What Is a VPN and Do You Actually Need One?

The Federal Trade Commission publishes a consumer page titled “Are Public Wi-Fi Networks Safe? What You Need To Know.” Its answer, as of its March 2026 revision, is this: today, most websites do use encryption to protect your information, and because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe.

The page does not mention VPNs at all.

That is a considerable change from the advice of a decade ago, and it is the single most important fact for anyone deciding whether to pay for one. The coffee-shop scenario that sells most consumer VPN subscriptions has largely been solved by something else.

What actually changed

Encryption won. Google, publishing Chrome telemetry in October 2025, described the trajectory: HTTPS ran at around 30 to 45 percent of browsing in 2015 and reached the 95 to 99 percent range around 2020, where it plateaued.

The 2025 figures, restricted to public sites, are higher still. Windows rises from 95 percent of all navigations to 98 percent when limited to public sites; Android and Mac both exceed 99 percent; Linux jumps from 84 percent to nearly 97 percent. Google also reports that the median user now sees fewer than one certificate warning per week.

Browsers are finishing the job. Google stated it would enable its Always Use Secure Connections setting, in the public-sites variant, by default in October 2026.

When the connection between your device and the website is already encrypted, a second encrypted tunnel around it does not protect the contents of that session again. It was already protected.

What a VPN actually does

A VPN routes your internet traffic through a server operated by someone else, so that the networks between you and that server see only an encrypted connection to it, and the websites you visit see the server’s address rather than yours.

That is genuinely useful for some problems. It is worth being precise about which.

Read the second row twice, because it is where most people actually lose money. The FTC’s caveat is precise: if you visit a scammer’s website, your data may be encrypted on its way to the site, but it will not be safe from the scammers operating the site. A VPN encrypts the pipe. It has no opinion about what is at the other end.

You are moving the trust, not removing it

This is the part the marketing omits, and a federal agency has said it plainly. The FTC, writing about VPN apps, stated: when you use a VPN app, you are giving the app permission to intercept all of your internet traffic.

That is not a criticism of the technology; it is a description of it. Without a VPN, your internet provider is positioned to see which sites you connect to. With one, your provider sees an encrypted connection to the VPN, and the VPN operator occupies the position your provider used to hold. The question is not whether someone can see your traffic. It is which company you would rather it were, and what that company does with it.

The FTC is specific about the free tier: many VPN apps are free because they sell advertising within the app, or because they share your information with, or redirect your traffic through, third parties. It cites researchers who examined almost 300 VPN apps and found apps that lacked encryption entirely, requested unexpected permissions, or shared data with third parties for purposes such as serving ads.

The agency’s four checks are a reasonable minimum: research the app, review its permission requests, confirm that it actually encrypts, and check whether it shares data with third parties.

The question about your internet provider

This is the strongest remaining consumer argument for a VPN, and it deserves accuracy rather than outrage.

In April 2017 Congress used the Congressional Review Act to disapprove an FCC rule on broadband privacy that had been adopted in December 2016. The operative effect was that the rule shall have no force or effect. Note what that did and did not do: it nullified a rule whose main provisions had not yet taken effect. It did not grant internet providers any new authority, and under the Review Act a substantially similar rule cannot be reissued without fresh congressional authorisation.

The current enforcement position is more recent and more often misreported. The FCC’s 2024 order reclassifying broadband as a Title II telecommunications service was vacated by the Sixth Circuit in January 2025, which held that broadband internet access is a Title I information service. The practical consequence is that broadband providers are not common carriers for that service, so the FTC is the operative federal enforcer of their privacy practices.

If you would rather your provider not compile a record of the domains you reach, a VPN does address that, at the cost described in the previous section.

The part the industry never mentions

VPNs are not inherently safe infrastructure. They are high-value targets, precisely because all the traffic funnels through them.

In January 2024 CISA issued an emergency directive ordering federal agencies to disconnect all instances of two widely deployed enterprise VPN products from their networks by a stated deadline, citing widespread and active exploitation. A subsequent joint advisory, published with the FBI and international partners, warned that a threat actor might gain root-level persistence despite factory resets, that the vendor’s own integrity checking tool had failed to detect compromise, and that organisations should consider the significant risk of adversary access when deciding whether to continue operating the devices.

Be precise about scope: those were enterprise gateway appliances, not consumer subscription apps, and the two are different products. But the lesson transfers. A VPN is a single point through which everything passes, which makes it valuable to attack, and the US government has told its own agencies to unplug one.

It is also worth noting where federal security guidance has gone instead. NIST’s zero trust architecture publication states that a remote subject should not be required to use a link back to the enterprise network, meaning a VPN, to access services. The perimeter model that VPNs implement is the thing zero trust was designed to replace. And CISA’s own consumer programme covers four practices, recognising phishing, strong passwords, multifactor authentication and updating software. A VPN is not among them.

When a VPN is the right tool

Three cases hold up.

Remote access to an employer’s network. This is what the technology was built for, your employer configures it, and the question does not arise.

Censorship circumvention. The Open Technology Fund, a grantee of the US Agency for Global Media, exists to support technologies providing secure and uncensored access to the internet, and reports that over two billion people use technology it has supported. For someone in a country that blocks the open internet, this is not a convenience purchase. It is the difference between access and none.

You specifically prefer the VPN operator to your internet provider. A legitimate preference, provided you have actually examined the operator with the FTC’s four checks rather than choosing whichever one sponsored a video.

Outside those, the honest answer for most US households in 2026 is that a VPN subscription buys less than it did in 2016, because the problem it was sold to solve has largely been fixed by default encryption.

What to do, in order

1. Check for the lock symbol or https in the address bar, which is the FTC’s own instruction and covers the public Wi-Fi case for nearly all browsing.
2. Turn on multifactor authentication, which addresses the threat that actually empties accounts and that no VPN touches.
3. Keep software updated, since it is on CISA’s four-item list and a VPN is not.
4. If you want one for the provider-visibility reason, run the FTC’s four checks before paying, and treat free apps as advertising-funded until proven otherwise.
5. Do not expect it to stop phishing. It encrypts the connection to the fraudulent site just as faithfully as to a real one.
6. If you are travelling somewhere that censors the internet, research it before you go, because this is the case where it genuinely matters.

What is striking, assembling the federal sources, is the absence rather than the presence. The FTC rewrote its public Wi-Fi advice to say encryption has mostly solved the problem and removed the VPN recommendation. CISA’s consumer campaign lists four protective practices and a VPN is not one. NIST’s architectural guidance treats the VPN model as the thing to move away from. The technology is not fraudulent and it has real uses. It is simply no longer the answer to the question most people are buying it to answer.

Where these figures come from

• Federal Trade Commission, Are Public Wi-Fi Networks Safe? What You Need To Know; In the market for a VPN app?; FTC Provides Tips for Using VPN Apps
• Google Security Blog, HTTPS by default, October 2025
• Cybersecurity and Infrastructure Security Agency, Emergency Directive 24-01, January 2024, and joint advisory AA24-060B, February 2024; Secure Our World programme
• National Institute of Standards and Technology, Special Publication 800-207, Zero Trust Architecture, and Special Publication 800-77 Revision 1, Guide to IPsec VPNs
• Public Law 115-22, April 2017, disapproving the FCC broadband privacy rule of December 2016
• US Court of Appeals for the Sixth Circuit, decision vacating the FCC broadband reclassification order, January 2025
• US Agency for Global Media, Open Technology Fund

General information, current as of September 2026, and not personalised security advice. Threats and guidance change; check the primary sources before relying on any of this.