What does a VPN really hide, and from whom?

A VPN wraps your traffic in an encrypted tunnel across the internet, so the networks in between can't read it, but the company running the VPN may see what you do. A virtual private network extends a private network across a public one, using encryption and tunnelling protocols. A tunnelling protocol carries your network messages from one host to another, and encryption hides what is inside.

Companies use the idea for a simple reason. Organisations use VPNs so off-site users can securely reach an office network over the internet, and to connect two networks, such as an office and a data centre. A remote worker can reach private resources without exposing them on the public internet.

Individuals use them differently: to encrypt and try to anonymise their traffic, buying access to a VPN service's own private networks. The privacy gain is real but limited. A VPN can stop an internet provider from reading the private data sent through it. But VPNs do not make users anonymous or unidentifiable to the network carrying the traffic, and the VPN provider and the online service being reached may still see the user's activities.

So the honest answer to what a VPN hides is this: it hides the contents from the network in between, such as a café's Wi-Fi or your provider, by encryption, and it moves trust to the VPN company. The tunnel also protects against tampering: a message authentication code can make the receiver reject altered packets.