Whenever we go online, our activity is tracked, monitored, recorded and analyzed, while the associated data is shared, bought, traded and sold. The digital crumbs we leave in our online footsteps are abundant, and maintaining any semblance of privacy on the internet is a continuous challenge.
The natural response to such an alarming lack of privacy is to put up walls, retreat into a shell and try to become anonymous. It’s that reflex that many VPNs build their marketing around, peddling inflated claims about how their product can make you completely anonymous online. But complete online anonymity is a myth.
To be fair, not all VPN companies are pushing this false narrative — CNET’s picks for the best VPNs are all very clear about what their services can and can’t do. But too many companies, including a few high-profile VPN providers, continue to keep the myth alive.
Even a VPN provider as established and well-known as CyberGhost continues to promote this dangerous falsehood. The company boldly states on its website that its service can help users “go completely anonymous and surf the internet without privacy worries,” and that they can “enjoy complete anonymity & protection online” with CyberGhost.
To be fair, CyberGhost does mention in an FAQ section tucked away at the bottom of its home page that “no VPN service can make you 100% anonymous online,” but the messaging from the company is nonetheless confusing and avoidable.
This isn’t just a case of harmless exaggerated marketing — it’s reckless. Using a VPN while under the impression that it’s a silver bullet for online anonymity can put you in a bad spot, even if you have nothing to hide. If you use a social media platform to share sensitive information online with someone, or if you’re an investigative journalist in a region whose government practices oppressive digital surveillance, you’ll still be at risk, even with a VPN.
You can’t simply throw good judgment and all other basic privacy principles out the window just because you think your VPN gives you an all-encompassing invisibility cloak on the internet whenever you switch it on. It’s time to dial back the hyperbole and be clear about how a VPN can and can’t protect you online, starting with why all this talk about data matters.
Your information is out there, and almost everyone wants it
Whether used by governments to spy on citizens and adversaries or by companies like Google and Meta to profit off of user data, the internet has been an incredibly efficient surveillance tool for decades. It was only after former NSA contractor and whistleblower Edward Snowden’s revelations in 2013 that the public really began to grasp the extent of the online surveillance and internet privacy issues in general came more to the forefront.
A few years later, the Cambridge Analytica scandal in 2018 helped illustrate not only the vast amount of data Big Tech was collecting without our consent, but also how outside companies were piggybacking off of that data collection for their own purposes.
Whenever you’re logged in to a service like Google, Facebook, TikTok, Instagram, X, Amazon or Netflix, all of your activity on those platforms can be tracked by the companies and linked directly back to you. Data related to the search terms you enter, links you click on, videos you watch, items you purchase, ads you interact with and content you share are all collected and used to create a detailed profile on your interests and online habits.
Additionally, personal information such as your name, username, address, payment data and email address, along with unique identifiers like your IP address, browser type, device type and operating system can all be tracked.
Your internet provider can track things like your web browsing history, location, app usage and metadata. Fitness and financial apps can collect sensitive health and financial data. Websites use cookies and device fingerprinting, and social media platforms use pixels to track your activity across the web.
That information can be collected and sold to data brokers, who further treat your personal information like valuable currency.
Data privacy legislation like Europe’s GDPR and California’s CCPA help people take more control over how their data is collected and processed, but these laws can only do so much. Surveillance capitalism is so ingrained into how Big Tech operates that having our actions online tracked in one way or another is becoming increasingly unavoidable. With all the ways in which we’re being tracked, online anonymity is only possible if you don’t go online at all.
A VPN can help boost your privacy, but there are many limitations
With a VPN, you can give your privacy a boost and put a small dent into the scope of data collected on you when you go online. A VPN encrypts your online traffic while routing it through a secure server in a remote location that you choose. This process achieves two objectives critical to improving your privacy: It hides your internet activity from your internet provider, network administrator, government and other online snoops, and it changes your actual IP address to that of the VPN server you connect through.
This way, you can keep your online activity hidden from certain key entities while also preventing the sites and services you use from detecting your actual physical location and tracking you based on your IP address. VPNs are great for protecting your privacy, limiting certain kinds of tracking and data collection, evading firewalls at work or school and spoofing your IP address and location to bypass georestrictions.
That’s a useful set of features, but there are still plenty of ways for data to get through your VPN.
