activity-based throttling to slow your internet connection if you stream or play games at certain hours of the day. Connecting to a VPN means your internet provider no longer sees what you’re doing online and therefore can’t use this data to throttle your speeds.

To be clear, your ISP will still see that you’re using a large volume of data; it just won’t know what for. In other words, connecting to a VPN server will protect you from content-based throttling but not volume-based throttling.

Your data (from cybercriminals)

When you connect to public Wi-Fi hotspots without a VPN, you’re relying on whatever security is provided by the Wi-Fi operator. If this security is weak, cybercriminals could easily manipulate your traffic and redirect you to phishing sites or read your unencrypted data in transit.

However, VPNs encrypt your internet connection, meaning your traffic is safe from tampering and manipulation. That’s why it’s always a good idea to connect to a VPN before doing any browsing on public Wi-Fi networks.

ExpressVPN also offers Advanced Protection, which shields against phishing attacks, malicious websites, and ad tracking.

Itself (via obfuscation)

Did you know that some VPNs (like ExpressVPN) can also hide the fact that you’re using a VPN? This technique, called obfuscation, makes your VPN traffic appear as regular (non-VPN) traffic. ExpressVPN supports obfuscation on all servers.

What does a VPN hide from your ISP?

Your ISP assigns you an IP address and, as the name implies, provides your internet service.

By default, your online data is designed to pass through your ISP’s systems whenever you use internet-based services. That means it has a front-row seat to your online activities.

Fortunately, a VPN helps you hide sensitive details of your online activity from your ISP, such as:

• The websites you visit.
• How long you spend on each website.
• The content you download online.
• Your gaming and streaming activity.
• People you communicate with online.
• Files you share on the internet.
• …and more.

What a VPN doesn’t hide (and why that matters)

Your account logins and online profiles

If you’re logged into an online service or profile, the service provider can see your account activity even over a VPN. For instance, Google can associate your search history with your logged-in Google account, even if you searched over a VPN.

Similarly, a VPN won’t hide your online profiles, such as your social media accounts. For example, logging into your Facebook account while connected to a VPN server doesn’t hide your new posts from Facebook itself or from anyone who can see your updates.

That’s why you should always remember to follow good online privacy practices when using social and online services, even while connected to a VPN.

Cookies and tracking scripts

Internet cookies are small data files stored in your browser that help enhance your online experience. They remember your preferences on websites, personalize content, and can even improve your security in cases like authentication cookies that keep you logged in securely.

However, some cookies can compromise your privacy. They follow you across websites, build a profile of your online behavior, and share data with advertisers or other third parties.

Unfortunately, a VPN can’t protect you from cookies already stored in your browser, as they may continue tracking you over a VPN connection. That’s why you should regularly clear your browser cookies. This means you’ll have to occasionally re-enter your logins and preferences on some websites, but the extra layer of privacy and security is worth the tradeoff.

Beyond cookies, many websites use tracking scripts, which can log your clicks, time spent on a page, device details, and more. Unlike cookies, tracking scripts operate in real-time and are harder to detect or block. Tools like ExpressVPN’s Threat Manager help by preventing apps and websites from communicating with third-party domains known to track user activity.

Device information

Most widely used web browsers send something called a “user agent” to the websites you visit. This user agent string contains information about your device, including the type, operating system, browser, and browser version. Some of this data is used to serve web pages and services correctly (mobile vs. desktop pages, for example) and for website analytics.

While this data is generally harmless on its own, it can be combined with other information, like screen resolution, time zone, and installed fonts, to create a unique browser fingerprint. This fingerprint can be used to track your activity across the web, even without cookies.

Unfortunately, a VPN doesn’t hide or alter your user agent. It encrypts your traffic and masks your IP address, but your browser still sends identifying data like the user agent to every site you visit. To reduce tracking, consider using privacy-focused browsers that block fingerprinting and allow you to limit this kind of data.

VPN logs (depending on provider)

Some VPN providers log your internet activities while you’re connected to their server. The good news is that ExpressVPN has a strict no-logs policy to ensure you never have to worry about this kind of information collection. KPMG has audited ExpressVPN’s no-logs policy multiple times and confirmed its validity.

However, some providers don’t offer no-logs policies, and as such, they might log:

• The websites you visit.
• How long you stay on each website.
• Files you download.
• Your gaming or streaming activity.

