When a website loads, it does not look at your IP address first. That is the last resort, the fallback method for when nothing else works. The first thing a server sees is the request headers, which contain a long list of details about the browser making the call. This includes the user agent string, which declares the operating system, the browser version, and the screen resolution. It also includes the language settings, the list of installed fonts, and the capabilities of the graphics card. This data is sent with every single request, regardless of whether you are logged in or not. It is the raw material of a browser fingerprint.
A fingerprint is not a single ID number. It is a statistical probability calculation. A site collects dozens of these attributes and compares them against a database of known devices. If your combination of Firefox version, screen size, and GPU model matches a previous visitor with a high degree of confidence, the site treats you as that person. This works even if you have cleared your cookies and changed your IP address. The IP address is merely one data point in this vast array. It is the least reliable of the bunch because it changes frequently, especially for mobile users or those using dynamic IP assignments.
The VPN intervenes at the very bottom of this hierarchy. It replaces the IP address in the request header with the address of the VPN server. If a site relies solely on IP geolocation to determine your region, the VPN works. But if the site uses fingerprinting, the VPN is invisible. The site sees a new IP, but the same browser, the same fonts, and the same hardware. The mechanism of identification has not been broken; only one variable has been swapped. The condition under which this fails is when the site has enough other data points to identify you with certainty. For most modern websites, that condition is met almost immediately.
The Moment You Sign In
The most significant shift in identification happens the moment you log into an account. Before that, you are an anonymous collection of browser attributes. After that, you are a user with a persistent identity. The site no longer needs to guess who you are. It knows. The IP address becomes irrelevant to the question of identity. It might still be used for fraud detection or regional compliance, but it is no longer the primary key for your profile.
This is the core error in the claim that a VPN stops websites knowing who you are. If you are signed into Google, Amazon, or any major service, the site knows exactly who you are. The VPN changes the exit address, but it does not change the account. The account is the identity. The IP address is just the location of the device currently accessing that account. If you log in from a VPN server in London, the site records that your account was accessed from London. It does not record that you are a new person. It records that you, the known user, are now coming from a different address.
The consequence is that the privacy benefit of the VPN is drastically reduced for signed-in users. The site still has your browsing history, your purchase history, and your preferences. The only thing it loses is the precise geographic location of your home or office. For a major platform, that is a minor loss. The condition under which this stops being true is if you are not logged in at all. But most browsing is not anonymous. Most people are logged into their email, their social media, and their cloud storage. The VPN does not log you out. It only hides the address.
The Persistence of Cookies
Even when you are not logged in, the site can identify you through cookies. These are small pieces of data stored by your browser. When you first visit a site, it sets a cookie with a unique identifier. Every subsequent visit, your browser sends that cookie back. The site sees the same identifier and knows you are the same person. This works across sessions, even if you close your browser and open it again. The IP address may have changed, but the cookie remains.
The VPN does not clear your cookies. It does not delete the data stored in your browser. It only changes the network address. So, if you visit a site with a VPN, the site sees a new IP address but the same cookie. It can correlate the new IP with the old identity. This is a common technique used by ad networks. They track you across different IP addresses by using the cookie as the constant. The condition under which this fails is if you clear your cookies before connecting to the VPN. But that is a manual step that most users do not take.
The mechanism here is statefulness. The web is designed to be stateful. It remembers you. The IP address is stateless. It changes. The cookie is stateful. It persists. The VPN changes the stateless part. It does not touch the stateful part. The result is that the site still knows you, but it doesn't know where you are. For most tracking purposes, knowing who you are is more valuable than knowing where you are. The condition under which the VPN helps here is if the site relies on IP-based tracking and does not use cookies. But that is a rare scenario in modern web tracking.
The Limits of Fingerprinting
Browser fingerprinting is the most robust method of identification that does not rely on user action. It works because browsers leak information. They reveal the screen size, the resolution, the timezone, the list of installed fonts, and the capabilities of the hardware. This information is relatively stable. It does not change when you clear your cookies or change your IP address. The VPN cannot hide this information. It is sent in the request headers, which are not encrypted by the VPN. The VPN encrypts the data between you and the server, but the headers are part of the request structure.
The effectiveness of fingerprinting has increased over time. Early studies showed that a significant percentage of browsers had unique fingerprints. More recent studies show that the number of unique fingerprints has grown as more attributes are used. The condition under which this fails is if the browser is heavily modified to hide or randomize these attributes. Some privacy-focused browsers do this. They randomize the user agent string, the screen size, and the font list. This makes the fingerprint less reliable. But for most users, the browser is standard. The fingerprint is unique.
The VPN does not alter the fingerprint. It only changes the IP address. The site sees a new IP, but the same fingerprint. It can identify you with high confidence. The mechanism is statistical matching. The site compares your fingerprint to its database. If it finds a match, it identifies you. The condition under which this stops being true is if your fingerprint is not unique. If many users have the same fingerprint, the site cannot be sure. But for most users, the fingerprint is unique enough to identify them.
Where the Address Still Matters
There are narrow situations where the IP address is the primary method of identification. One is geofencing. Some services restrict access based on location. A streaming service might only allow access from certain countries. A VPN can bypass this by providing an IP address from an allowed country. In this case, the site does not care who you are. It only cares where you are. The VPN works because it changes the location.
Another situation is network-level tracking. Some networks, such as those used by ISPs or public Wi-Fi providers, track users by their IP address. If you connect to a public Wi-Fi network, the network operator can see your IP address. A VPN hides your IP address from the network operator. It shows the VPN server's IP address instead. This prevents the network operator from tracking your activity. The condition under which this fails is if the network operator can identify you by other means, such as your MAC address or your login credentials. But for basic network-level tracking, the VPN is effective.
The final situation is when the site has no other way to identify you. If you are not logged in, you have cleared your cookies, and you are using a privacy-focused browser that randomizes your fingerprint, the site may rely on the IP address. In this case, the VPN changes the IP address, and the site sees a new person. But this is a rare combination. Most sites have multiple methods of identification. The VPN only changes one of them. The condition under which this works is when the site is poorly designed or relies on a single method of identification. For most modern websites, that is not the case.