The honest answer to "can a VPN be tracked" is yes, but only partly. A VPN hides your real IP address and your traffic from your internet provider, the Wi-Fi owner and the sites you visit. But you can still be tracked through cookies, accounts you log in to, browser fingerprinting, leaks, malware and the VPN company itself. Here's who can see what and how to close the gaps.
| Who is watching | Without a VPN | With a VPN |
|---|---|---|
| Your internet provider | Every site you visit and your real IP | Only that you use a VPN and how much data |
| Wi-Fi owner (café, hotel, office) | Sites you visit and unencrypted traffic | Only an encrypted stream to the VPN |
| Websites you visit | Your real IP and rough location | The VPN server's IP and location |
| Ad networks and cookies | Your browser across sites | Still your browser across sites |
| Google, Facebook and other accounts | Everything you do while logged in | Still everything you do while logged in |
| The VPN company | Nothing | Your real IP when you connect. Activity only if it logs |
| Spyware on your device | Everything on the device | Still everything on the device |
Green means the VPN hides it. Red means the VPN doesn't change it.
What a VPN hides from trackers
A VPN sends your traffic through an encrypted tunnel to a server run by the VPN company. Everything you do online then appears to come from that server. That changes three things.
- Your real IP address. Sites, apps and other players see the VPN server's address. As a result, they can't use your IP to guess your city or match your visits to your home connection.
- The content and destinations of your traffic. Your internet provider and the owner of the Wi-Fi see an encrypted stream to one server. They can't see which sites you open or what you send.
- Your DNS lookups. These are the requests your device makes to turn a site name into an address. With a good VPN they go through the tunnel too. So your provider can't build a list of the sites you visit from them.
That's real privacy from the people who run the network. But tracking on the web mostly works in other ways. Those keep working with a VPN on.
When using a VPN, can you be tracked? 7 ways it still happens
Yes. Most of the methods below have nothing to do with your IP address, which is why a VPN alone doesn't stop them.
Cookies and tracking scripts
Cookies are small files sites save in your browser. Ad networks place their own cookies on thousands of sites and recognize the same browser wherever it goes. A VPN doesn't touch your browser. So the same cookies follow you before and after you connect.
Browser fingerprinting
Fingerprinting identifies your device by its settings instead of a file. Screen size, fonts, browser version, language and graphics card together are often unique enough to tell you apart from other visitors. The EFF's Cover Your Tracks test shows how unique your own browser looks. Changing your IP doesn't change any of these details.
Accounts you log in to
Once you sign in to Google, Facebook, Amazon or any other account, the site knows it's you. So your IP doesn't matter at that point. Everything you do while logged in is tied to your account, with or without a VPN.
Leaks that expose your real IP
A VPN can leak in a few ways. Each one exposes your home IP or your browsing to someone the VPN should hide it from.
- A DNS leak sends site lookups to your provider instead of through the tunnel.
- A WebRTC leak happens in the browser. WebRTC is the technology behind video calls in a browser tab. In some browsers it can reveal your actual IP to a site.
- An IPv6 leak happens when your connection supports IPv6 but the VPN only tunnels the older IPv4 traffic.
- A dropped connection without a kill switch sends traffic out on your normal connection until the VPN reconnects.
The test section below shows how to check for each one.
The VPN company itself
With a VPN on, your provider stops seeing your traffic. But the VPN service now sits in that position. For example, it knows your home IP when you connect. And it could log what you do or watch traffic on its servers if it chose to. That's why the logging policy matters more than any other feature.
The cases below show what happens when a VPN does keep data. We cover them in detail in the police section.
Malware and spyware
Spyware on your phone or computer, however, sees everything before the VPN encrypts it. That includes your screen, keystrokes and location. A VPN doesn't detect or remove it.
Work devices and work networks
On a laptop or phone your employer manages, the company can often see activity through software on the device itself. A personal VPN doesn't hide that. Company devices also often forbid other VPN apps. Check the policy before you install one.
Can police track a VPN?
Police can't usually watch your VPN traffic live. Instead, they ask companies for records with a court order, subpoena or similar request. With a VPN, the trail runs from the site to the VPN server and stops at the provider. What happens next depends on what that company kept.