Payment and billing info

Making online payments over a VPN doesn’t hide your payment details from the payment processor. Your financial information still goes to the payment provider and is linked to your identity through your bank or credit card company. So even when using a VPN, your transaction can be traced back to you. That said, some VPNs, including ExpressVPN, let you pay with cryptocurrency, so your payment and billing details stay private.

If you’re shopping over a public Wi-Fi network, a VPN adds an important layer of security by encrypting your internet traffic, preventing malicious actors on the same network from intercepting your payment or personal data. While the VPN doesn't make your payment anonymous, it reduces the risk of data theft in less secure environments.

Data consumption

Your ISP can still see how much data you’ve used on its network, even if you’re connected to a VPN. In other words, a VPN won’t help you circumvent data costs or usage limits.

Information you submit online

Any information you enter into websites can be collected and seen by the site administrators, regardless of whether you’re connected to a VPN.

Again, it’s crucial to remember that a VPN encrypts the connection over which you submit such information, but it doesn’t encrypt the information that you willingly enter into sites.

Who can still see what you do online?

You know what a VPN can and can’t hide now, so who can still see your online activity? Let’s find out.

Can your ISP track you with a VPN?

Your ISP can no longer track your online activities with a VPN enabled. It’ll only be able to see that you’re connected to a VPN and how much data you’re using, but it won’t see anything you do online while the VPN connection is active.

Can websites track you with a VPN?

Even while connected to a VPN, websites can still track you using cookies and other browser-based technologies like browser fingerprinting and tracking pixels.

A VPN hides your real IP address and replaces it with the IP of the VPN server, so websites won’t be able to identify your location. However, a VPN can’t block many common tracking methods that rely on your browser rather than your network. These include:

• Device information tracking, including device type, screen resolution, etc.
• Browser type and version identification through user agent strings and feature detection
• Cookie-based tracking, especially if tracking cookies were already stored in your browser before connecting to the VPN.

Can your employer or school monitor you?

Using a VPN doesn’t guarantee full privacy from your employer or school, especially if you're using a device or network they control. If you’re connected to their Wi-Fi network, they may still see that you're connected to a VPN, and they can often monitor when and how long you're connected.

And if you’re using a work-issued or school-managed device, they may have monitoring software installed that can track your activity even if you're using a VPN.

That said, if you're on your own device and using a personal VPN on a personal network (like your home Wi-Fi), your employer or school will typically not be able to see what you’re doing inside the encrypted VPN tunnel.

Can law enforcement track VPN users?

Law enforcement can only access data from VPN users if the VPN provider itself collects user logs. If that’s the case, law enforcement may be able to request and obtain that data from the VPN provider.

This is why using a no-logs VPN is essential. For example, ExpressVPN’s no-logs policy means there’s nothing to share.

How to maximize your online privacy

Use private browsers and search engines

Private browsers don’t collect as much personally identifying data as most mainstream browsers do. The best ones will block trackers, prevent fingerprinting, and ensure secure browsing.

If you’d like to continue using a mainstream browser, though, you can tweak the browser’s settings to modify the kind of information it collects about your online activities. For example, you can set Firefox to block malicious content, downloads, and known trackers; prevent behavioral-based tracking; and tell websites not to share or sell your data.

Combine these measures with privacy-focused search engines like DuckDuckGo to limit how much of your information is collected by search engines as well.

Enable tracker and ad blockers

Online trackers and ads may follow you around the web to gather info on your online habits and send you more targeted ads. Thankfully, privacy-focused VPNs like ExpressVPN come with built-in tracker and ad blockers.

ExpressVPN Threat Manager prevents apps you use and websites you visit from communicating with third-party servers known for tracking and other malicious behavior, and the ad blocker also reduces your exposure to ads.

Clear cookies and cache regularly

Your browser cache and cookies are essential for convenience: they help remember your website preferences (language, fonts, etc.), authenticate your logins, and customize your preferences (playback speed, page configuration, etc.).

However, while cookies are typically safe, they can also be used by websites and advertisers to track your behavior for analytics and ad targeting. And in some cases, cybercriminals can exploit browser vulnerabilities to steal cookies and potentially access your accounts.

That’s why it’s a good idea to regularly clear your cache and cookies, especially if you're concerned about privacy or browser performance. Doing so can also help resolve loading issues and reduce data buildup over time.

