A VPN can improve some aspects of your privacy, but it also gives its provider a role in handling your internet connection. That doesn’t mean every VPN can read everything you do online or that every provider misuses user data. The key questions are what a provider can observe, what it records, and how long it keeps that information.
The 2015 Hola VPN controversy shows why those questions matter. Hola’s peer-to-peer service could route other users’ traffic through participating devices. Later, the company’s CEO acknowledged that Hola had not made this arrangement clear enough to users. (BBC’s report on Hola’s peer-to-peer network)
So the key question isn’t just, “Can a VPN see my data?”
It’s also: What can the provider technically see, what does it actually record, and how long does it keep that information?
Do VPNs Really Protect Your Privacy?
A VPN can improve your privacy in specific ways. It routes your internet traffic through a VPN server, which can keep your ISP from seeing your usual browsing activity. Websites you visit through the VPN typically see the VPN server’s IP address instead of your device’s public IP address.
On public Wi-Fi, a VPN encrypts traffic between your device and the VPN server. That can make it harder for other people on the same network to inspect that part of your connection. HTTPS already encrypts the contents of most modern web connections, however, so a VPN does not replace secure websites, safe browsing, or an up-to-date device.
None of this makes you completely anonymous. Your traffic still passes through the VPN provider’s infrastructure, and the provider may be able to observe some information about your connection.
To understand the privacy trade-off, separate three questions: what a provider can observe, what it chooses to log, and what it keeps over time.
How a VPN Works
Your device connects to a server operated by your VPN provider. The VPN creates an encrypted tunnel between your device and that server. Someone who intercepts traffic on this part of the connection generally cannot read the tunnel’s contents.
Next, the VPN server connects to the website or service you want to reach. That destination typically sees the VPN server’s IP address, rather than your own.
For a closer look at how encryption works, read our guide to understanding VPN encryption.
A VPN doesn’t make your traffic disappear. Instead, it changes the route your traffic takes—and who handles it along the way. Your connection passes through the provider’s infrastructure before it reaches its destination. That’s how VPN technology works, and it’s why the provider’s practices matter.
Can a VPN See What Websites You Visit?
A VPN provider may be able to identify some of the websites you connect to. The exact information depends on how your device handles DNS requests and how the connection works. Other connection details may also offer clues about your online activity.
HTTPS protects the contents of your connection. When you visit an HTTPS website, the VPN provider generally cannot read your password, messages, or the specific pages you view.
The provider may still see or infer details such as your real IP address, connection times, data volume, DNS requests, or the destination server’s IP address. DNS settings and other privacy features can affect which details the provider sees.
Knowing that you connected to a website is not the same as reading what you did on it. Keep that distinction in mind when you evaluate a VPN’s privacy claims.
Can a VPN Track You?
Potentially, but “track” can mean different things.
A VPN provider can see the IP address that connects to its service. Depending on its systems and logging practices, the provider may also process or record when you connected, how much data you transferred, which VPN server you used, or which DNS requests your device made.
If the provider stores these records and links them to an account or device over time, they could help build a picture of how you used the service. But the provider’s ability to process information does not automatically mean it stores that information.
A “no-logs” claim also needs context. Providers may define “logs” differently, so check what the privacy policy says the company collects, retains, or excludes. An independent audit can offer useful evidence, but it covers only the systems and practices within its scope at the time of the audit. It cannot guarantee that the provider will never change its practices.
A VPN also doesn’t stop every kind of online tracking. Websites, apps, and advertisers may still recognize you through cookies, account logins, browser characteristics, or fingerprinting.
A VPN can change or conceal some information linked to your connection, but it doesn’t remove every identifier associated with you.
Is Using a VPN Really Safe?
A reputable, well-maintained VPN can help improve some aspects of your privacy and connection security. But asking whether “a VPN” is safe in general doesn’t tell you much.
A more useful question is:
Is this particular VPN, from this particular company, trustworthy enough for the information I’m routing through it?
VPN providers differ in their privacy policies, security practices, ownership, and business models. A provider that clearly explains its practices and supports its claims with credible evidence deserves a different assessment from an unknown app that makes sweeping promises without explaining how it handles data.
The Hola case is one reminder that the provider—and the way it designs its service—matters as much as the technology itself.
Can a VPN Steal Your Data, Like Passwords and Credit Card Numbers?
A VPN sits on the route your internet traffic takes, but that does not mean it can automatically read every password or credit card number you enter.
Most modern websites that handle logins or payments use HTTPS. Your browser or app establishes an encrypted connection with the destination service. The VPN carries that connection, but it generally does not have the keys to read its contents.
More realistic privacy risks may involve the information a provider collects about your connections, how long it keeps that information, how securely it stores it, or whether its practices match its privacy claims.
The UFO VPN case illustrates why those questions matter. In 2020, researchers reported that an exposed database linked to UFO VPN and several other VPN services contained user information and activity records, despite the services’ no-logs claims. (ESET’s report on the exposed VPN databases)
The concern wasn’t that researchers had broken HTTPS and recovered everyone’s passwords from secure website connections. Instead, the concern was that someone could access information the VPN services had stored.