A VPN that logs connection times and IP addresses can link a session to your home connection. A VPN that keeps no such records has little to hand over. Both have happened in real US cases:
| Year | VPN | What happened | Result |
|---|---|---|---|
| 2016 | IPVanish | Homeland Security asked for data in a child abuse investigation. The service had said it kept no usage logs. | Handed over the user's name, email, real IP and connection times |
| 2016 | Private Internet Access | The FBI subpoenaed the provider in a case about a false bomb threat. | Could only say the IP addresses were on the US East Coast |
| 2017 | PureVPN | The FBI investigated a cyberstalking campaign. | Logs linked the suspect's accounts to his home and work IP addresses |
Sources: TorrentFreak (IPVanish), TorrentFreak (PIA), Help Net Security (PureVPN). IPVanish had a different owner at the time.
Two lessons stand out. First, a "no-logs" line in an ad proves nothing. IPVanish and PureVPN both marketed themselves as privacy services. Second, a policy only counts once someone outside the company has checked it, through an independent audit or a court case.
Keep in mind that a VPN is the last link in the chain. In the PureVPN case, investigators also relied on records from Google and other services. And the payment details you used to buy the VPN are a record too. The rules for police requests also differ from country to country. This article isn't legal advice.
Can your internet provider see that you use a VPN?
Yes. Your provider or the Wi-Fi owner can see that you connect to a VPN server, how much data you send and when. What they can't see is which sites you visit or what you do there.
Because of this, some networks block VPNs, for example at work, at school or in some countries. If a site blocks you instead, our guide to 403 Forbidden errors with a VPN explains why and what to try.
How to check if your VPN leaks your identity
A leak test takes about five minutes. Ideally, run it once after you install a VPN and again after big system updates.
- Check your IP. Note your IP address with the VPN off, then connect and check again. The new address and location should belong to the VPN server.
- Check DNS. Run an extended test at a DNS leak test site. The servers listed should belong to your VPN, not to your internet provider.
- Check WebRTC. Use a WebRTC leak test in each browser you use. Your home IP should not appear anywhere on the page.
- Check IPv6. If an IPv6 test shows your provider's address while the VPN is on, turn off IPv6 on the device or choose a VPN that handles it.
If a test shows your real IP, first turn on the VPN's DNS leak protection and kill switch. Then test again. If WebRTC is the only leak, a browser setting or extension that limits WebRTC usually fixes it.
Does a VPN protect you from viruses?
No. A VPN encrypts your connection but doesn't scan files or block malicious apps. You still need system updates and care with downloads. Our guide on how a VPN protects you explains where it helps and where it doesn't.
How to make yourself harder to track
A VPN covers the network side. The rest depends on your browser and your habits. This checklist covers the steps that matter most:
Still, you don't need every step. Pick the ones that match who you're hiding from. A VPN with a kill switch is enough to stop a hotel Wi-Fi owner from seeing your sites. Avoiding ad trackers, on the other hand, takes browser changes as well. If you want to see how much of you is already out there, our digital footprint guide shows where to look.
How Atomic VPN limits what can be tracked
Atomic VPN keeps as little as it can, because data it never stores can't be handed over or leaked. Our no-log policy has been verified by an independent third-party audit.
- No connection timestamps, no assigned IP addresses, no per-user bandwidth, no DNS queries and no browsing history.
- RAM-only servers with no hard drives. A reboot wipes them.
- Your account holds only an email and a payment method, stored separately from the VPN network. You can pay with crypto (BTC, XMR or USDT) if you'd rather not use a card.
- A kill switch on Windows, macOS and Android, plus DNS leak protection, to close the most common leaks.
To be clear, Atomic VPN doesn't stop cookies, fingerprinting or account tracking. No VPN does. The yearly plan is $1.99 a month, billed $23.99 once a year. It renews at the same price. Apps are available for Windows, macOS and Android, with iOS coming soon.
Audited no-log policy, RAM-only servers and crypto payments. $1.99 a month on the yearly plan, billed $23.99 once a year.
