Technology / The Privacy Desk

A VPN tunnel is not a cloak

A VPN is the most misunderstood product on the internet. It hides real things — and leaves other things in plain view that most people assume are covered. Here is exactly who can still see you, what happened when “no-logs” promises met courtrooms, and how the law changed underneath all of it.

By Albert Richer / Updated August 19, 2026 / 17 min read

Picture your internet traffic as postcards. Everyone who handles a postcard can read it. A VPN puts your postcards inside one envelope addressed to the VPN company, which opens it and mails the contents onward. Your mail carrier — your internet provider — now sees only that you send a lot of envelopes to one address. But the VPN company inherits the privileged position your carrier just lost: your real IP plus every destination and its timing, while HTTPS still seals the contents of properly encrypted pages. That is most of what a VPN is. The rest of this article is what that sentence does not cover.

Who sees what: the honest grid

Five observers watch your browsing. A VPN blinds exactly one and a half of them.

The second row is the one the ads skip. The VPN company inherits the privileged position your provider lost: your originating IP plus destination and traffic metadata for every connection — attached, usually, to a payment method with your name on it — while HTTPS still protects the contents of properly encrypted pages. Even Mozilla, which sells a VPN, states plainly that a VPN will not stop cookies, fingerprinting, or logged-in accounts from recognizing you.Mozilla And your ISP still sees the tunnel itself: a real million-user ISP identified more than 85% of OpenVPN connections in live traffic.USENIX

The employer row deserves one plain sentence: on a company-managed laptop or phone, monitoring software sits below any VPN — it can capture the screen, the keystrokes, and the browser itself, and corporate firewalls with an installed company certificate can decrypt HTTPS outright. No consumer VPN changes that. (On an iPhone, Settings → General → VPN & Device Management shows whether such a profile is installed.)Apple MDM

The two-session problem

Connect. Look at something. Disconnect. Reconnect an hour later. Can anyone tell both sessions were you? Three observers — and none of them necessarily forget you.

On observer one, the proof is a court record. In 2017, the FBI asked PureVPN — a “no-logs” provider — about a Massachusetts cyberstalking suspect. PureVPN’s records showed the same customer connecting from two originating IPs: his home and his workplace — and investigators described the same VPN exit IP touching his real Gmail, the burner account sending the threats, and an everyday pet-sitting account within minutes of each other. No browsing logs were needed; timestamps did it. Ryan Lin was sentenced to more than 17 years.DOJ The counter-model proves the rule: Mullvad issues random numbered accounts, takes no email, and accepts cash in envelopes precisely so it cannot link sessions to a person.Mullvad

On observer three, the research is stark. DeepCorr, a deep-learning correlation attack presented at one of security’s top conferences, matched flows through an anonymity network with about 96% accuracy using roughly 900 packets — a few seconds of browsing — and that was against three-hop Tor. A one-hop VPN is the easier target. Website-fingerprinting studies hit ~98% accuracy guessing which site you visited from encrypted traffic patterns alone in lab conditions.DeepCorr

Cookies do not care about your IP

The tracking industry stopped caring where you connect from years ago. It recognizes the browser itself.

A cookie is a name tag your browser volunteers to every site that set one. Change your IP a hundred times; the name tag stays pinned. And even with cookies blocked, your browser’s configuration — fonts, screen size, time zone, graphics quirks — forms a fingerprint. In the EFF’s landmark study of real browsers, more than 8 in 10 carried a fingerprint unique enough to identify them with no cookies at all.EFF

Then there is the mode people trust most. Incognito windows delete local history when they close — and nothing else. Google spent four years litigating what its own servers collected from Incognito users, and settled by agreeing to delete or de-identify billions of records of private-browsing data, rewrite Incognito’s disclosures to say Google still collects data, and block third-party cookies in Incognito for five years. Class members received $0.Settlement

The iPhone section: Apple does it differently

iPhones have a private-browsing tool most owners already pay for — and a VPN quirk Apple has never fixed.

Start with the quirk, because it is the kind of thing this article exists for. In 2020, Proton disclosed that on iOS, connections opened before the VPN turns on keep running outside the tunnel — including Apple’s own services. Researcher Michael Horowitz confirmed it was still leaking in 2022; follow-up testing found Apple services bypassing VPNs into iOS 16; and as of his August 2025 update, he reports the behavior remains. Apple has called aspects of it expected behavior and offers developers a mitigation API. If your threat model is serious, the defensible summary is: an iPhone VPN app cannot promise that everything goes through the tunnel.Disclosures

Private Relay’s split design means no single company holds the complete picture — architecturally stronger for Safari browsing than a one-hop VPN, and useless for anything outside it.Apple

And the App Store itself is part of the threat model. The Tech Transparency Project found roughly 1 in 5 of the top 100 free VPN apps in the US App Store had obscured Chinese ownership — several linked to a US-sanctioned firm — while academic testing of free Android VPN apps found decades of consistent results:TTP

The courtroom record: when “no logs” met subpoenas

The marketing says nobody keeps logs. The court record keeps score — and it opens with a VPN that was the spy.

