You're Using a VPN — But Are You Really Invisible?

First, a Quick Refresher: What Does a VPN Actually Do?

A VPN — short for Virtual Private Network — masks your real IP address and encrypts your internet traffic, routing it through a secure server in another location. This makes it significantly harder for outsiders to spy on what you're doing online. It's a genuinely powerful privacy tool, widely used by remote workers, frequent travellers, and everyday privacy-conscious users alike. But here's the thing: a VPN doesn't make you completely anonymous. It shifts who can see your data — it doesn't make that data disappear entirely.

Understanding the Three Types of VPN Data Logs

Not every VPN handles your data the same way. Before choosing one, it's worth understanding what kind of records different providers keep — because this directly affects how private your activity really is.

Who Can Still See You — 01

Your Internet Service Provider (ISP)

Without a VPN, your ISP has a front-row seat to everything you do online. With one, the view gets murkier — but not fully blocked. Your ISP can no longer see which websites you visit, but they can still detect that you're connected to a VPN server, how long you've been connected, and roughly how much data is passing through. In some countries, that alone is enough information for authorities to make requests.

Who Can Still See You — 02

Search Engines (Yes, Even With a VPN On)

Here's one people often miss: if you're signed into your Google account while searching the web, Google is logging your searches regardless of your VPN status. Your browsing history is tied to your account identity, not just your IP address. The same goes for Bing, Yahoo, or any search engine you've ever used while logged in. Switching to a privacy-first search engine like DuckDuckGo or Brave Search — without being signed in — is the better approach.

Who Can Still See You — 03

Social Media Platforms

Facebook, Instagram, X, TikTok — these platforms track you through your account login, not just your IP address. If you're scrolling while signed in, advertisers still have access to your behavioural data. It gets even broader: many websites let you sign in using your social media account ("Continue with Facebook"), and that cross-site activity remains visible to the platform even while your VPN is running. Your VPN protects your network layer — it doesn't protect data you've actively shared with these services.

Who Can Still See You — 04

Your Employer (If It's a Work Device or Work VPN)

Using your company's VPN on a work laptop is a fundamentally different situation from using a personal VPN. Corporate VPNs route traffic through company-managed servers, giving IT departments the ability to monitor activity — often including websites visited, files downloaded, and time spent on non-work apps. Many employers also have administrative access to work devices, meaning your local browsing history can be visible to them entirely separately from any VPN. If privacy from your workplace matters, a personal device with a personal VPN is the only real answer.

Who Can Still See You — 05

Law Enforcement Agencies

Active, encrypted VPN traffic is effectively unreadable to law enforcement in real time. But they don't always need to intercept your live traffic. If you become a person of interest in an investigation, agencies can approach your ISP for connection logs, which reveal which VPN provider you were using and when. From there, they can issue a legal request to that VPN provider. If your provider keeps logs — or is legally obligated to hand over data — your trail becomes visible. This is why jurisdiction and logging policies matter so much when picking a VPN.

A VPN Is One Layer — Not the Whole Shield

Think of a VPN as a strong lock on your front door. It handles one specific threat very well — but it doesn't protect every window and back entrance in your house. Rounding out your privacy setup means choosing a VPN that operates under a verified no-logs policy, staying signed out of personal accounts when true anonymity matters, using a privacy-focused browser (Firefox, Brave) with tracker blocking enabled, creating strong, unique passwords for every account, and staying alert to phishing attempts — no VPN protects against clicking the wrong link.