Some VPNs include ad and tracker blockers, along with surface level malware and phishing protection features, but (other than Windscribe’s anti-fingerprinting feature) most VPNs cannot guard against tracking through browser fingerprinting. Your browser fingerprint can expose information like your time zone, screen resolution, browser type, operating system, extensions, language preferences and IP address. All of this information taken together can be used by advertisers to build detailed profiles on internet users, governments to surveil citizens and even cybercriminals to commit identity theft.
A VPN can’t help hide your identity when you purchase something from Amazon or when you use services like Google or Facebook. These platforms all know it’s you when you interact with them while logged in and are still collecting hoards of data related to your activity whether or not you’re connected to a VPN.
A VPN can’t protect you if you download malware or enter your sensitive information into a phishing site. Privacy protections don’t prevent you from downloading malware or sending your personal information to cybercriminals. Some antivirus services can protect you against these risks, but a VPN won’t.
And you’re not anonymous to the VPN itself when using its services because you’re essentially swapping the visibility into your online activity from your internet provider to your VPN provider. That’s fine if your VPN has an audited no-logs policy and runs on RAM-only or full-disk encrypted servers to serve as an extra layer of protection. But there are too many VPNs, especially free services, that put user data at risk or otherwise misuse it.
Yet none of this stops some VPN providers from saying that VPNs can make you totally anonymous online.
In reality, VPNs are just a small piece of the much greater online privacy and security puzzle. VPNs like Mullvad and Windscribe let you sign up and use their services without supplying any personal information whatsoever — which is about as close as you can get to anonymity with a VPN. Other providers like Proton, NordVPN, ExpressVPN and Surfshark offer additional privacy and security services on top of a VPN that you can bundle under a single subscription, which can help you better round out your cybersecurity toolkit.
Other tools for boosting your privacy online
Everyday citizens simply looking to boost their online protections should be fine with a VPN, password manager and antivirus. But if you’re an activist, lawyer, whistleblower, investigative journalist or anyone else with critical privacy needs, there’s a lot more you should do to protect yourself and become as anonymous as possible online.
A great first step is to go with a vetted VPN provider with an audited no-logs policy and make sure to enable the appropriate settings for optimal privacy. On top of that, I recommend leveraging the following tools if you want to be as anonymous as possible online:
- Tor: Uses “onion routing” to send your traffic through multiple volunteer-run relays across the globe, encrypting your data multiple times and hiding the origin and destination of your traffic.
- Tails operating system: A secure operating system from the Tor Project that you download to a USB stick that runs independently of your computer’s operating system. It boots fresh each time you start it up and wipes all data automatically when you shut it down.
- Adblocker: A browser extension like Privacy Badger or Ghostery can help you block ads and trackers from following you around the web.
- Encrypted messaging services: Apps like Signal can help keep your messages private by encrypting the contents.
- Proton Mail: An encrypted email service from Proton that’s free of trackers and uses end-to-end, zero-access encryption so that only you can access the contents of your emails.
- Privacy-focused browsers: Certain browsers like the Mullvad Browser or Brave can help automatically block ads and trackers and fight against fingerprinting. The Electronic Frontier Foundation’s Cover Your Tracks tool can also give you a detailed look into your specific browser fingerprint and reveal exactly how unique it is.
- Private search engines: Tools like DuckDuckGo or Brave Search are solid private alternatives to the tracking and data collection employed by the likes of Google or Bing.
More ways to protect your privacy
In addition to using the tools listed above, I recommend taking the following actions if you’re serious about minimizing your digital footprint and staying as private as possible online:
- Limit your social media use and reliance on Google services: Big Tech is a data-hungry machine that doesn’t put your privacy at the forefront.
- Create burner accounts: Whether it’s an email address, phone number or social media account, use an alias to sign up and make them temporary accounts that you can ditch at any time.
- Pay in cash or crypto: Credit cards, PayPal, Venmo and personal checks all leave a trail back to you. Cash and crypto do not.
- Be careful of what you download: Don’t download random files from unsolicited emails. Be on the lookout for signs of phishing, malware and other scams. Use some common sense and if something feels off, then don’t engage.
- Shore up your device’s privacy settings: Make sure app permissions are set to only what the apps need to function. Enable device encryption and set a strong passcode. Disable ad tracking and location services.
- Be careful with public Wi-Fi: Only connect to secure Wi-Fi hotspots and use a VPN for extra protection.
- Regularly clear your browser cookies and cache: This not only limits tracking, but can also improve performance and free up storage space.
While neither a VPN nor any single privacy or security tool can guarantee you anonymity, a well-rounded cybersecurity toolkit, some strategic actions and a little bit of common sense can go a long way toward protecting your privacy.