When you use a VPN, you’re choosing to trust its provider with information about your internet connection.
What Data Can a VPN Provider See?
A provider’s technical design and configuration determine what it can observe. Its logging practices determine which information it stores.
Depending on the service, a provider may process or observe:
- Your public IP address: Your device connects to the VPN server, so the provider can see the IP address your connection comes from.
- Connection times: The provider may be able to determine when you connect or disconnect. Whether it records this information depends on its practices.
- Bandwidth usage: It may measure how much data passes through your VPN connection.
- The VPN server you use: The provider can generally identify which of its servers your device connects to.
- DNS requests: If the VPN handles your DNS requests, those requests may reveal the domains your device looks up.
- Other connection details: This may include timing, data volume, and destination IP addresses.
- Unencrypted traffic: If a service uses HTTP instead of HTTPS, systems handling the connection may be able to read the information it carries.
A provider’s ability to process information does not mean it stores that information. It may handle some details temporarily and discard them, or design its systems so they never save certain data.
To understand how a provider handles your information, look beyond its marketing claims. Review its privacy policy, technical design, independent audits, and track record.
What About VPN Data Breaches?
A VPN can protect traffic as it travels through an encrypted tunnel, but that does not make the provider’s own systems immune to attacks.
If attackers compromise a provider’s systems, they may access sensitive information the company has stored. This is one reason data minimization matters: information a provider never retains cannot sit in its systems waiting for a breach.
In July 2026, Bitdefender reported that researchers had analyzed a leaked database allegedly linked to SplitVPN, formerly known as NotVPN. The report described nearly 58 million records of connections between devices and VPN servers, covering June 2025 through July 21, 2026.
Bitdefender said those records did not show which websites users visited. Instead, they could connect a device or account to a VPN server at a particular time. The report also described exposed information such as email addresses, recent IP addresses, device identifiers, approximate locations, subscription details, and some payment-related data. SplitVPN had not publicly confirmed the incident at the time of the report. (Bitdefender’s report on the SplitVPN database)
That distinction matters. The reported concern was not that someone had cracked the VPN tunnel and recovered users’ browsing activity. Rather, attackers may have accessed connection records and other information stored in the provider’s systems.
The report also raises a reasonable question about “no-logs” claims: what does a provider mean by “logs,” and do its systems and practices match that definition?
VPN encryption protects data while it travels through the tunnel. It does not automatically protect information the provider chooses to store.
How a VPN Provider Could Misuse Your Data
Documented concerns about VPNs often involve less dramatic risks than someone stealing passwords from HTTPS websites. Examples include:
- Collecting or using browsing data: Facebook presented Onavo Protect as a security and privacy app. Facebook also used Onavo data to learn about app usage and inform product decisions. Apple removed the app from its App Store in 2018 after concerns about its data-collection practices. (CNBC’s report on Apple’s removal of Onavo Protect)
- Routing traffic through users’ devices: Hola’s peer-to-peer model allowed other people to use participating users’ bandwidth through its network. The case highlighted the importance of explaining how a service uses users’ devices and connections. (BBC’s report on Hola’s peer-to-peer network)
- Keeping data despite no-logs marketing: The 2020 report on UFO VPN and several other services described exposed user information and activity records. (ESET’s report on the exposed VPN databases)
- Exposing data through weak security: A provider may not intend to misuse user information, but poor security can still put stored data at risk.
- Making ownership hard to verify: If a VPN’s ownership remains unclear, users may find it harder to determine who controls the service and handles their data.
These examples do not mean every VPN behaves this way. They show why “VPN = private” isn’t enough to evaluate a service. A provider’s business model, ownership, technical design, data-retention practices, and track record all matter.
What a VPN Cannot Protect You From
A VPN can help with some network-privacy risks, but it cannot act as a general-purpose security shield. It generally cannot protect you from:
- Phishing: A VPN won’t stop you from entering your password on a convincing fake website.
- Malware: A VPN does not make a malicious download safe.
- Compromised accounts: It can’t prevent someone from using stolen credentials to access your account.
- Website or app tracking: Services may still recognize you through account logins, cookies, or browser characteristics.
- Social engineering: A VPN can’t stop someone from tricking you into sharing sensitive information.
- Data a service already holds: Connecting through a VPN does not erase personal information a website or app already has.
- Poor device security: An outdated operating system, vulnerable browser, or compromised device can still put your data at risk.
A VPN mainly changes the privacy and security characteristics of your network connection. It does not replace software updates, strong passwords, multifactor authentication, careful browsing, or other basic security practices.
Can a Fake VPN App Collect Your Data?
Yes. Some fake or malicious VPN apps aim to collect information or expose users to other risks. They may imitate legitimate providers with similar names or logos, make unrealistic privacy promises, request unnecessary permissions, display intrusive ads, or redirect traffic.
What information might a risky app collect?
