Why You Should Use a VPN and How It Protects Your Data

Why you should use a VPN, and what it actually protects you from

A colleague pinged me last month from a hotel in Lyon. She'd connected to the lobby Wi-Fi to check her banking app, and by the time she'd finished her coffee, someone on the same network had scraped her session. Not because they were a genius hacker. Because the network was wide open and she was the easiest thing on it.

That story keeps coming back to me whenever someone asks whether a VPN is worth it. The short answer: yes, for most people, most of the time. The longer answer involves knowing exactly what a VPN does — and, just as importantly, what it doesn't. I've been running one on my own devices for years, and I've also had stretches where I stopped and paid the price.

So let's talk about why you should use a VPN, how it protects your data, and where the marketing claims quietly fall apart.

Do VPNs actually protect your data?

Yes — but only along one specific stretch of the road.

Here's the mechanism in plain terms. When you open a website without a VPN, your request travels from your device to your router, then across your ISP's network, then through a handful of intermediaries before reaching the site. At every hop, someone can potentially read where you're going and what you're sending. Your ISP in particular sees the full list of domains you visit. On an unsecured public network, so can anyone else sharing that connection.

A VPN builds an encrypted tunnel from your device to a server operated by the provider. Everything inside that tunnel is scrambled. Your ISP sees only that you're connected to a VPN server — not what you're doing once you're through it.

Two things get protected in the process:

• Your IP address, replaced by the VPN server's. Sites you visit see the server, not you.
• The contents of your traffic, unreadable to anyone between your device and that server.

And two things do not:

• Anything you do after the traffic exits the tunnel. If you log into your bank, the bank still knows it's you.
• Threats that never depended on intercepting your connection in the first place — phishing pages, malicious downloads, tracking cookies already sitting in your browser.

What a VPN does not protect you from

This is where the industry gets slippery. A VPN is not a shield. It's a rerouting with encryption attached.

If you click a link in a fake DHL email and type your password into a lookalike page, the VPN will faithfully encrypt that password as it travels to the attacker. It won't warn you. It won't block the page. I learned this the boring way years ago, when a client of mine got phished while his VPN was running — and he assumed, reasonably, that the VPN had him covered. It didn't. The breach came through his inbox, not his network.

Trackers are another blind spot. Plenty of them run inside the page itself, executing in your browser with cookies that persist between sessions. A VPN changes your IP, but the cookie still identifies you. That's why browser-level tools — tracker blockers, privacy-focused browsers, container tabs — do work a VPN simply can't.

Why is it important to use a VPN?

Because the internet was not built with your privacy in mind, and the parts of it that expose you most are the parts you use every day.

Think about what happens when you connect to a café's Wi-Fi. You join a network you don't control, shared with strangers you can't see. On that network, unencrypted traffic is readable. Even encrypted traffic leaks metadata: which domains you're reaching, roughly when, from where. A VPN closes that window.

Then there's your ISP. In many countries, providers are permitted — sometimes required — to log the domains their customers visit. Those logs sit somewhere, governed by a retention policy you didn't choose and can't inspect. A VPN doesn't make you invisible to your provider, but it does reduce what they can meaningfully record: the tunnel, not the contents.

The three situations where a VPN earns its keep

I'm not going to pretend a VPN matters equally in every context. It doesn't. Here's where I've found it genuinely useful:

1. Public and semi-public networks. Hotels, airports, coworking spaces, conference venues. Anywhere the network owner is unknown and the other users are strangers.
2. Working away from the office. If your employer runs a corporate VPN, use it — it's usually how remote access is granted, and it's built for that purpose. A personal VPN is a different tool with a different job.
3. Countries and networks that filter or throttle. A VPN won't defeat a well-funded state firewall, but it will get you past ISP-level throttling and many forms of content blocking.

Outside those, the benefit shrinks. At home, on your own encrypted router, visiting sites that all use HTTPS, the marginal gain of a VPN is smaller than the marketing suggests. Still real — your ISP's visibility drops — but smaller. Spoiler: that's why providers lean so hard on fear in their ads.

