No product in the privacy space is marketed as hard, or as wrongly, as the consumer VPN. The pitch is some version of "stay anonymous and secure online." A VPN does a specific, useful, narrow thing - and almost none of what the sponsorships imply. The honest way to understand one is not a list of features but a question: who are you hiding from, and what, exactly, does the tunnel change about what that party can see? Answer it one adversary at a time and the real shape of the tool appears.

[INFO]
This is the honest counter to a genre of marketing, not a VPN recommendation. A VPN is a good tool for a few jobs and useless or counterproductive for others. The interactive matrix below lets you pick an adversary and watch what actually moves.
◈ interactive artifact
What a VPN Changes, by Adversary
Choose an adversary and see, asset by asset, what a commercial VPN hides, what it leaves untouched, and the one place it simply relocates the risk.

//What a Tunnel Is

A commercial VPN wraps all your device's traffic in an encrypted tunnel to a server the provider runs, and that server forwards it to the internet. From the outside, your traffic appears to come from the server's IP address, not yours. That single mechanism explains everything a VPN can and cannot do. It changes who sees your traffic on the path between you and the VPN server. It changes nothing about the two endpoints: your device, and the site you are actually talking to.

//The One Real Win: Your ISP and the Local Network

Without a VPN, your internet provider sees every destination you connect to - not the contents of HTTPS pages, but the fact that you reached them, by IP and by the cleartext server name in each connection. A VPN hides that. Your ISP, and anyone snooping the same Wi-Fi, now sees only an encrypted tunnel to the VPN server and cannot read your destinations. This is genuine and worth having if your ISP logs and sells browsing records, or you are on a hostile network.

But notice the asymmetry in the matrix. Your ISP does not stop knowing it is you - it assigned your address, it can see you are connected to a VPN. And the destinations it used to see have not vanished. They have moved.

//Trust Is Relocated, Not Removed

This is the part the ads skip. Everything your ISP could previously see about where you go, the VPN provider can now see instead. You have not deleted the trusted middleman from the picture; you have swapped one - your ISP, a company you have a contract and a billing relationship with - for another, a VPN company whose "no-logs" promise you cannot verify from the outside and which can be compelled by legal process the same way an ISP can.

[WARNING]
"No-logs" is a claim, not a property you can check. A handful of providers have had the claim tested in court or by third-party audit; most have not. Treat it as a statement of intent from a company you are choosing to trust, because that is exactly what it is.

//What a VPN Does Not Touch at All

The tunnel ends at the VPN server. Above it, at the application layer, a VPN is simply not in the conversation.

The site still decrypts your traffic

HTTPS already encrypts your traffic end to end between your browser and the site. A VPN does not add privacy from the site - the site is the other end of the encryption, so it reads everything you send regardless. The "military-grade encryption" in the ad is encrypting a leg that, for the content that matters, was already encrypted.

Logging in erases the anonymity

The moment you sign into an account, you have told the site exactly who you are, VPN or not. Using a VPN while logged into a real identity - your bank, your email, your social accounts - adds nothing, and can trip fraud detection when your apparent location jumps across the world.

Tracking and fingerprinting ignore the network

Cookies, logins and your browser fingerprint are how you are actually followed between sites, and all three live inside the page, above the network. A VPN muddies crude IP-based tracking by giving you a shared exit address, but it does nothing about the mechanisms that do the real work. This is why "a VPN stops tracking" is the single most misleading claim in the category.

//So When Is a VPN Actually the Right Tool?

Three honest use cases. Hiding your destinations from an ISP or a hostile local network. Hiding your home IP from the sites you visit, where that matters to you. And appearing to be somewhere else, for geography-locked content or to test how a service behaves from another country. That is a real and useful list. It is just a much shorter one than "anonymous and secure," and it is worth knowing which column your reason actually sits in before you pay for a subscription.

[TECHNICAL NOTE]
A clean way to hold it in your head: a VPN moves the boundary of who can watch your traffic one hop further out, from your ISP to your VPN provider. It does not make you anonymous, it does not add security the site side already had via HTTPS, and it does not reach the trackers. "Secure against whom" is the only question that makes the answer legible - the same lesson as the threat-model picker.

//Sourcing and Framing

The matrix is built from the behaviour of the protocols, not from any provider's claims. The "trust is relocated to the provider" framing, the point that a VPN cannot provide anonymity, and the warning that it does nothing against trackers or logged-in identity all follow the analysis published by Privacy Guides, which argues most people do not need a VPN for the reasons they think they do. The HTTPS reasoning - that the destination site is the encryption endpoint - is standard TLS. Where this piece states an opinion rather than a fact, it is this: the category is sold on the one use case (hostile-network destination hiding) to imply the others, and the gap between the two is where people are misled.