Depending on the app and how it works, it may access information such as:
- Your public IP address and approximate location
- Device or account information
- DNS or connection activity
- Information you enter into the app, including email or payment details
- Data sent over unencrypted connections
- Information exposed through permissions the app requests
A VPN app generally does not need access to your contacts, photos, microphone, messages, or precise location just to create a VPN connection. Treat requests for unrelated permissions as a warning sign unless the developer gives a clear, credible explanation.
Warning signs of a fake or unsafe VPN app
An app-store listing alone does not prove that an app is trustworthy. Check that the developer’s name matches the VPN provider and, when possible, use the download link on the provider’s official website.
Warning signs can include:
- An unknown or unverifiable developer
- A name or logo that imitates a legitimate VPN
- A missing privacy policy or support contact
- Requests for permissions unrelated to the VPN’s stated function
- Aggressive ads or unexpected redirects
- Unrealistic claims about complete anonymity
- Unclear pricing or unexpected subscription charges
- Few authentic reviews, or a sudden flood of repetitive reviews
What to do if you installed a suspicious VPN
If you think you installed a fake VPN, consider taking these steps:
- Disconnect from the VPN and uninstall the app.
- Remove any VPN or configuration profile it installed. Apple explains how to review and delete configuration profiles.
- Scan your device for harmful software. Android users can use Google Play Protect.
- Review and revoke app permissions that you no longer need.
- Change passwords for sensitive accounts if you entered them while using the app. Start with your email and financial accounts.
- Enable multifactor authentication wherever it is available.
- Review bank and payment statements if you entered payment information.
- Check for unfamiliar apps or device settings that may have appeared.
- Install a legitimate VPN only from the provider’s official website or verified app-store listing.
If you reused the same password on other services, change it there too. Start with your email account, since access to email can make it easier to reset passwords elsewhere.
A fake VPN may fail to protect your connection—and could create another way for someone to collect information.
Can All VPNs Be Trusted?
No. VPN providers differ in how they handle privacy and security.
Some explain who owns and operates the service, describe their data practices clearly, and support their claims with independent audits or other evidence. Others share little about their ownership, systems, or data-retention practices.
Before you trust a provider with your everyday traffic, look for:
- A clear privacy policy that explains what information the provider collects, why it collects it, and how long it keeps it.
- Independent assessments of relevant privacy or security claims. Check what the auditor examined, who conducted the assessment, and when it took place.
- A meaningful track record, including how the company handled past security or privacy incidents.
- Security features that fit your needs, such as a kill switch and DNS leak protection. These features can help limit exposure if a VPN connection drops or DNS traffic bypasses the tunnel. Learn more about what a VPN kill switch does.
- Transparent ownership, so you can identify the company responsible for the service.
- Evidence beyond marketing claims, such as audit reports, security assessments, and credible reporting.
No single feature or audit can guarantee that a VPN is trustworthy. If a provider cannot answer basic questions about data collection and security, take a closer look before using its service.
Why We Don’t Recommend Most Free VPNs
Not every free VPN is automatically unsafe. The concern is that its business model may be less obvious than a subscription-based service’s.
Running servers, maintaining infrastructure, and securing a VPN service cost money. If a company doesn’t charge users directly, it may rely on another source of revenue. That does not prove the company sells user data, but it is reasonable to ask: How does this VPN make money?
Darktrace’s analysis of Hola-related proxy activity offers one example of why that question matters. Hola’s peer-to-peer model allowed the service to route traffic through users’ unused bandwidth. The concern wasn’t simply that Hola was free; it was whether users understood how the service could use their devices and connections.
Some reputable providers offer limited free plans. Still, an app-store listing alone may not tell you enough about a VPN’s privacy practices.
If privacy is your main reason for using a VPN, a paid plan from a provider with transparent practices and credible independent scrutiny may be easier to evaluate. For more detail, read our guide on whether it’s safe to use a free VPN.
Bottom Line
A VPN does not inherently steal your data. The risks depend on what a particular provider can observe, what it collects, how long it keeps that information, how securely it stores it, and whether its practices match its claims.
HTTPS generally protects the contents of your connection from the VPN provider, but the provider may still process connection metadata. A data breach can expose information the provider has stored, and a fake VPN app can introduce additional risks.
The cases involving Hola, UFO VPN, Onavo, and SplitVPN show why you should evaluate more than encryption alone. Look at a provider’s data practices, privacy policy, ownership, security design, independent assessments, and track record.
A VPN changes the route your network traffic takes. It does not make you anonymous, eliminate website tracking, or protect you from every online threat. Understanding that distinction helps you decide what you’re trusting a VPN to do.
You May Also Like
Computers & PC GamesDoes a VPN Really Improve Minecraft Ping and Performance?
VPNs & ProxiesWhy You Should Use a VPN for Minecraft Servers
VPNs & ProxiesWhat Is a VPN Kill Switch and Why Is It Important?
Computers & PC GamesIs RomsFun Safe and Legit? My Complete Review and Testing Experience
VPNs & ProxiesHow to Hide Your IP Address and Protect It: 5 Best Ways
VPNs & Proxies