VPN Myths Debunked: What's True and What's Not

False. A VPN hides your IP address from the websites you visit and encrypts your traffic so your ISP can't see what you're doing. That's it. If you log into Google, Facebook, or your bank, those services still know exactly who you are. Browser fingerprinting (screen resolution, fonts, installed extensions) can also identify you across sessions even with a different IP.

A VPN is one layer of privacy, not a cloak. For stronger anonymity, combine it with the Tor browser, anti-fingerprinting browsers like Brave or Mullvad Browser, and disposable accounts.

False. VPNs vary enormously in privacy refund terms, infrastructure, and trustworthiness. ExpressVPN's privacy policy has been documented in public provider materials, NordVPN's by public provider materials, Surfshark's by provider materials, ProtonVPN's by public provider materials. Many smaller VPNs have no audits at all — you're trusting their marketing copy alone.

See our privacy guide for the full reported landscape.

Mostly false, with one exception. Most free VPNs monetize by injecting ads, selling browsing data, or serving as residential proxy networks (your bandwidth becomes someone else's anonymity layer). A 2020 academic analysis of free Android VPNs found that the majority contained tracking libraries.

The notable exception is ProtonVPN's free tier, which uses the same published privacy infrastructure as the paid version, has no ads, no data selling, and no bandwidth caps — only server location and speed restrictions. See free vs paid VPN for full breakdown.

Partially true. A VPN protects against specific attacks: man-in-the-middle on public Wi-Fi, ISP-level snooping, and traffic interception on hostile networks. It does not protect against malware, phishing emails, weak passwords, or credential reuse. If you click a phishing link and enter your password, the VPN doesn't help — the encrypted tunnel just delivers your credentials to the attacker faster.

Combine a VPN with a password manager, 2FA on every account, and a modern browser with up-to-date patches.

A VPN can slow some connections, especially on distant servers or older protocols. With a nearby server and a modern protocol, many users see a small enough difference for browsing, HD video, calls, and downloads. If your VPN feels dramatically slower, switch protocol, choose a closer server, and test again before blaming the provider outright.

False in the US and most countries. VPNs are legal in the United States, Canada, the UK, the EU, Australia, and the vast majority of countries worldwide. Some authoritarian states (China, Russia, Iran, North Korea, Belarus) restrict or ban consumer VPN use. See our is VPN legal in the US guide for the full legal picture.

Nuanced. A 'privacy' VPN doesn't store records of what you do — sites visited, files downloaded, IP addresses connected from. They generally do store minimal operational data: total bandwidth used (for billing), payment records, and account email. The key question is whether they store anything that could link your activity back to you.

Providers like NordVPN, ExpressVPN, and Private Internet Access have been reported or publicly documented to confirm their privacy claims. See privacy explained.

Oversimplified. Provider headquarters matters more than server location. A VPN headquartered in Panama (NordVPN), the British Virgin Islands (ExpressVPN), or Switzerland (ProtonVPN) operates outside Five/Nine/Fourteen Eyes intelligence sharing — but their servers can be anywhere.

What matters is: (1) the company's home jurisdiction and what data laws compel them to retain, (2) whether they use diskless RAM-only servers (data wiped on reboot), and (3) whether they've passed published disclosures. See jurisdiction guide.

False. Incognito mode (or Private Browsing) only prevents your local browser from storing history, cookies, and cache. Your ISP, your network admin, and the websites you visit can all still see exactly what you're doing. A VPN encrypts your traffic and hides your IP — incognito mode does neither.

False. A VPN protects data in transit; an antivirus protects your device from malicious files. They solve different problems and you need both. NordVPN includes Threat Protection (DNS-based malware blocking), and Surfshark includes CleanWeb — but neither replaces a real endpoint antivirus like Windows Defender or Malwarebytes.