How to Choose a VPN Without Getting Burned

VPN marketing works because it sells an emotion rather than a capability. The pitch is that you are exposed and a subscription fixes it. What the subscription actually does is narrower than that, and knowing the boundary is the difference between spending $5 a month usefully and spending it as a placebo.

Start with your threat model, not with a provider

A VPN does exactly one thing: it moves the point at which your traffic enters the public internet from your ISP to the VPN provider. That is it. Everything else is a consequence of that one change.

So the question is always: who are you hiding the destination from?

That last row is the one people get wrong. If you are the specific target of an investigation with resources, a commercial VPN is not a defence. Traffic correlation, endpoint compromise, and legal process all defeat it. VPNs protect you from mass collection, not from being singled out.

The free VPN business model problem

Running a VPN costs money: servers, bandwidth, and the staff to keep them running. If you are not paying, someone is.

The three ways free VPNs pay for themselves:

1. They sell your data. Not usually your traffic contents, which are encrypted, but your connection metadata: which IP connected when, to which destinations. That is commercially valuable and it is exactly what you were trying to hide.
2. They show ads, aggressively. Some inject ads into pages, which is worse than tracking because it modifies content in transit.
3. They are a funnel. The free tier is bandwidth-capped or time-limited, designed to convert you to paid. This is the most honest model of the three, and it still means the free tier is not usable for anything real.

There are exceptions, mostly research projects and providers using a free tier as marketing with genuinely usable limits. But the default assumption should be that free means you are the product.

What "no logs" actually means

Every provider claims no logging. The claim is unverifiable by design, because the only party who could verify it is the one making the claim.

There are three levels of evidence, in increasing order of usefulness:

Nothing. A policy page saying "we keep no logs". This is a promise.

An audit. A third-party firm examined the infrastructure and wrote a report. This is better, but audits are point-in-time and scope-limited: an audit of a server configuration says nothing about whether the company responds to legal requests with data it holds elsewhere.

A structural argument. The provider can show that it cannot produce logs because it does not have the ability to associate an account with activity. Mullvad's approach, where accounts are random numbers and payment can be cash, is the strongest version of this, because the data does not exist to be subpoenaed.

When you compare providers, weight the third category far above the second, and ignore the first entirely.

Streaming and privacy are different products

A provider that unblocks Netflix is doing something technically specific: it maintains IP ranges that streaming services have not yet blocked, and it plays a continuous cat-and-mouse game. That work costs money and it has nothing to do with privacy.

The consequence is that the two goals pull in opposite directions. A provider optimised for unblocking needs lots of IPs that rotate constantly and are shared by many users. A provider optimised for privacy wants stable infrastructure and as few users per IP as possible.

Some providers do both, badly. If you need streaming unblocking, choose on that and accept weaker privacy claims. If you need privacy, choose on that and accept that Netflix will not work.

When a VPN is the wrong tool

For accessing your own devices, use a mesh network like Tailscale instead. It connects your laptop to your home server without exposing anything to the internet, and it is a different and better tool for that job.

For protecting a small business's internal tools, use a zero-trust access product rather than a traditional VPN. The model is per-application authorisation rather than network-level access, which means a compromised laptop does not get you the whole network.

For avoiding tracking by websites, a VPN barely helps. Cookies, fingerprinting, and logged-in sessions identify you regardless of your IP. A browser with tracker blocking does more.

What to actually check before paying

1. Who owns it. VPN companies are acquired quietly. An independent provider that gets bought by an ad-tech company does not announce it loudly, but the privacy policy changes within a year.
2. Where the servers are and who runs them. Rented rack space in a datacenter is normal. Servers in a jurisdiction with mandatory data retention are a problem regardless of policy.
3. Whether the payment can be anonymous. If they only take cards, they have a payment trail tied to your identity, which undermines the point.
4. The protocol. WireGuard is the current default for good reasons: faster, simpler, less code to have bugs in. Anything proprietary deserves scrutiny.
5. Whether they have ever been audited, and what the audit covered.

The short version

If you want to stop your ISP seeing your browsing, almost any reputable paid provider works and the differences are minor. If you want to avoid mass surveillance, pick one with a structural no-log argument and anonymous payment. If you want to reach your own machines, use a mesh VPN. If you are a specific target, a VPN is not the answer and buying one will give you false confidence.

The most common mistake is buying a VPN for a threat it does not address. The second most common is buying a free one for a threat that requires a paid one.