What VPNs Hide—and What They Still Leave Exposed

WASHINGTON — Commercial VPNs have moved beyond their earlier role as niche tools for corporate networks and tech-savvy users. Consumer advocacy groups and cybersecurity experts increasingly describe them as a necessary, though limited, shield for personal data as digital surveillance by commercial entities expands and cyber threats targeting public infrastructure grow.

The shift has followed heightened scrutiny of internet service providers (ISPs) and persistent security gaps in public wireless networks. Outside the home, airports, hotels, and coffee shops commonly provide public Wi-Fi networks that are rarely configured with robust security protocols, creating opportunities for data harvesting and cyberattacks.

In October 2021, the Federal Trade Commission (FTC) published a landmark staff report on the data collection practices of major U.S. broadband providers. The investigation found that ISPs routinely gather highly sensitive consumer data, including web browsing histories, real-time location data, application usage, and device identifiers. Many providers combine that information with demographic data to build detailed consumer profiles, which are then shared with advertising networks or sold directly to third-party data brokers.

A broadband provider’s position as the gateway to the internet gives it a unique vantage point over all unencrypted traffic flowing from a household or mobile device. A VPN changes what the ISP can observe by creating an encrypted tunnel between the user’s device and a secure server operated by the VPN provider. The ISP can still detect that the user is connected to a VPN server, as well as the volume of data transferred and connection timestamps, but it cannot view the specific websites visited, individual pages accessed, or data entered.

“`
[User Device] —> (Encrypted VPN Tunnel) —> [Public Wi-Fi Router] —> [VPN Server] —> [Internet]
|
(Intercepted data remains
unreadable to attackers)
“`

On an open wireless network, malicious actors can use basic packet-sniffing software to monitor unencrypted traffic passing through the router. A more sophisticated method, known as an “evil twin” attack, involves creating a rogue wireless access point with a name identical to that of a trusted local network. Users who connect to the spoofed network route their data directly through the attacker’s hardware.

Routing traffic through a VPN on public networks encrypts the data before it reaches the local router. Even when an attacker intercepts the transmission or controls the Wi-Fi access point, the encrypted payload remains unreadable. Cybersecurity professionals recommend confirming that a VPN connection is active and fully secured before signing into online banking portals, healthcare networks, personal email accounts, or any service containing financial or personally identifiable information (PII).

HTTPS has reduced the amount of unprotected web traffic over the last decade, as security initiatives have pushed the vast majority of websites toward Hypertext Transfer Protocol Secure. HTTPS encrypts the connection between a browser and a specific website, so an eavesdropper on a local Wi-Fi network or an ISP cannot see communication contents such as passwords or messages. Under standard HTTPS, however, network observers can still see the domain being visited through DNS queries and Server Name Indication fields. A VPN encrypts those lookup requests and hides the destination domains entirely.

A small percentage of websites still default to insecure HTTP connections. In those cases, a VPN provides a blanket layer of encryption that acts as a fallback, securing traffic even when users connect to legacy, unencrypted sites. The technology also defends against eavesdropping and “man-in-the-middle” attacks, in which data is intercepted in transit.

That protection does not extend to every form of tracking or fraud. A VPN cannot prevent local tracking on the device itself: web browsers continue compiling local history logs unless users manually clear them or use private modes. If someone remains logged into persistent Google, Apple, or social media accounts, those corporations can continue tracking and cataloging search queries, location data, and platform interactions whether or not a VPN is active.

Nor does a VPN stop social engineering or phishing. If a user enters login credentials into a fraudulent duplicate website, the VPN encrypts the transmission of those stolen credentials to the attacker rather than preventing the compromise.

The technology has another role for people crossing borders. In countries where governments monitor citizens or restrict access to global information networks, VPNs allow journalists, activists, and citizens to bypass national firewalls and state-sponsored surveillance. Connections routed through servers in foreign jurisdictions can provide access to blocked news outlets, communication platforms, and social services securely.

Travelers also use VPNs to circumvent “geoblocking,” which restricts digital content according to a user’s geographic IP address. Netflix, Amazon Prime Video, and Disney+ limit their content catalogs to comply with regional licensing agreements. By routing a connection through a server in a home country, travelers can access domestic streaming services and subscriptions while abroad. Users can also change their virtual location to reach country-specific media libraries unavailable in their home region.