Network privacy
Does a VPN make you private?
A VPN can hide your public IP from websites and protect covered traffic from your local network. Your accounts, cookies, and browser fingerprint can still connect your visits.
The destination sees a different public IP.
Websites can read signals and recognize sign-ins.
How VPN privacy works
An encrypted route to another network.
A virtual private network carries selected traffic through an encrypted tunnel between your device and a VPN endpoint. That endpoint forwards the traffic onward. For a typical internet connection through a commercial VPN, the destination sees the endpoint’s public address. A company VPN can instead provide access to internal systems. [1]
The tunnel ends at the VPN endpoint. HTTPS is a separate layer that encrypts the connection between the browser and the website. It protects page contents, passwords, and messages in transit, including after the connection leaves the VPN. A site still receives the data you send to it. [2]
Interactive visibility map
Follow the route. Keep track of the observer.
Switch between a direct connection, a VPN, and a VPN with a private window. Then sign into the same account and see which connection becomes explicit.
Your connection goes directly to the website.
- 01Your deviceBrowser + accounts
- 02Local network / ISPDirect connection
- 03VPN endpointNot in this route
- 04WebsiteYour public IP
Local network / ISP
Sees the website’s IP, connection timing, and traffic volume. DNS and other metadata can reveal the destination; HTTPS protects page contents.
VPN provider
Not carrying this connection.
Website / its scripts
Sees your public IP, requests, available browser signals, and this session’s activity.
- Network address
- Home / office exit
- Browser signals
- Still available
- Cookies / session
- Existing session
- Account link
- Not signed in
Conceptual model for covered web traffic using HTTPS. These controls do not change your VPN, open a private window, inspect your IP, or send a test request.
What changes
A new exit IP is one part of the picture.
Public IP
Replaced for covered connections
The website generally sees the VPN exit. Confirm which applications and protocols actually take that route.
Browser fingerprint
Browser signals remain
Canvas, fonts, graphics capabilities, language, and screen measurements come from the browser and device.
Cookies and accounts
Existing links remain
An IP change does not clear a cookie, end a login, or remove a service’s account history.
HTTPS contents
Protected by HTTPS
The VPN endpoint does not normally decrypt the browser-to-website HTTPS connection.
Device location
IP-based location changes
Location permissions, account details, and other application data can still reveal where you are.
Device monitoring
Endpoint visibility remains
A VPN does not remove software, management policies, or monitoring installed on the device.
This describes a conventional VPN tunnel. Bundled tracker blocking, browser extensions, and other product features should be assessed separately.
Why a VPN does not make you anonymous
Websites have more than an IP address.
Cookies carry continuity.
A stored identifier can connect the next request to the previous session. Turning on a VPN does not remove it. A private window starts a separate session, but sites can create state within that session.
See the Chrome evaluation →Your browser has a pattern.
Rendering, fonts, screen measurements, language, and hardware hints can form a recognizable configuration. The tunnel does not rewrite those browser APIs. Trackers can combine that pattern with other observations.
Explore browser fingerprinting →A sign-in reconnects the account.
Logging into the same service supplies a direct account link across networks. A personal account can connect research activity to a real identity even while a VPN is working correctly.
Build account-separation habits →Private browsing changes local session handling; it does not stop the destination from observing your visit. Google’s Incognito documentation describes this distinction.
Browser comparisons
Browser protections cover a different layer.
Browsers can block tracking resources, restrict stored state, reduce exposed detail, or vary fingerprintable outputs. These mechanisms complement a VPN by addressing what websites can learn after the connection arrives.
Firefox
Block known scripts; reduce exposed detailEnhanced Tracking Protection blocks listed fingerprinters. Suspected-fingerprinter protections alter selected outputs, including canvas readback and hardware hints, and limit local-font exposure.
Review your ETP mode and per-site exceptions. Mozilla documents broader suspected-fingerprinter coverage in Strict and Private Browsing.
Read the browser’s documentation →Brave
Block trackers; vary fingerprintable outputsShields blocks tracking resources and randomizes selected browser APIs. This reduces the usefulness of repeatable rendering and device signals. The VPN tunnel and Shields do different jobs.
Keep Shields and fingerprinting protection enabled. Review exceptions before comparing results.
Read the browser’s documentation →Safari
Restrict cross-site tracking and fingerprintingWebKit combines storage restrictions with protections against tracking links, known tracking requests, and fingerprinting. Advanced tracking and fingerprinting protection has mode-specific settings.
Review Safari’s advanced privacy settings and whether protections apply to private windows or all browsing.
Read the browser’s documentation →Tor Browser
Blend browser signals; separate the network pathTor Browser combines the Tor network with defenses such as font restrictions, isolation, and letterboxing. Standardizing groups of users reduces how much a configuration stands out.
