You Don't Need A VPN

If you watch tech videos on YouTube or listen to podcasts, you've heard the VPN ad. A creator stops in the middle of a video to warn you about hackers on public Wi-Fi and an internet provider that sells your data. Then they tell you that NordVPN, ExpressVPN, Surfshark, CyberGhost, or Private Internet Access will protect you, read out a promo code, and go back to the video.

Most of that pitch describes risks that modern browsers and websites already handle for free. In this article, I'll go through the main claims in those ads and what is true about each one, the cases where a VPN does help, and the free settings that protect your privacy better than a $10 to $15 monthly subscription.

How VPN Companies Sell Their Product

The consumer VPN business is worth billions of dollars, and it is cheap to enter. A company rents servers, resells the bandwidth at a markup, and pays creators a commission for every subscription their promo code brings in. Many providers are registered in places like Panama or the British Virgin Islands, where consumer protection is weak.

The ad budget tells you something about the product. Password managers and two-factor authentication apps don't sponsor half of YouTube, because people who use them can see what they protect. VPN companies have to persuade you that a problem exists before they can sell you the fix.

The companies behind the apps are often hard to identify. The Open Technology Fund's 2025 VPN Transparency Report found providers that hide their owners behind layers of shell companies, collect more data than they admit, and in some cases are controlled by state actors. Those apps still get millions of downloads, so we should look at what the ads claim, starting with the most common one.

Public Wi-Fi Is Already Encrypted

Nearly every VPN ad uses the same scene. You're in a coffee shop, a hacker on the same network reads your banking password, and your savings are gone. That attack used to be possible on unencrypted websites. Today, almost no website you log in to is unencrypted.

The lock icon in your browser's address bar means the connection uses HTTPS, which encrypts everything between your device and the website. That holds on your home Wi-Fi, in a coffee shop, and on an airport hotspot. Someone on the same network can see which website you connect to, but not your password, your messages, or what you do on the page.

Much of that change came from Let's Encrypt, a nonprofit that started giving out free HTTPS certificates in 2015. Before that, a certificate could cost hundreds of dollars a year, so many small websites never bought one. Today, over 90% of web pages loaded in Firefox use HTTPS according to Mozilla's telemetry, and Chrome reports similar numbers. Google also ranks HTTPS sites higher in search, and browsers show a warning before they load a site without it.

So when you check your bank account on public Wi-Fi, your login is encrypted the same way it is at home. A VPN wraps that encrypted connection in a second layer of encryption, which protects nothing extra. The next claim in the ads is about your internet provider, and it has more truth in it.

A VPN Moves Your Trust From Your ISP to the VPN Company

VPN ads say that your internet service provider (ISP) watches what you do online and sells it. This is partly true. Your ISP can see which websites you visit through your DNS lookups, which I'll explain in the next section. However, a VPN doesn't remove that view. It gives the same view to a different company.

With a VPN on, all your traffic goes through the VPN company's servers before it reaches the internet. The company can see everything your ISP could see, including the sites you visit, when you connect, and how much data you send. You have stopped trusting your ISP and started trusting a VPN company instead, often one registered in another country that you know much less about.

That trust has been broken before. HideMyAss kept logs of when customers connected and from which IP address. In 2011 it handed those logs over under a court order, and they helped the FBI arrest a member of the LulzSec hacking group. PureVPN has also admitted to cooperating with law enforcement. TorGuard was sued by film studios and settled by agreeing to block torrent traffic on its US servers. All three companies still sell subscriptions.

A $10 subscription doesn't pay for lawyers who will fight a court order on your behalf. When police or an intelligence agency asks a VPN company for customer data with a legal order, the company will usually comply, because a long court fight costs more than most providers can pay.

You also can't check a "no-logs" promise yourself. You can't see the company's servers or what software runs on them, and a dishonest provider makes the same promise as an honest one. An independent audit helps, but it only shows how the servers were set up on the day of the audit.

