Online privacy did not vanish in one dramatic leak. It thinned out. Your internet provider can see where you go. Advertisers stitch your IP address to cookies and a browser fingerprint. Public Wi-Fi is a gift to anyone sitting one table over. Governments and platforms keep narrowing what an ordinary connection is allowed to reach. By 2026, treating a VPN as a specialist toy is the outdated move. Treating it as a magic invisibility cloak is the other one.
PCMag security writers Chris Stobing and Justyn Newman put that tension at the center of a February 2026 explainer: you probably need a VPN, and you still need to know what it cannot do. The useful version of the argument is not a product pitch. It is a map of the job a tunnel is actually good for.
What a VPN actually changes
A virtual private network is a detour. Your device encrypts traffic, sends it through a tunnel to a server you chose, and that server talks to the rest of the internet on your behalf. Anyone watching the path between you and the VPN — your ISP, a hotel hotspot, a snoop on the same café network — gets a scrambled stream instead of a list of sites. Anyone looking at the destination sees the VPN’s address, not yours.
That is an old idea. Companies used VPNs for remote access long before consumer apps filled podcast ads. The consumer version just put the same pattern on a phone and a laptop: one tap, an encrypted hop, a different exit point.
You can build that hop yourself if you like tinkering — spare hardware, a rented server, a self-hosted stack. Most people should not. A home-brew tunnel still needs updates, a trustworthy location, and time. Paying a service is not laziness. It is admitting that a forgotten patch is a security hole.
Anonymous is the wrong word
A VPN does not make you disappear. Someone, somewhere, still has a trace as long as you pay an ISP for a pipe. What the tunnel does is make the interesting part of that trace much harder to read.
Your ISP is the obvious case. It can see every destination you hit on a naked connection, and it has been in the business of packaging that knowledge. A 2021 Federal Trade Commission report spelled out how much major providers know about their customers. The data is often described as anonymized. It is still your browsing, sold because you had little choice of who sells you access.
With a VPN on, the ISP still knows you exist. It can still see how much data you move and when you move it. It can still see the personal details you handed over to get the account. What it should not see is the sites, searches, and files inside the tunnel. That is the difference between a firehose of behavior and a trickle of metadata.
Advertisers are the second case. Many still key off your IP address. Shift that address to a VPN server and you cut one of their easiest hooks. You do not cut the rest. Cookies, tracking pixels, and “accept all” banners still follow you around. Browser fingerprinting — screen size, fonts, browser build, and a dozen other dull facts — can reassemble a profile even when the IP keeps changing. A VPN makes that fingerprint harder to pin to a home address. It does not erase the fingerprint. An ad blocker and a tracker blocker do the other half of that job.
Then there is the serious adversary. A well-funded agency with time and legal process can often get what it wants. The honest claim for a good VPN is narrower: when someone comes knocking, there should be nothing useful in the logs. Mullvad’s 2023 police search is the example privacy writers keep returning to. Officers left without user data because the service was not keeping any. That is what a no-logs policy is supposed to mean when it is real, not when it is a slogan on a pricing page.
A VPN is not an antivirus, and it is not a brain
Encrypted transit does not scan attachments. It does not stop a phishing page you typed a password into. It does not talk you out of a convincing text from a fake bank. Some VPN apps now bundle malware filters or sit inside a wider security suite. Those extras have to be judged as antivirus, not as a side effect of encryption. The tunnel itself is doing a different job.
You remain the last control. Slow down before you accept cookies. Do not reuse passwords. Turn on multi-factor authentication where it exists. Use a password manager. A VPN that is always on and a person who clicks every link is still a person who clicks every link.
What it hides, and what still leaks
If you download or upload large files on an active VPN, the contents and the method are hidden from the ISP. The volume is not. A provider can still throttle a fat pipe or bill you for going over a cap. Whether file sharing is even allowed is a separate question: it can violate an ISP’s terms, and it can violate a VPN’s terms. Read the contract you are actually using, not the one you wish you had.
Location spoofing works the same way. Connect to a server in another country and many sites will treat you as if you were there. That can get around local blocks. It can also spook a bank that thinks “you” just logged in from a city you have never visited. Extra checks and frozen accounts are a feature of fraud defense, not a VPN bug. Turn the tunnel off for that login if you need to, then turn it back on.
Streaming libraries are the least reliable of these tricks. Licensing is regional, and the platforms spend money hunting VPN exit nodes. A server that works in March can fail in May. Anyone selling a permanent Netflix region as a guaranteed feature is selling a cat-and-mouse game as a product. If that is your main reason for paying, a monthly plan you can drop is saner than a three-year coupon.
Censorship is the highest-stakes use, and the least honest marketing category
A VPN can make a blocked site reachable by moving your apparent location. For journalists and for people living under heavy filtering, that is the serious use. It is also the use that should come with a warning instead of a slogan.
Encrypted traffic is visible as encrypted traffic. In some places that is enough to draw attention. In some places installing the app is itself a risk. Obfuscated protocols try to make the tunnel look like ordinary HTTPS. That helps. It is not a promise that a state-scale filter will shrug and move on. PCMag’s own writers refuse to certify VPNs as censorship-bypass tools for a blunt reason: getting that test wrong can put someone in danger.
If you are in a country where a VPN is restricted, the decision is not “which server is fastest.” It is whether the tool is legal to hold, whether the app can be hidden in a list of icons, and whether a failed connection is safer than a successful one that was watched. That is a political fact, not a speed-test fact.
Trust is the actual product
All of your traffic passes through the VPN. In the worst case, you have only moved the ISP problem to a new company. So the question is not whether the app has a sleek map. It is whether you would rather that company see your destinations than your broadband provider.
A no-logs policy is the starting line, written in language a human can read. Independent audits by firms that actually inspect the systems — not a PDF of marketing claims — are the next step. Audits are imperfect. The VPN usually pays for them and helps set the scope. They are still better than an unchecked promise. A transparency report that lists law-enforcement requests, and what was handed over, is better still. The gold standard is the ugly one: a real search, a real warrant, and an empty cupboard.
If a provider will not say where it is based, what it stores, how long it stores it, or who has already asked for it, you are buying a tunnel into a black box. That is not privacy. That is a transfer of trust you have not earned the right to make.
Do you need one in 2026?
For most people, yes — as one layer, used on purpose. Travel networks, home ISPs that monetize your clicks, trackers that follow an IP from site to site, and a public internet that keeps getting narrower all point the same way. A cheap, always-on VPN that you actually leave running will do more than an expensive one you forget to open.
It will not replace a password manager. It will not replace multi-factor authentication. It will not replace the habit of not dumping your life into a cookie banner. Pair those and the tunnel starts to look like what it is: a way to stop the easiest observers from reading the easiest data.
If you can still pick the provider yourself, pick one. Prefer modern protocols with a small design. Prefer a company that has been forced to prove it keeps no logs. Keep the app updated. Do not confuse “connected” with “unobserved,” and do not confuse “encrypted” with “anonymous.”
Privacy in 2026 is not a setting you toggle once. It is a set of smaller refusals. A VPN is one of the few that still works at the network layer, where so much of the watching now lives. Use it for that job. Use other tools for the rest.