Two nuances the table cannot hold. First, jurisdictions can force the issue going forward: in 2021, Proton — under a binding Swiss order — began logging one account’s IP prospectively, leading to a French activist’s arrest. A no-logs policy is not immunity from a future court order.Proton Second, breaches happen upstream: NordVPN’s 2018 incident was one rented server compromised through the datacenter’s management interface — forward secrecy meant no past traffic could be decrypted, but it took a researcher’s tweet in 2019 to surface it.NordVPN

Can governments just decrypt the tunnel? The documented answer is: they did, when the crypto was weak. Snowden-era NSA documents describe an industrial VPN-exploitation pipeline — PPTP was broken outright, and researchers later showed a single weak 1024-bit prime would let a nation-state passively decrypt about 66% of IPsec VPN servers of that era. Modern, correctly configured WireGuard and OpenVPN have no known practical break; WireGuard’s handshake carries machine-checked proofs. The experts’ refrain: the math holds — so attackers go after keys, endpoints, metadata, and humans instead.Snowden docs / Logjam

Can they find your address?

Not from your VPN. From your habits — that is a different story, and it runs through the dark web’s favorite spreadsheet.

First, the reassuring mechanics. An IP address geolocates to a city at best — commercial databases are right about the city only 50–75% of the time, with errors of 25–50 km — and it resolves to your internet provider’s equipment, not your door. Turning an IP into a street address requires a legal demand to the ISP. A website operator watching a VPN visit has none of that; they would need to identify the provider, compel it (often across borders), hope it kept logs, and then compel your ISP — four steps, each needing court authority.Geolocation

Now the unreassuring mechanics. People do get found — through a chain that ignores the VPN entirely:

The darkest irony in the research: free VPNs feed this exact machine. SuperVPN’s 2023 leak exposed 360 million records pairing email addresses with users’ real IPs and locations — the precise join a stranger needs to connect “anonymous” activity to a person. The tool bought for privacy became the breach.SuperVPN leak

Can you scrub yourself out? Consumer Reports tested seven paid data-removal services against the people-search sites for four months. The results argue for doing it yourself:

The law moved: why 2025–26 changed everything

VPNs went from nerd tool to civic flashpoint in eighteen months — and lawmakers noticed.

The backdrop is American: in 2017, Congress killed FCC rules — finalized but never yet in effect — that would have required your consent before your internet provider used or sold browsing data, and barred similar rules from returning. Since then, only general consumer-protection law constrains what ISPs do with your history — the original mass-market reason to buy a VPN.2017 repeal What changed recently is age verification. 27 states (as of August 2026) require adult sites to verify visitors’ ages; the Supreme Court upheld Texas’s law 6–3 in June 2025; and Pornhub has blocked itself in roughly two dozen states in protest.SCOTUS / tracker

Then the UK ran the natural experiment. When the Online Safety Act’s age checks switched on July 25, 2025, VPN apps seized the UK download charts — Proton reported signups up 1,400% within hours, tracked UK VPN traffic ran roughly +1,300% to +2,000% over baseline for days, and five VPNs filled the top-10 free apps, including free ones researchers flag as dangerous. Ofcom’s position, as of mid-2026: VPN use by adults is legal and no ban is contemplated — but sites must not encourage children to circumvent checks.UK surge

And the crosshairs are real, if so far empty. Wisconsin’s age-verification bill originally required adult sites to block known VPN traffic — a US first — until backlash stripped the provision in February 2026. The UK House of Lords voted to ban VPN provision to under-18s in January 2026; the Commons rejected it in March. A federal bill that would force sites to treat VPN addresses as unverified remains stalled in committee as of publication — and Utah’s 2026 amendments point at the next frontier, judging location by physical presence rather than IP, so a VPN’s address no longer legally moves you.EFF / records

The actually-private checklist

In order of effort. Each step closes a hole the previous ones cannot.

And to be fair to the much-advertised product: a VPN can earn its subscription on an untrusted network, against ISP data collection, and wherever your IP is the thing being judged — though with HTTPS now near-universal, even public Wi-Fi is less naked than the ads suggest. It is a good tool. It was just never a cloak.