Combine VPN with antivirus and firewall

A VPN isn’t designed to protect you against malware in the same way as dedicated anti-malware software. A reliable antivirus app can scan your device for existing malware, remove it, and keep your device safe against future malware threats.

A good firewall is another security must-have. Firewalls inspect incoming and outgoing data on your device to prevent malicious programs and threat actors from accessing your network.

ExpressVPN’s Threat Manager tool offers some anti-malware protection. While it won’t scan your device for malware and delete it like an antivirus can, it will prevent you from accessing malicious websites that may install malware on your device.

Use encrypted messaging and email

Encrypted messaging apps make it impossible for threat actors to hijack your communications in a man-in-the-middle attack, for example. That’s why I recommend using them, even for day-to-day communication with family and friends.

Use a password manager

A password manager lets you generate, store, sync, and auto-fill unlimited unique passwords. This means you don’t have to remember your passwords, which helps you avoid using weak ones or reusing passwords across your accounts. The ExpressVPN Keys password manager is included with all ExpressVPN subscriptions.

Protect accounts with 2FA/MFA

Multi-factor authentication (MFA) adds an extra layer of protection to your accounts by requiring additional proof of your identity before logging in. This ensures continued protection for your online accounts even if a password is compromised.

Many online services now support multi-factor authentication, including SMS and authenticator app-based options. ExpressVPN Keys lets you generate 2FA codes for eligible accounts.

Monitor the dark web for data leaks

Cybercriminals dump and sell personal data (including Social Security numbers, financial information, medical information, account logins, and more) on the dark web. This often occurs after a data breach.

That’s why you need to regularly monitor the dark web for your personal data. That way, you can act fast to change stolen credentials if you get alerted to a leak.

ExpressVPN offers dark web monitoring as part of the Identity Defender suite (U.S. only). It also offers a Data Removal service that scans data brokers and people search sites for your data, then sends deletion or opt-out requests on your behalf.

How to choose a trustworthy VPN

Look for a strict no-logs policy

Don’t just look for a VPN that claims it doesn’t collect user data. Instead, choose one that’s been audited for these claims by reliable and independent third-party sources.

ExpressVPN’s no-logs policy has been independently audited and confirmed multiple times. On top of that, ExpressVPN uses industry-leading TrustedServer technology, ensuring your data is never written to a hard drive. Instead, it’s written to RAM-only disks that don’t log your data and get wiped on every server reboot.

Review independent security audits

As mentioned above, look at the independent security audits a VPN has had, what was audited, and who conducted the audits. These audits help confirm that the VPN provider sticks to the privacy, security, and logging claims it makes.

ExpressVPN has passed audits from large cybersecurity and accounting companies like KPMG, PwC, Cure53, F-Secure, and Praetorian. These audits span the privacy policy, the performance of our proprietary protocol (Lightway), and the security of the mobile and PC apps, among other features.

You can get more information about all of ExpressVPN's most recent audits by visiting our Trust and Privacy Center.

Avoid free VPNs that sell your data

When something is free, you might be the product. That’s the case when it comes to some free VPN providers, which might collect data on your internet activities and sell it to advertisers. While not all free VPNs do this, even the ones that don’t often come with severe data limits, server limitations, and other restrictions.

That’s why it’s smart to invest in a quality VPN like ExpressVPN, which offers a verified no-logs policy, unlimited bandwidth, and servers in 105 countries.

Research reputation, ownership, and jurisdiction

You should check that a VPN provider is owned by a legitimate company, research its online reputation, and confirm where it’s based. VPNs owned by legitimate companies are less likely to engage in underhanded tactics like data collection and selling.

Likewise, it’s best to choose a VPN located in a privacy-friendly region, especially one that doesn’t mandate explicit user data collection and retention. ExpressVPN is based in the British Virgin Islands, a privacy-friendly jurisdiction without any data retention laws.

Finally, user reviews offer valuable insights, so it’s a good idea to visit trusted and independent review websites to check real user assessments.

Check for transparency reports and privacy commitments

ExpressVPN publishes a biannual report to show how many user data requests it receives, from whom, and how it responds to them. It gets most user data requests from the government but doesn’t honor them because it doesn’t keep logs and therefore has no data to share.