“A hacker at your local coffee shop can see everything you’re doing online.” You’ve seen this line in VPN ads. There’s a hooded figure with a laptop. There’s a sense of imminent danger every time you connect to public Wi-Fi. The VPN is the only thing standing between you and disaster.
This is, in 2026, almost entirely a marketing invention. Here’s what’s actually happening.
What the VPN ad is selling you
The VPN industry is worth around $50 billion globally and growing fast. That money comes from convincing people they’re under active threat. The “hacker at Starbucks” scenario — a man-in-the-middle attack on public Wi-Fi — was a real concern in the early 2010s. It is largely irrelevant now.
The reason: HTTPS. In 2026, roughly 95% of web traffic is encrypted at the application layer. When you load your bank’s website, Gmail, Amazon, or any major service, your browser negotiates an encrypted connection directly with that server. Your ISP can see you’re talking to google.com. They cannot read what you typed or what came back. Neither can the person at the next table.
The danger VPN companies sell doesn’t match the threat landscape that actually exists.
What a VPN actually does
A VPN is genuinely useful for four things, and you should know all four before deciding whether to pay for one.
First: ISP privacy. Your internet provider can see which domains you visit (even with HTTPS). They sell this data in many countries, or hand it to governments on request. A VPN routes your traffic through the VPN provider’s server — your ISP sees encrypted traffic going to one address, not a list of every site you visited.
Second: IP masking. Websites you visit see the VPN server’s IP address, not yours. This makes it harder for sites to tie your visits together based on IP and harder for them to geolocate you precisely.
Third: Geo-restrictions. Connect to a server in another country and services think you’re there. This is how people access streaming libraries not available in their region. It works.
Fourth: there is a real but narrow benefit on public Wi-Fi — specifically, protecting against the small number of cases where someone is intercepting HTTP (non-HTTPS) traffic. It’s rare. But if you use apps that don’t use HTTPS properly, a VPN adds a layer. (The better fix is to stop using those apps.)
What a VPN doesn’t do
This is the part the ad skips.
A VPN does not stop Google or Facebook from tracking you when you’re signed in. These platforms know who you are — not from your IP, but from your account. Log into Gmail through a Mullvad VPN and Google still logs exactly what you do. The VPN is irrelevant to them.
A VPN does not stop tracker pixels from loading. Those tiny invisible images in emails and on websites phone home when they load, telling the sender that you opened something and where you roughly are. A content blocker like uBlock Origin stops this. A VPN doesn’t.
A VPN does not protect you from browser fingerprinting — websites identify your browser by its unique combination of fonts, screen size, and plugins. That fingerprint persists across sessions. A VPN changes your IP. Your fingerprint stays the same.
A VPN does not make you anonymous. This is important. You are now trusting the VPN provider instead of your ISP. If the VPN provider logs your traffic — or gets a court order they comply with — they can identify you. Some VPN companies that claim “no logs” have produced user logs when pressed.
And a VPN does nothing against phishing, malware, or data breaches. If you click a bad link or your credentials leak from a database, a VPN was never relevant.
The public Wi-Fi reality check
Your bank uses HTTPS. Gmail uses HTTPS. Instagram, your work email, Spotify, YouTube — all HTTPS. When you open your banking app at an airport, your connection is already encrypted end-to-end between your app and the bank’s servers. Adding a VPN adds a second layer of encryption on top of an already-encrypted connection.
The marginal security benefit on public Wi-Fi in 2026 is small. The VPN industry needs you not to know this.
What is a real risk on public Wi-Fi: captive portals — those browser pages where you click “agree to terms” before you get access. These load over HTTP and have occasionally been used to inject ads or malware. The other real risk is apps that don’t implement HTTPS properly, which still happens with some niche software.
When a VPN is genuinely worth using
There are clear situations where a VPN provides real protection.
If you’re a journalist, activist, or researcher in a country with surveillance infrastructure, hiding your browsing from your ISP matters. Governments that monitor internet traffic at the ISP level can build cases from browsing patterns alone. A trustworthy VPN meaningfully reduces that exposure.
If your ISP throttles streaming based on traffic inspection (some do), a VPN hides the content type and restores normal speeds. If you regularly travel internationally and need access to geo-restricted services at home, it works cleanly for that too.
For everyday consumer privacy in a country without aggressive ISP surveillance? The benefit is modest. Worth $5/month if you’re privacy-conscious. Not the essential life-safety tool the ads suggest.
How to choose a VPN that doesn’t spy on you
The free VPN category is almost entirely compromised. Free VPN providers need revenue. Their product is your browsing data. You’re solving a privacy problem by creating an identical privacy problem, just with a different company you know less about.
Three providers have independently audited no-logs policies and transparent ownership:
Mullvad — no account required (you get an account number, no email attached), accepts cash, multiple security audits. They can’t hand over what they don’t collect.
ProtonVPN — open source clients, audited no-logs policy, based in Switzerland. Run by the ProtonMail team.
IVPN — smaller, privacy-focused, audited, no dark-pattern pricing.
“No logs” means the provider doesn’t record which sites you visit. Ask what an audit actually covered before trusting the claim — some audits only verify internal processes, not whether logs can be generated at all.
Avoid any VPN with opaque ownership or one that has “partnered with” analytics companies. Free VPNs monetize your traffic data. That’s exactly what you’re trying to avoid.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.