VPN Buying Guide: Trust Transfer, Not Anonymity

What a VPN actually does

A VPN builds an encrypted tunnel from your device to a server the provider operates. Traffic inside the tunnel is unreadable to anyone on the path between you and that server — your internet provider, the coffee shop network, anyone passively watching the local link. At the far end, the traffic exits onto the ordinary internet from the provider’s address.

Two things follow immediately, and they are the whole basis for an honest VPN buying guide. Websites see the provider’s address rather than yours. And the provider sees everything your internet provider used to see. The encryption protects the middle of the journey; it does nothing at either end.

The trust transfer

This is the single idea the category’s marketing works hardest to obscure. You are not eliminating a party who can observe your browsing. You are choosing a different one, and choosing to pay them instead of your internet provider.

That reframes the purchase entirely. The question is not “which VPN is fastest” or “which has the most servers.” It is: do I have better reason to trust this company than my internet provider, and what happens to me if I am wrong? For someone on a hostile public network, the answer is often clearly yes. For someone browsing at home on a connection from a regulated national carrier, the calculation is much less obvious than the advertising suggests.

What “no logs” has meant in practice

The category’s central promise has a documented history of not surviving inspection. A complaint filed with the FTC alleged that a widely used free VPN advertised “Anonymous Browsing” with “no logs of your online activity” while in fact collecting IP addresses, device identifiers and application information — data used to “identify [a user’s] general location, improve the Service, or optimize advertisements.”

The same complaint alleged the service “redirects e-commerce traffic to partnering domains,” intercepting requests to retailers and routing them through advertising partners, and that the application transmitted mobile carrier information without HTTPS encryption.

Whatever the eventual outcome in any individual case, the structural lesson stands and it belongs in every VPN buying guide: “no logs” is a marketing claim until something external tests it. Free services in particular have to earn revenue somewhere, and the product being sold is frequently the traffic.

Evidence that counts

On that last row, a disclosure is owed: VPN affiliate commissions are among the largest in consumer technology, which is exactly why so much of the category’s coverage reads like a leaderboard. Treat any ranking that never mentions a downside as an advertisement. A VPN buying guide with no downsides in it is a sales page with a table of contents.

Real uses and overstated ones

Genuinely useful: shielding traffic on untrusted networks; preventing your internet provider from building a browsing profile; reaching your home or office network remotely; and reducing casual location exposure to the sites you visit.

Overstated: anonymity. Browser fingerprinting, logged-in accounts and cookies identify you regardless of your address. A VPN does not stop a site you are signed into from knowing who you are.

Overstated: security. HTTPS already encrypts content on the modern web. The VPN hides which sites you visit from the local network, not the contents of a session that was already encrypted.

Conditional: streaming access. It works until it does not, changes without notice, and typically violates the service’s terms.

Technical checks

• A kill switch that blocks traffic if the tunnel drops, tested by actually killing the connection.
• DNS handled inside the tunnel, verified with a leak test rather than assumed.
• Modern protocols — WireGuard or equivalent — rather than legacy defaults.
• IPv6 handling. A provider that ignores IPv6 can leak around the tunnel entirely.
• Router or device-level support if you need coverage for things that cannot run a client.
• Payment and account minimization — a provider that demands identity documents has undercut its own pitch.

The checklist

• Write down your actual threat. Public Wi-Fi, your internet provider, and a nation state are three different problems with three different answers.
• Never use a free VPN for anything you would not post publicly.
• Check the audit date and scope, not the badge.
• Prefer providers with a tested record over providers with a marketing claim.
• Run a DNS and IPv6 leak test after installing, before trusting it.
• Accept the trade honestly: you have changed who watches you, not whether anyone does.

Used that way, a VPN buying guide becomes a short document, because most of the category’s differentiators — server counts, speed leaderboards, award badges — do not bear on the only question that matters. The provider can see what your internet provider used to see. Choose accordingly.