Is there a downside to using a VPN?

Plenty, and anyone telling you otherwise is selling something.

Speed. Every packet takes a detour through the provider's server, then gets encrypted and decrypted at each end. On a good provider and a nearby server, I typically see a drop in the 10–25% range. Route through a server on another continent and that number can triple. For browsing, you won't notice. For 4K streaming or large uploads, you might.

Battery and heat. On phones, the constant encryption and the persistent connection cost you. I measured it once on an older Android device: roughly 8% more battery drain over a day of mixed use. Newer hardware handles it better, but the cost isn't zero.

Trust. This is the big one. When you use a VPN, you're shifting your trust from your ISP to a company you've never met. You can't audit their logging policy. You can read their terms, look for independent audits, check whether they've been tested in court — and that's about it. A free VPN that monetises your data is worse than no VPN at all. I'll say that plainly.

Friction. Some banking apps, streaming services, and corporate portals block known VPN IP ranges outright. CAPTCHAs multiply. It's a small tax you pay on convenience.

A quick comparison

Here's how the main options stack up for a typical home user:

Situation	VPN needed?	Why
Home Wi-Fi, HTTPS sites	Marginal	Your ISP still sees domains; gain is real but limited
Hotel or café Wi-Fi	Yes	Untrusted network, unknown users, no visibility
Mobile data on public transport	Sometimes	Protects against carrier-level snooping and hostile hotspots
Corporate remote access	Yes, company VPN	Required for internal systems; not a privacy tool
Streaming from another region	Often blocked	Many services actively detect and refuse VPN traffic

Do I need antivirus if I have a VPN?

Yes, and thinking otherwise is the most common mistake I see.

A VPN and an antivirus operate at completely different layers. The VPN handles the journey — the network path between your device and a server. The antivirus handles what arrives at the destination and what's already living on your machine. Malware that gets onto your device through a download, a USB stick, or a compromised app doesn't care whether your traffic is encrypted. It's already inside.

Think of it this way. A VPN is a private road. An antivirus is the lock on your front door. Having a private road doesn't mean you can skip the lock.

What actually covers the gap between them:

• A reputable browser with tracker blocking, which handles the in-page tracking a VPN can't touch.
• Antivirus or the built-in protection on your OS, for anything that lands on disk.
• Password hygiene and two-factor authentication, which stop the vast majority of account takeovers.
• Keeping software updated, because unpatched bugs are still the most reliable way in.

Should you use a VPN all the time?

I do, on my laptop. On my phone, I switch it on for public networks and off at home, mostly to save battery. There's no rule that says always-on is correct.

If your threat model is ordinary — you're a professional who travels, uses public Wi-Fi, and wants your ISP to see less — an always-on VPN on your laptop and a situational one on your phone is a reasonable setup. If you're a journalist, an activist, or handling sensitive material, the calculus changes completely, and you should be reading threat-model-specific guidance, not a blog post.

What to look for before you install one

My short list, built from several years of switching providers and regretting a couple of them:

• An explicit, published no-logs policy — and independent audits backing it up.
• A jurisdiction that doesn't compel data retention. This matters more than people think.
• Kill switch on by default. If the tunnel drops, your traffic should stop, not leak.
• Transparent ownership. Who actually runs this company, and what else do they own?
• Paid, not free. Free means you're the product or the product is your data.

One more thing, and it's the part nobody puts in the comparison tables: the VPN is a tool, not a posture. It fixes one problem well. The rest of your digital hygiene still has to carry its weight.

If you take nothing else from this, take the framing. A VPN is worth using because it removes a specific class of exposure — untrusted networks, ISP-level logging, IP-based identification — and it does that job cleanly. But it's one layer in a stack, and the day you start treating it as the whole stack is the day you get caught out.

Which raises the question I keep coming back to: how many of us have installed a VPN, felt safer, and then done nothing else? That's the trap. The tunnel is only as good as what you do at the other end of it.