Use the official browser, keep its defaults, and avoid extra extensions or customization that make the setup distinctive.
Read the browser’s documentation →Chrome / Incognito
Separate local session dataIncognito creates a separate session and removes its temporary site data when that session ends. Websites can still observe activity and receive browser signals. Signing in still identifies the account.
Treat Incognito as session separation. See our Chrome evaluation for measured recognition behavior.
Read the browser’s documentation →Read our Chrome evaluation →The comparison describes documented mechanisms, rather than a numerical ranking. Browser version, platform, mode, and site exceptions affect the protections available.
Check the actual coverage
A connected icon is only the starting point.
A full-device VPN, a browser proxy, and a work VPN can have different routing rules. Split tunneling intentionally sends selected traffic outside the tunnel. Confirm which browser, applications, address families, and destination networks are included.
DNS, IPv6, and WebRTC deserve separate checks. An excluded DNS request can reveal a lookup outside the intended route; IPv6 may follow different rules from IPv4. WebRTC routing and address exposure depend on browser policy and network configuration. A result showing an address needs interpretation: a local address, a VPN exit, and an original public address have different meanings. [4] [5]
Disconnect behavior
Check whether covered traffic stops or falls back to a direct route when the tunnel fails. Test after sleep and network changes, too.
Managed devices
Endpoint agents and browser management can observe activity before it enters a tunnel. A personal VPN does not remove those controls.
Network fingerprints
A route change can affect server-side observations. TLS is generated by the connecting client; TCP/IP characteristics depend on the tunnel, exit, and network path. Measure these layers separately.
TLSTCP/IPHow to improve privacy with a VPN
Build a setup you can explain and repeat.
- 01
Name the observer
Write down who you need privacy from: the Wi-Fi operator, an internet provider, the websites you visit, an account provider, or an organization managing your device. Choose controls against that observer.
- 02
Confirm the route
Check the covered apps, DNS resolver, IPv4 and IPv6 handling, split-tunnel exclusions, and what happens when the tunnel disconnects. Repeat after sleep, reconnects, and network changes.
- 03
Separate accounts deliberately
Assign browser profiles to roles or matters. Keep personal sign-ins out of sensitive research contexts. A separate profile separates storage; it can still expose the same device characteristics.
- 04
Use browser protections
Keep the browser updated, enable appropriate tracking defenses, and review extension and location permissions. Record any site exceptions so a temporary workaround does not become a permanent gap.
- 05
Measure one change at a time
Record a baseline, change the VPN or one browser setting, and repeat the same test. Keep the device, browser version, and demo scene consistent. Compare the signals that changed with those that stayed stable.
The local browser demos inspect browser surfaces. Confirming an exit IP or DNS route requires a network-facing test, which reveals a connection to the test operator.
Choosing a provider
Evaluate the service behind the tunnel.
Look for clear ownership, a sustainable business model, specific retention practices, and public security assessments that describe their scope. Review the application and infrastructure, rather than treating “no logs” as a complete explanation. A fast protocol does not establish a provider’s data practices. EFF’s selection criteria →
For a team, document approved configurations, support responsibilities, and the response to a failed connection. If the goal is anonymous work against a powerful observer, assess an anonymity system such as Tor Browser alongside the operational plan. Keep the distinction between changing a route, limiting browser recognition, and protecting a person’s identity.
Common questions
VPN privacy FAQ
Does a VPN stop browser fingerprinting?
The tunnel changes routing and the public exit address. It does not, by itself, change canvas pixels, available fonts, language, screen measurements, or other browser APIs a page reads. Browser-level protections can change those surfaces independently.
Does a VPN make incognito browsing anonymous?
No. The VPN changes the network path, while a private window separates local session state. A website can still see what you do on that site, read available browser signals, and recognize any account you sign into.
Can my employer see what I do with a VPN?
A VPN does not remove monitoring installed on a managed device. A work VPN may also route activity through your employer’s infrastructure. Follow organizational policy and separate personal activity from work systems.
Can a website tell that I am using a VPN?
It can compare the exit IP with known hosting or VPN ranges and other network information. A block or CAPTCHA can reflect an IP’s reputation rather than anything about your personal activity.
Do I still need HTTPS?
Yes. HTTPS protects the connection between your browser and the website. A conventional VPN protects a different segment: the tunnel between your device and the VPN endpoint. After traffic exits the tunnel, HTTPS still protects its contents.
Is a browser VPN the same as a device VPN?
Check its scope. A browser proxy or extension may cover only supported browser traffic; a device VPN can route traffic from other applications too. Split-tunnel rules, operating-system behavior, and product settings determine which connections actually use the tunnel.