A VPN moves the observer. That is the whole trick, and it is a genuinely useful trick — the café, the hotel, the ISP and anyone sharing the wire with you stop being able to read the shape of your traffic. What it does not do is make you nobody. You are still logged into things. You still look exactly like yourself.
The industry has spent a decade selling the second thing while delivering the first. The first is worth having. It is just worth knowing which one you bought.
What it genuinely changes
Three things, and they are not trivial:
- The local network stops being an audience. On shared wifi, everything you do becomes one encrypted flow to one address. The other people in the airport learn nothing.
- Your ISP loses the itinerary. It still knows you are connected, to whom, for how long and how much data moved. It stops knowing which sites, which is the part it was previously able to sell, log or hand over.
- Websites see a different address. Which changes what they show you, what they geo-block, and what a naive log records.
For the everyday case — untrusted networks, an ISP you would rather not brief daily, a region lock you would rather step around — that is the correct tool and it works.
The five things that still name you
1. Your accounts. This is the big one and it defeats everything else instantly. The moment you sign in, the service knows precisely who you are, and your IP address becomes a piece of trivia attached to a named account. Most people spend most of their browsing logged into something that also has an advertising business.
2. Cookies and fingerprints. Logged out, you are still identifiable. Your browser volunteers its screen dimensions, timezone, language list, installed fonts, graphics renderer and a dozen quieter signals; combined, they are unique enough to re-identify most people across IP changes, and the IP change itself becomes just another data point. This is why a fresh exit address does not produce a fresh person.
3. How you paid. A subscription bought with a card in your name, from your home address, creates a record linking you to the provider. Whether that matters depends on who might ask them.
4. What you do. Behaviour is identifying. The same handful of sites, in a familiar order, at hours consistent with one timezone, in one language, with the same writing style. Correlating traffic patterns across a tunnel is a real technique, not a hypothetical one.
5. The provider itself. You did not remove the observer. You replaced your ISP with a company whose business is watching the same traffic, and whose incentives you know less about. Independently audited no-logs policies are meaningfully better than promises, and they are still policies rather than physics. There is a reason the honest framing is trust transferred, not trust eliminated — the same point made at length in Notes from the Underground Network.
Threat models, briefly
"Am I anonymous" is the wrong question. "Anonymous from whom" is answerable.
| From | Does a VPN help? |
|---|---|
| Others on the same wifi | Yes, completely |
| The network operator (café, hotel, employer's guest network) | Yes |
| Your ISP | Yes, for site names and content |
| Advertisers and trackers | Barely — they identify you by browser and account |
| The websites you log into | No |
| Your VPN provider | No, by construction |
| An adversary who can compel the provider | Depends entirely on what the provider retains |
| An adversary watching both ends of the connection | No — timing correlation defeats a single hop |
Most people's real threat is in the top three rows, which is why the tool remains worth using despite everything below them.
When the answer is actually Tor
If your requirement is that no single party knows both who you are and where you are going, a VPN cannot provide it. One hop, one company, both facts.
Tor distributes that knowledge across relays run by different people: the first knows your address but not your destination, the last knows the destination but not you. That is a structurally different guarantee, and it is the one people describe when they say anonymity.
It costs you. It is slower, some sites treat exit nodes as hostile, and using it badly — logging into your own accounts over it, for example — undoes the design in one click. For journalists, sources and people under genuine pressure it is the correct tool. For watching a football match from the wrong country it is not.
The honest summary
A VPN is a very good answer to "who can watch me on this network" and not an answer at all to "can I be identified". Buy it for the first question. Do not let anyone sell you the second.
And the sales copy is worth reading with that in mind: any provider promising complete anonymity is either misunderstanding their own product or expecting you to. The useful ones describe what they encrypt, what they retain, who audited that claim and when — which is a much shorter, much duller paragraph, and the reason it is duller is that it is true.
Questions people actually ask
Does a VPN hide my browsing from my ISP?
Yes — that is the part it does well. With a working tunnel your ISP sees encrypted traffic to one address, its volume and its timing, and nothing about which sites are inside it.
Can websites still identify me through a VPN?
Easily, if you are logged in — the account is the identity and the IP address is irrelevant. Even logged out, browser fingerprinting and cookies re-identify most people across IP changes.
Is Tor better than a VPN?
For anonymity against a serious adversary, yes, because no single relay knows both who you are and where you are going. For everyday privacy on untrusted networks a VPN is faster, simpler and less likely to break the sites you use. They answer different questions.