What a VPN does not hide

When a tunnel is up, traffic leaves your device encrypted, travels to an endpoint, and joins the internet from there. Two concrete things follow, and they are worth stating precisely because everything else is often inferred from them incorrectly.

1. Your local network — the café, the hotel, the campus, your ISP — sees an encrypted connection to one address instead of your individual destinations. It can still see how much traffic there is and when.
2. The sites you visit see the endpoint's address rather than yours, which changes what they can infer about your location and which network you are on.

That is the complete list of what the tunnel itself provides. Everything beyond it depends on other things being true.

Anonymity means an observer cannot tell that two actions were taken by the same person. A tunnel does not provide that, and several things defeat it at once.

• Accounts. Signing in identifies you by name. No amount of address-hiding changes that, and the great majority of everyday browsing is signed in.
• Cookies and local storage. These persist across a tunnel being switched on and off, and they link the sessions on either side of the change.
• Browser fingerprinting. Screen dimensions, fonts, time zone, language settings, graphics behaviour and dozens of smaller signals combine into an identifier that is frequently unique and has nothing to do with your address.
• Timing correlation. An observer who can see both ends of a tunnel can match traffic by volume and timing without decrypting anything.
• Your own behaviour. Visiting the same handful of accounts and sites in the same order is itself distinctive.

Tools built specifically for anonymity make quite different trade-offs — multiple relays so that no single operator knows both ends, a uniform browser configuration so that fingerprints collapse together, and a significant cost in speed and convenience. A VPN makes none of those trade-offs, which is why it is fast and why it is not anonymity.

Even when a tunnel is working, traffic can take another route without any obvious sign. These are the common cases, and each has a check.

DNS outside the tunnel

Name lookups sent to the local network's resolver rather than through the tunnel. The contents of your traffic stay protected, but the list of names you looked up does not. Check by comparing which resolver answers while the tunnel is up.

IPv6 leaving directly

A tunnel that carries IPv4 while the device also has working IPv6 will send IPv6 traffic straight out. A client should either carry IPv6 as well or disable it for the duration.

WebRTC

A browser feature for real-time communication that can reveal local and sometimes public addresses to a page directly, independently of how the page was loaded.

Traffic before the tunnel is up

Anything sent between the network connecting and the tunnel establishing goes out in the clear. Background sync on a laptop waking from sleep is the usual culprit; a kill switch is the mitigation.

Applications that bypass the system route

Some software binds to a specific interface or uses its own network stack, and will not follow the tunnel. Split-tunnelling configurations do this deliberately, and it is easy to forget what was excluded.

Setting the overstatements aside, the genuine benefits are worth having and worth stating plainly.

• On an untrusted local network, the operator of that network stops being able to see which sites you use. This is a real and immediate improvement.
• The sites you visit stop learning your network location from your address, which limits one common input to profiling.
• Where a network filters by destination, traffic that resembles ordinary permitted traffic can continue to work.
• Your ISP stops holding a per-destination record of your browsing, which matters a great deal in jurisdictions where such records are retained by law.

What it will not do is make you anonymous, protect a compromised device, hide your identity from services you sign in to, or defeat a network that permits only an explicit list of destinations. A provider whose marketing implies otherwise is telling you something about the provider.