The internet is an indispensable part of modern life, but with its convenience comes security risks from outside actors who want to track your every online move.
You may have heard that a virtual private network is one way to protect against these risks, but many internet users don’t fully understand the consequences of not using one. According to a recent CNET survey, less than half of Americans report using a VPN.
But spending time online without a VPN leaves your digital life vulnerable to myriad forms of digital prying. “It’s no different than driving a car without a seatbelt on,” especially if you’re using a lot of public Wi-Fi networks, says Fred Kwong, vice president and chief information security officer at DeVry University.
“[A] VPN is just a great way to help you have better cyber hygiene,” Kwong says.
Here’s what you need to know about the risks of not using a VPN, and why you might want to start.
Your internet provider might be snooping on your activity
Believe it or not, the company that provides your internet service might be collecting a good bit of data on you.
“This is honestly a big issue right now,” says Marijus Briedis, chief technology officer at NordVPN.
Your ISP might be tracking your location, the dates and times that you’re connected to the internet and even which websites you’re visiting. VPNs funnel your activity through an encrypted tunnel so no one, even your ISP, can see what you’re doing while you’re online. Briedis says some ISPs also hand that information over to governments or sell it to third parties.
ISPs can even be subpoenaed in court to hand over this data, Kwong says, which could create a privacy risk.
Security risks on public networks
VPNs can provide an additional layer of protection to a public Wi-Fi browsing experience.
Cybercriminals — or “threat actors” — can break into your connection on an unsecured public network and collect that data or even pose as a fake public network for the express purpose of stealing your data, Kwong says.
However, the risk of hackers stealing passwords and credit card numbers on public Wi-Fi is less prevalent now due to widespread use of HTTPS to secure sites handling sensitive information, said Attila Tomaschek, CNET’s resident VPN expert. While the risk of fake public networks or “evil twin hotspots” is real, a VPN won’t protect you from directly sending data to cybercriminals, Tomaschek said. If you’re redirected to a phishing site and you input your personal information, for example, a VPN can’t protect you here. However, a VPN can keep the websites and services you’re using hidden from anyone trying to snoop on your internet activity.
The primary concern with public Wi-Fi is that network administrators or ISPs might track your browsing activity and sell your data to third parties, Tomaschek says.
Geographic and content restrictions
You may have noticed that you can no longer access certain online content when traveling to other states or countries. These geographic restrictions are based on your IP address, which contains information about your general location, and which websites use to determine what content you can access.
Surfing the web without a VPN in certain regions might subject you to government-imposed restrictions on online content and social media platforms. While such content restrictions are a big issue in many countries, it’s not an issue in the US — currently. What most Americans are concerned with is geographic restrictions on streaming, which is typically dictated instead by regional copyright laws and licensing agreements between studios and streaming services.
A VPN can circumvent this by bouncing your web traffic off a server in a different location. But Kwong says this is not always the case. “In theory, that is true, but a lot of the content providers are also smart enough to know you’re using some sort of VPN service and might block the content anyway,” he says.
It’s an ongoing battle between VPN services and streaming services, Tomaschek says. Streaming services try to block IPs they know belong to VPNs, and the VPNs are constantly acquiring new IP addresses to circumvent those blocks.
That’s why, at CNET, we make sure to test geo-unblocking capabilities for every VPN we review so we get a good idea of which ones do so consistently across locations and services. ExpressVPN, for example, has demonstrated to be one of the best for streaming.
We recommend checking your streaming service’s terms of service agreement to ensure you’re not violating it by using a VPN.
Online tracking and profiling
When you see targeted ads online, it’s a result of various tracking techniques that help advertisers learn about you. That information sticks around unless you request its removal or subscribe to data removal services to scrub it for you.
When you’re not using a VPN, these advertisers can see your IP address (and therefore general location), which might lead to you seeing certain ads or prices online.
Using a VPN can block the collection of some, but not all, of this information, Briedis says. Advertisers also use tools like cookies or JavaScript, which a VPN cannot protect you from.
But if you suspect prices for a flight or hotel might be cheaper from a different country, you could use a VPN to “trick” online retailers into thinking you’re buying from somewhere else.
Tomaschek says in his experience while testing this theory out, he wasn’t able to find significant price differences when trying to use a VPN for price hacking. “That’s not to say that it can’t be done. I just haven’t had much success in my limited, anecdotal testing with it,” he said. “You may need to be persistent in your efforts to find deals in this way.”
The bottom line
At the end of the day, not using a VPN exposes you to a range of threats, from privacy invasion and targeted ads to serious security vulnerabilities.
The best VPN services cost money. But Kwong sees them as a worthwhile investment in your cyber hygiene and the security of your most sensitive information.
Our VPN experts have found that most free VPNs pose risks, including weak encryption, data harvesting, and malware, as well as crowded servers and bandwidth limitations. The only free VPN we currently recommend is the free tier offered by Proton VPN. It offers the same basic privacy protections as the premium plan, without bandwidth or usage limitations; however, the trade-off is fewer servers and simultaneous connections.
Ultimately, VPNs give you an essential extra layer of privacy by encrypting your online traffic and hiding your IP address, giving you more control over your online experience. However, they’re only one piece of the larger cybersecurity puzzle, which should also include services like antivirus and password managers.
