What a VPN Does NOT Protect You From

A VPN does exactly two things: it hides your IP address from the sites you visit and encrypts your traffic to the VPN server. Everything outside that narrow job is unprotected, and most of the ways you are actually tracked or attacked fall outside it. Knowing the gaps is not a reason to skip a VPN — it is the only way to use one sensibly, without leaning on it for jobs it was never built to do. Here is the honest list of what a VPN does not protect you from.

Your logins and the accounts you use

The moment you sign in to anything, the VPN stops mattering for your identity there. Google, your bank, your email, any social network — they know it is you because you authenticated, and a hidden IP changes nothing about that. Worse, a service can tie the activity you do while “anonymised” by a VPN to your real account the second you log in from the same session. A VPN cannot make you private from a company you have handed your username and password to.

Cookies and browser fingerprinting

Advertisers and trackers rarely need your IP address, so hiding it barely slows them down. Cookies stored in your browser follow you between sites, and browser fingerprinting identifies you from the unique combination of your screen size, fonts, extensions, time zone and other signals — none of which a VPN touches. You can change your apparent country and still be the same recognisable browser to every tracker on the web. Reducing this kind of tracking takes tools built for it — a privacy-focused browser, tracker blockers, and clearing or partitioning cookies — not a VPN.

Malware, ransomware and viruses

A VPN is not security software. It does not scan files, block malicious downloads, or remove an infection, and encrypting your connection does nothing to stop malware that arrives through an email attachment or a booby-trapped download. Some VPNs bundle a separate threat-blocking feature that filters known-malicious domains, which helps at the margins, but that is an add-on, not the VPN itself. For malware you need up-to-date software, a reputable security tool, and cautious habits. A VPN protecting you from viruses is a category error.

Phishing and scams

If you type your password into a convincing fake login page, a VPN forwards it to the scammer just as faithfully as it would to the real site. Phishing works on the human, not the network, so encryption and a hidden IP are irrelevant to it. The defences that matter are a password manager that refuses to autofill on the wrong domain, multi-factor authentication, and slowing down before you click. None of those is a VPN's job.

The VPN provider itself

This is the risk a VPN creates rather than removes. All your traffic now flows through one company, which can see the sites you connect to while you are connected. You have not eliminated the party that can watch you — you have swapped your ISP for the VPN. That is fine if the provider is trustworthy and genuinely keeps no logs, and a disaster if it is not, which is why the entire point of choosing an audited no-logs VPN is to make sure the company you shifted your trust to actually deserves it. A free VPN with no audit is the classic case of trading a known watcher for an unknown one.

A targeted state adversary — and true anonymity

A VPN does not make you untraceable, and it will not withstand a determined, well-resourced adversary focused on you specifically. Traffic-correlation analysis, a compromised device, or an order forcing the provider to log one user can all defeat it. For genuine anonymity against a serious threat, the tool is Tor, not a VPN — and even Tor has limits and must be used carefully. We compare the two honestly in VPN vs Tor for privacy. If a product promises to make you “untraceable,” treat that word itself as the warning sign.

The single sentence to remember: a VPN protects the connection, not the person at either end of it. Everything it fails to protect follows from that one fact.

What to use instead — in layers

Privacy and security come from layers, each doing its own job. Use a VPN to hide your browsing from your ISP and the local network. Use a password manager and multi-factor authentication to protect your accounts. Use a privacy-focused browser and tracker blockers against fingerprinting and cookies. Keep your software updated and run reputable security tools against malware. And use Tor when you need real anonymity. The mistake is expecting any one of these — especially the VPN — to do all of it. Stacked correctly, they cover each other's gaps.

Why the overpromising is the real danger

The gaps above are not the biggest problem — the biggest problem is believing they do not exist. A VPN that you understand is a useful tool; a VPN you have been told makes you “completely anonymous” is actively dangerous, because it encourages you to do things you would otherwise avoid under a false sense of protection. Someone who thinks a VPN hides them from a site they log into, or shields them from malware, or defeats a targeted investigation, will take risks the technology cannot actually cover. This is why the marketing matters so much and why we are so hard on words like “untraceable” and “military-grade”: the overpromise is not just annoying, it changes behaviour in ways that can hurt people. The right mental model is narrow and calm. A VPN moves your trust from your internet provider to a company you have chosen, and encrypts the path in between. Hold that sentence in mind and the gaps stop being surprises — they are simply everything that sits outside the path, which is most of your digital life. Use the other tools for the rest.