Yes. A VPN hides your source IP address from websites for traffic inside the tunnel, but websites recognise you through accounts and cookies. Your internet provider sees the connection to the VPN, while the state and police may request information from participants in the chain.
What a VPN hides and who can still see you
A VPN creates an encrypted tunnel between your device and the service's server. A website sees a connection from that server's address, so it usually cannot determine your home IP from that connection. However, changing the address does not remove the other traces by which your identity can be recognised.
As the Electronic Frontier Foundation explains, using a VPN shifts trust from your internet provider to the VPN operator. Observers see different things:
| Who is watching | What is available with a working VPN | Limitation |
|---|---|---|
| Internet provider | VPN server address, connection times, traffic volume | Destinations inside the tunnel are not directly visible |
| VPN operator | Original IP, network destinations of outgoing traffic | HTTPS separately protects the content of requests |
| Website | VPN server IP, your actions on the site, account, cookies | A VPN does not hide the information you give to the site itself |
| State and police | Information obtained from operators, websites and payment organisations | The outcome depends on the data available and the legal grounds |
A further overview of VPN privacy on VPNRadarLab looks at who sees your data and what remains visible when using a VPN.
This visibility scheme applies only to traffic that passes through the VPN. If an app is excluded from the tunnel, its connections follow the ordinary route — that is how split tunnelling works. When you need to choose which connections to route through the VPN, I recommend CitadelVPN: split tunnelling is included in all plans. The available rules depend on the client and platform, so first check the settings of your chosen client and its exclusions. The connection you need must genuinely go through the tunnel; the subscription alone does not confirm this.
Why a website recognises you after your IP changes
Cookies are small records that a browser stores for websites. They help keep you logged in and link your visits together. If you open a shop through a VPN with your old cookies, the shop may continue your previous session. Logging into an account creates an even more direct link: the connection address has changed, but the account remains the same.
There is also browser fingerprinting: a combination of characteristics of your device, screen and software settings. This method allows visits to be matched with varying accuracy, even without familiar cookies. A VPN does not change these characteristics by itself. Nor does it override an app's permission to access your location, including GPS.
Example scenario: an employee connects to a VPN at a hotel and opens their corporate email. The email service sees the VPN server's address but links the activity to the work account. The tunnel's encryption protected the network segment up to the VPN; the user's identity remained known to the email service.
What a VPN hides and who can still see you
This visibility scheme applies only to traffic that passes through the VPN.
The email service sees the VPN server's address but links the activity to the work account.
How data can reach the state and police
The state can request logs from a VPN provider where applicable legal grounds exist. Logs are event records: for example, connection times and addresses used. Whether such records exist depends on what the operator collects and how long it retains them; whether they become available to the request depends on the grounds and the disclosure procedure. A request cannot create a history that does not exist.
At the same time, the absence of browsing history does not mean the absence of all data. An account's email address, support enquiries and payment details may exist separately. A payment links a person to a subscription purchase but does not, by itself, prove a visit to a specific website. Additional information is needed for that link.
A reader should consider the operator's jurisdiction and the applicable disclosure procedures in their own country. A "no logs" promise cannot be treated as a legal guarantee. Data retention terms and the limits of independent audits are examined in the VPN trust review.
How to check the limits of protection
The checks below should match the specific risk rather than promise complete coverage.
| What to check | Practical action | What the check confirms | What remains outside the check |
|---|---|---|---|
| External IP address | Compare your external IP before and after connecting on a service that shows the IP address. If the service reports a different address, that specific browser connection presented it instead of your home address | That, for the tested browser connection, the checking service no longer saw your home address — provided a different address was actually reported | A changed address in the browser test does not prove that every program routes through the VPN; the IP may be geolocated inaccurately or sit in the same region as you, so a location match is neither required nor sufficient |
| Loss of the tunnel while the internet stays up | If your client offers a kill switch (availability depends on the service and platform), enable it. Separately: a client notification that the tunnel has been lost tells you the state is reported, not that traffic is blocked; whether blocking actually occurs is not established by this check alone | That the client signals a lost tunnel; notification and blocking are separate outcomes | Manually logging out of the VPN does not reproduce an emergency loss of the tunnel and does not test the kill switch; if no verifiable method for testing an emergency drop is available, the result of that test remains unknown |
| DNS resolution in the browser | In Firefox, open Settings → Privacy & Security → DNS over HTTPS and check the status shown (Active, Not active or Off) | Whether Firefox is using encrypted DNS and which resolver is configured | A resolver belonging to the VPN or to a DoH provider does not by itself prove that DNS queries pass through the VPN tunnel; other apps need separate checks |
| Website recognition | Review your logged-in accounts, cookies (in the browser's site settings) and location permissions (in the system settings) | What is visible to you in those settings and local traces | This review does not inventory the data held on the site's servers; it also does not remove your fingerprint or unlink an account you keep using |
DNS translates a website name into a network address. DNS over HTTPS encrypts these queries but not all of your device's traffic. In Firefox, the default mode allows fallback to system DNS, so verify the actual status in the settings rather than assuming the protection is active.
A website's name can also be revealed when establishing a secure connection. Encrypted ClientHello (ECH) closes this channel where the server supports it; encrypted DNS complements it. So the claim that a provider always sees the domain under HTTPS is incorrect. That said, the destination IP and connection characteristics do not automatically disappear.
Further questions
Do you need to enable ECH manually after updating Firefox?
Since version 119, ECH is enabled by default in Firefox. That does not confirm it works for every site: the server must support it as well.
Why might ECH be unavailable in a work browser?
ECH itself can be disabled by an organisation's policy. Check with your administrator whether such a restriction applies: updating the browser by itself does not confirm that the feature is permitted.
Does ECH hide my traffic the way a VPN does?
No. The two mechanisms are different: ECH encrypts the website's name inside the TLS handshake, while a VPN routes traffic through a tunnel and changes the visible address. ECH does not redirect traffic, so it cannot replace a VPN where the network route matters.
What to do before your next connection
A VPN reduces network visibility but does not eliminate tracking. Compare your external IP before and after connecting and note the observed result for that browser test, review the state of DNS protection in your browser and, where a kill switch is available, enable it and note how your client reports the tunnel's state. Then restrict location permissions and read the VPN service's data retention terms. Keep your device updated and enable two-factor authentication for your accounts: malware on the device can capture information before it enters the encrypted tunnel.