A virtual private network (VPN) protects data by encrypting network traffic between your device and a VPN server. This reduces what people on the local network and your internet service provider (ISP) can read, but it does not make you anonymous or secure every stage of communication.
When you connect to a VPN, its software creates an encrypted VPN tunnel. Your device encrypts outgoing data packets and sends them through the internet to the VPN server. Anyone monitoring the connection between these two points can usually observe metadata, such as traffic volume, timing, and the VPN server's IP address, but cannot easily read the packet contents.
The VPN server decrypts the tunnel traffic and forwards it to the destination. Consequently, the destination website normally sees the VPN server's IP address rather than your device's public IP address. Return traffic follows the same process in reverse.
| Protection | Limitation |
|---|---|
| Encrypts traffic between your device and the VPN server | Traffic beyond the VPN server still requires HTTPS or another end-to-end security protocol |
| Limits an ISP's view of the websites or services you access | The ISP can still see that you are connected to a VPN |
| Masks your public IP address from destination websites | Websites may still identify you through logins, cookies, browser fingerprinting, or personal information |
| Reduces interception risks on untrusted Wi-Fi | The VPN provider may be able to observe connection data, so trust shifts from the ISP to that provider |
A common misconception is that a VPN provides complete anonymity. It changes who can observe particular parts of the network connection; it does not remove tracking, malware, phishing, or data collection by services you use.
For IB Digital Society, this is shared SL and HL content within 3.4 Networks and the internet, particularly network security and internet privacy dilemmas. In an explain response, trace the data from device to VPN server to destination, then distinguish encryption from anonymity and identify the shift in power to the VPN provider.
