Back to insights
Article

What a VPN can — and cannot — protect

THREAT MODELPRIVACYLIMITS

Author

EVPN Research

Date

July 10, 2026

Reading Time

8 min read

What a VPN can — and cannot — protect

A VPN is a networking tool, not an anonymity cloak.

VPNs are useful. They are also widely oversold. Understanding the difference matters more than any slogan about being “invisible online.”

EVPN is designed around private connectivity: encrypted tunnels, private DNS and fail-closed leak controls. That is valuable. It is not absolute anonymity.


What a VPN is designed to protect

When a VPN tunnel is active and correctly configured, it typically aims to:

  • Encrypt traffic between your device and the VPN gateway
  • Hide your originating public IP from ordinary destination websites
  • Keep DNS requests inside the tunnel when private DNS is enforced
  • Reduce local-network and café-Wi-Fi visibility into destination traffic

Those protections are meaningful against opportunistic observers: a hostile shared Wi-Fi network, a local router admin, or routine ISP visibility into destinations.


What a VPN cannot guarantee

Honesty requires listing the hard limits.

A VPN cannot guarantee:

  • Anonymity against a global passive adversary
  • Anonymity after you sign into identifiable accounts
  • Protection from malware already on the device
  • Prevention of browser fingerprinting
  • Secrecy for plaintext HTTP after traffic leaves the VPN exit
  • Universal streaming access
  • Universal censorship resistance
  • Immunity from lawful infrastructure seizure

If a provider claims otherwise without evidence, treat the claim as marketing.


Identity still exists outside the tunnel

Your email login, payment method, browser profile and account cookies are often stronger identifiers than an IP address. A private exit does not erase those signals.

Architecture can reduce what the VPN gateway knows. It cannot rewrite how the rest of the internet identifies you.


Design for the threat you actually have

Ask:

  1. Who am I trying to reduce visibility from?
  2. What metadata still exists after the tunnel?
  3. Which apps and accounts re-identify me immediately?

EVPN’s logging and identity-separation design exists to reduce unnecessary retention — not to promise impossibility.

Privacy improves when products admit limits. That is the standard this site is written to.

More Insights

Continue with these articles

All Insights