Some VPN apps collect data on purpose. In 2020, BuzzFeed News found that the analytics company Sensor Tower secretly owned at least 20 VPN and ad-blocking apps, including Luna VPN, with 35 million downloads between them. These apps asked users to install a root certificate, which let Sensor Tower collect data from their traffic. The apps sold protection from tracking and tracked their own users.

DNS Privacy Without a VPN

The VPN ads are right about one gap, and it's DNS. When you type a website address, your device first asks a DNS server for the IP address of that domain. For most of the internet's history, devices sent those questions unencrypted, usually to a DNS server run by your ISP. That let the ISP log every domain you looked up.

We can close that gap without sending all our traffic through a VPN company. Browsers and operating systems now support three free technologies that encrypt this information.

DNS over HTTPS (DoH)

DNS over HTTPS sends your DNS lookups inside the same encrypted HTTPS connections that carry normal web traffic, so your ISP can't read them. Firefox turns it on by default in the US, Canada, and a few other countries, and you can turn it on in Chrome, Edge, and Brave with one setting. The domain name can still leak during the start of the HTTPS connection itself, which is the problem Encrypted Client Hello solves (see below).

DNS over TLS (DoT)

DNS over TLS encrypts DNS lookups too, but it uses its own dedicated connection instead of HTTPS. Operating systems and routers use it more than browsers do. Android's "Private DNS" setting, for example, uses DNS over TLS.

Encrypted Client Hello (ECH)

When your browser opens an HTTPS connection, the first message it sends (the "Client Hello") names the website it wants. That name is called the SNI (Server Name Indication), and it has traditionally been sent unencrypted, even with encrypted DNS. Encrypted Client Hello encrypts that message, so someone watching the network can no longer read which website you're connecting to. Browsers and websites are still adding support, so it doesn't cover every site yet.

The guides page has step-by-step instructions for turning on encrypted DNS. Services like Cloudflare's 1.1.1.1 and Google Public DNS provide encrypted DNS for free, which covers what VPN ads promise for DNS. The ads also promise to hide your IP address, and that matters less than they suggest.

Hiding Your IP Address Doesn't Stop Tracking

VPN ads promise to hide your IP address from advertisers and trackers. A VPN does hide it, but advertisers rarely depend on it to recognize you.

Trackers combine many signals to tell one browser from another, a method called browser fingerprinting. They read your installed fonts, screen size, time zone, browser extensions, and even how you move your mouse. Google's and Meta's ad networks also follow you across millions of websites through cookies, logins, and tracking scripts. None of that depends on your IP address.

IP addresses are also a weak signal on their own. Many ISPs use CGNAT (Carrier-Grade Network Address Translation), which puts many households behind the same public IP address. For a tracker, your IP address is one hint among many, not your identity.

So with a VPN on, advertisers still recognize you through cross-site cookies, your phone's advertising ID, and your browser fingerprint. Only the IP address in their records changes.

Free VPNs

Everything above applies to paid VPNs. Free VPNs carry the same trust problem, with an added question of how the company pays for its servers. When you don't pay with money, the provider makes money from your data or your connection. Free VPN providers have been caught doing the following:

• Selling user data to advertisers
• Injecting malware and adware
• Collecting location data despite claiming not to
• Using outdated or broken encryption protocols
• Renting server capacity to other services

The same Open Technology Fund report tested Turbo VPN, VPN Proxy Master, and 3X VPN, which have more than 100 million downloads each, and found serious security flaws. Some used protocols that were never designed to keep data confidential. Others shipped with passwords written into the app, which let an attacker decrypt every user's traffic.

The report concludes that millions of people use these apps believing they're protected, while the apps make them less safe. If you need a VPN, a paid provider with a reputation to lose is a little safer than a free one. That leaves the question of when you need one at all.

When a VPN Makes Sense

VPNs are useful in a few specific situations. The problem is that the ads sell them to everyone else. These are the cases where I think a VPN does solve a real problem.

