Why Use a VPN? Name the Observer, Name What It Loses

Most disagreements about whether a VPN is worth running come from arguing about it in the abstract. The question becomes answerable the moment you state each reason in one specific form: which observer loses which specific piece of visibility? Reasons that can be written that way tend to hold up. Reasons that cannot are usually describing a mechanism a VPN does not have.

The test, and why it works

A VPN only moves the point at which your traffic joins the public internet, and encrypts the run up to that point. Every genuine benefit has to be a consequence of one of those two facts. So for any reason you are considering, fill in both blanks: the party who was seeing something, and the exact thing they no longer see.

If you cannot name the party, the reason is marketing. If you can name the party but the thing they lose is something they were never reading in the first place, the reason is a misunderstanding. Both are common.

The operator of the network you are attached to

Loses: which hosts your device is contacting. Whoever runs the cable or the access point you are using sits between you and everything else. Without a tunnel they can see the addresses your device connects to, resolve or intercept your name lookups, and in many cases read the hostname you asked for even on encrypted connections. With one they see a single steady flow to one address.

This is the strongest reason on the list, and it is strongest precisely where you have no relationship with the operator. It is worth being clear that this is not a hacking scenario — it is the ordinary, unremarkable position of anyone who runs a network you are using.

What they keep seeing: that a device is present, its hardware address unless it is randomised, the volume and timing of traffic, and the fact that a tunnel is up.

Your internet provider or mobile carrier

Loses: the list of destinations attached to your account. At home your provider occupies the same position as the café, with two differences: you have a contract with them, and they can see your activity over months rather than an afternoon. A tunnel replaces that list with one entry.

The honest framing is that this visibility is transferred rather than destroyed. The VPN operator is now in the position your provider was in. Whether that is an improvement depends entirely on which of the two you would rather be seen by, and that is a judgement about the operator, not about the technology.

The resolver that answers your name lookups

Loses: a record of every hostname you asked about. Your resolver sees names, not just addresses, which makes it the single most legible summary of what you do online. By default it is usually your provider’s, chosen for you by your router.

A VPN can move this, but only if it is configured to — the client has to point resolution at a resolver reachable through the tunnel and make sure the operating system actually uses it. When that is not happening, the traffic is tunnelled while the lookups are not. Who runs your DNS resolver, and why it matters covers how yours got chosen, and this is worth verifying separately rather than assuming.

The services you connect to

Lose: your own public address, and what can be inferred from it. A service now records the operator’s exit address instead of yours. What it loses with it is the network operator behind you, your rough geographic region as far as address databases go, and the ability to link today’s visit to a visit from the same home connection last month.

That last one is the underrated part and also the most limited. Address-based linking only matters if the service had nothing better, and for any service you have an account with, it has something much better.

There is a cost on this side too. Exit addresses are shared and recognisable as infrastructure, so you inherit whatever behaviour other users have produced from that address, and some services treat an unfamiliar one as a reason for extra scrutiny.

Reasons that fail the test

Each of these is widely repeated and none of them survives being written in the observer-and-loss form.

“It makes me anonymous.” Name the observer. If it is a service you log into, the loss is nothing at all — you told it who you are.

“It stops tracking.” Name the observer and the loss is close to nothing, because anything built to recognise people does not depend on an identifier as weak as a household address.

“It keeps me safe.” No observer to name. There is no party who was going to infect your device and is now prevented. Encryption in transit is not inspection, and the tool has no view of what you download or which page you are on.

“It hides my browsing history.” From the network operator, yes. From your browser, your accounts, your workplace’s managed device, and anyone with access to your machine, not at all — none of those are on the path being changed.

“It hides my IP address.” Half true and worth stating precisely. It substitutes the public address services see. Your local address is unchanged and can still be revealed by your own browser under some conditions, and the address your provider issued you keeps existing and keeps carrying the tunnel.

Two reasons that are real but rarely stated

Stable addressing. With a tunnel up, the address you present stops changing when your provider renews your lease or when you move between networks. That is not a privacy benefit at all; it is a consistency benefit, and it makes anything that reacts to your origin behave more predictably. Why your home IP address changes on its own is the behaviour this smooths over.

Not publishing your household’s address. Every service you use records the address your whole household shares. Some people simply prefer that this address is not on record in a hundred different places, without needing a threat model to justify it. That is a coherent reason as long as you notice you have handed the same information to one operator instead.

Deciding

Write down the observer you actually mind. If it is the operator of a network you do not administer, a VPN addresses it directly. If it is your own provider or resolver, it addresses it by substitution, and you should have an opinion about the substitute. If the observer you mind is a service you have an account with, or an advertising system, or a piece of malware, the answer is that this is the wrong tool and no configuration of it will become the right one.