What does a VPN hide, and from whom? Who still sees what

A VPN hides where your traffic is going from whoever runs your network: your internet provider, the Wi-Fi owner, your mobile carrier. It hides your IP address from the sites and apps you use. It does not hide who you are once you log in, and the VPN company takes over the view your provider had.

That last sentence is why the useful question is "from whom?" Here is the full map.

What does a VPN hide, and from whom?

Who is watching	Without a VPN they see	With a VPN they see
Your internet provider or mobile carrier	Every site name you connect to, when, and how much data	One encrypted connection to a VPN server, when, and how much data
The Wi-Fi owner (home router, cafe, hotel, school)	The same site names, tied to your device	The same single encrypted connection
Websites and apps	Your IP address, which gives your provider and rough location	The VPN server's IP address and location
Google, Meta and other accounts you are signed in to	Everything you do while signed in	Everything you do while signed in
Your employer, on a work device	Whatever its monitoring software records	Whatever its monitoring software records
The VPN company	Nothing	What your provider used to see
Police with a legal order	Records held by your provider and by the sites you used	Records held by the sites you used, plus whatever the VPN company keeps

Two rows do not change at all. Keep those in mind, because most disappointment with VPNs comes from expecting them to.

What does a VPN hide from your internet provider?

The list of sites you visit, which is the valuable part.

Most of the web is HTTPS now, so your provider already cannot read pages, passwords or messages. What it can read is the name of each site. Your device asks a DNS server for the site's address, and classic DNS lookups travel unencrypted. Then, when the browser opens the connection, it sends the site's name in plain text at the start of the handshake so the server knows which certificate to answer with. That field is called Server Name Indication, or SNI. Cloudflare's write-up on Encrypted Client Hello describes the problem directly: anyone sitting between you and the site can learn which site you are visiting from the first packet of the connection.

A fix exists. Encrypted Client Hello, standardized by the IETF as RFC 9849, encrypts that field. It only works when both your browser and the site support it, and many sites do not yet.

A VPN removes the question. Your DNS lookups and your handshakes travel inside the tunnel, so your provider sees one connection to one VPN server and nothing about what is inside it.

In the United States this matters more than people assume. The Federal Trade Commission studied six large providers and reported in October 2021 that several of them combine browsing data with other personal data to target advertising, and that the choices offered to customers were often hard to use. We go through the provider's view in detail in can my internet provider see what I search.

What your provider still sees with a VPN on:

That you use a VPN, and the IP address of the server you connect to
When you are online and for how long
How much data moves, in each direction

What does a VPN hide from the Wi-Fi owner?

The same thing, for the same reason. A router sits in the same position as an internet provider, one step closer to you. Whoever administers it can log the site names your device looks up. With a VPN on, the router logs one destination: the VPN server.

The router still knows your device is connected, its name on the network, and how much data it uses. A VPN does not make you invisible on the network. It makes your traffic unreadable to it. The router-side view, including what the admin page actually shows, is in can the Wi-Fi owner see my history.

What does a VPN hide from websites and from Google?

Your IP address, and with it your provider's name and your approximate location. The site sees the VPN server instead.

That is all it hides from them. Websites identify people in other ways, and none of them pass through the part a VPN changes:

Logins. If you are signed in to Google, Google records your searches against your account. The IP address they arrive from is a detail.
Cookies. A cookie set last week is still in your browser this week, VPN or not.
Browser fingerprinting. Your browser reports its version, fonts, screen size, time zone and graphics hardware. Together those are often unique.

So a VPN does not hide your search history from Google, and it does not make you anonymous to a site you log in to. It stops the site from learning your home IP address, which is useful on forums, on sites you do not trust, and anywhere your location is none of the site's business.

What does a VPN hide from your employer?

On your own device, on your own network: your employer sees nothing either way.

On a work laptop or a phone enrolled in company management, a VPN changes little. Monitoring software runs on the device itself and records activity before the VPN encrypts it. On the office network with your own phone, a VPN does hide your traffic from the network team, though they can see that you are using one. The device-by-device breakdown is in can my employer see my browsing history.

Does a VPN hide you from the police?

It changes who holds the records. It does not put anyone out of reach.

Without a VPN, an investigator with a legal order can ask your provider which sites your connection contacted. With a VPN, your provider can only say that you connected to a VPN server. The investigator can still go to the site itself, which knows the account you used, and to the VPN company, which can hand over whatever it keeps.

That makes the VPN company's logging the whole question, which brings up the row most people skip.

What can the VPN company itself see?

Everything your provider used to see: the names of the sites you connect to, when, and how much data. It cannot read HTTPS pages any more than your provider could.

You are not removing the middleman. You are choosing a different one, so read exactly what it says it records. "No logs" as a slogan tells you nothing. A statement that names what is recorded, what is not, and for how long can be checked against.

This is the standard we hold Secria VPN to. Secria VPN keeps no activity logs: we do not record browsing, DNS queries or traffic contents. While a session is live the service holds the account and device it belongs to, the server in use and the time it started, and that record is removed when the session ends. The servers run RAM-only, so nothing persists if one is powered off.

What does a VPN not hide?

Who you are on any account you sign in to. Covered above, and the most common misunderstanding.
Your GPS location. A phone app with location permission reads the GPS chip. The VPN changes your IP address, not your coordinates.
Your browser fingerprint and cookies. Those live in the browser.
What you paid for. Your card issuer sees the purchase.
That you are using a VPN. Your provider can tell, and many sites can too, because VPN server addresses are known.
Malware and phishing. A VPN carries a bad download as faithfully as a good one.
Your real IP address, if the browser gives it away. Browsers can expose local and public addresses through WebRTC, the technology behind in-browser calls. The IETF's RFC 8828 describes the case where WebRTC discovers both the VPN's address and the provider address underneath it.

See it for yourself in two minutes

You do not have to take any of this on trust.

Check 1: what the network and the site learn.

With the VPN off, open https://www.cloudflare.com/cdn-cgi/trace in your browser. It prints a few lines of plain text.
Note the ip= line (your real address), the loc= line (your country) and the sni= line. If it says sni=plaintext, the site name was readable by your network on the way there.
Turn the VPN on and reload. ip= and loc= should now show the VPN server. Your network no longer saw the request at all, only the tunnel.

Check 2: what the site still knows.

With the VPN on, open the EFF's Cover Your Tracks and run the test.
Read the fingerprint result. It will be the same with the VPN off, because the VPN does not touch it.

Those two pages show both halves of the answer: the VPN changed what the network and the site learn about your connection, and changed nothing about what your browser says about itself.

FAQ

Does a VPN hide your search history? From your internet provider and the Wi-Fi owner, yes. They see only the encrypted tunnel. From the search engine, no. If you are signed in, searches are saved to your account, and the history stored in your own browser is untouched.

Does a VPN hide your IP address? Yes, from the sites and apps you use. They see the VPN server's address. Your internet provider still knows your real address, since it assigned it, and so does the VPN company.

Does a VPN hide your location? It hides the location your IP address gives away, which is usually your city or region. It does not change GPS. A phone app with location permission still gets your real position.

Can my internet provider tell I am using a VPN? Yes. It can see a steady encrypted connection to an address that belongs to a VPN service. It cannot see which sites you visit through it.

Does a VPN hide what I do from the VPN company? No. The VPN company is in the position your provider was in. That is why its logging statement, in specifics, matters more than any other feature.

A VPN is good at one job: taking your browsing away from the network you are on and your home address away from the sites you visit. If that is the job you need done, Secria VPN is $7.99 a month on its own or included in Secria Pro.