Government Censorship and Internet Blocking

Censorship is the strongest reason to use a VPN. Governments in countries like China, Russia, Iran, and North Korea block large parts of the internet. China's "Great Firewall" blocks Google, Facebook, Wikipedia, many news sites, and thousands of other services. Russia has blocked far more of the internet since 2022.

After Russia invaded Ukraine in 2022, VPN downloads in Russia rose sharply as people tried to reach blocked independent news. VPN use in Turkey and Iran also rises during political unrest. In these countries, a VPN gives people access they can't get any other way.

Even there, VPNs are getting harder to use. China actively detects and blocks VPN traffic. Russia has banned many VPN services and requires the legal ones to connect to its censorship system. A VPN that works today can be blocked next week.

If you live with heavy censorship, look for a VPN or tool built to disguise its traffic (often called obfuscation), not the consumer service from the YouTube ad.

Streaming Services and Geo-Restrictions

"Watch Netflix from any country" used to be the easiest VPN sell. It worked for a while, but streaming services now detect and block VPN traffic.

Netflix shows an error when it detects a VPN or proxy. BBC iPlayer refuses to play anything if it thinks you might be using one, even for viewers in the UK. HBO Max and Disney+ block VPNs too.

Some paid VPNs still get through for a while, until the service blocks their servers and they move to new ones. I expect the streaming services to keep winning, because their licensing deals are worth billions and depend on enforcing those borders.

Getting around geo-restrictions also breaks the terms of service of the major streaming platforms. They license each show region by region, and their contracts require them to enforce those regions. They rarely ban accounts for it, but they can.

If you accept those limits and still want shows from another region, a VPN is the easiest way to try. Expect it to stop working without warning.

Corporate and Remote Access

Companies built VPNs so employees could connect to the office network from outside it. If your employer asks you to use a VPN to reach internal systems, use it. That will be the company's own VPN, not a consumer service.

High-Risk Individuals

Journalists, activists, and whistleblowers face adversaries who target them personally, and a VPN can be one part of how they protect themselves. If you're in that group, get your security advice from organizations like the Freedom of the Press Foundation or the Committee to Protect Journalists, not from YouTube sponsorships.

Torrenting and P2P Applications

When you download copyrighted material through BitTorrent, your ISP can see it, and in some countries rights holders send warning letters through the ISP. A VPN hides that traffic from your ISP. I don't endorse piracy, but this is a real reason some people use a VPN.

Checking for Location-Based Pricing

Some online stores and subscriptions charge different prices depending on your country. A VPN lets you check what the price is from another location. This is one of the few cases where a VPN can save an ordinary person money.

What Protects Your Privacy Instead

If none of those cases describes you, the $120 to $180 a year is better spent elsewhere, or not at all. These steps protect you from the attacks that actually happen to people, and most of them are free:

Together, these steps protect your accounts and your browsing far better than a VPN subscription, and most of them cost nothing. If you're still thinking about buying a VPN, a few questions can help you decide.

Questions to Ask Before You Subscribe

VPN ads don't ask you these questions, so ask them yourself before you pay. If you don't have a good answer, you probably don't need a VPN.

• What specific threat am I protecting against? A general worry about "hackers" doesn't count. Name the problem you have.
• Do I trust this VPN provider more than my ISP? Has an independent auditor checked its no-logs claim, and how recently?
• Is a VPN the right tool for my problem? For DNS privacy, use encrypted DNS. For anonymity, use Tor. For censorship, use a tool built to disguise its traffic.
• Am I paying for security theater? Would the VPN change anything that affects me, or would it only make me feel safer?

Conclusion

The internet has changed more since 2015 than VPN ads admit. HTTPS protects your logins on any network, encrypted DNS is a free setting, and browsers block trackers on their own. The attacks that hurt most people today are data breaches, reused passwords, unpatched software, and phishing, and a VPN does nothing about any of them.

I think a VPN is a fine tool for the few problems it solves. Before you buy one because a creator you like read an ad, make sure you have one of those problems.