Questions: VPN Basics and Use Cases

Question 1

You connect to a VPN, then log into your Google account and browse YouTube for an hour. Can Google track which videos you watched?

• A. No — the VPN's encrypted tunnel prevents Google from seeing any activity
• B. Yes — Google sees your account login and associates your activity with your profile, regardless of your IP address
• C. No — the VPN replaces your identity with the VPN server's identity, including account data
• D. Yes — but only the raw IP address is visible, not the specific videos

Answer: (B)

A VPN changes your IP address and encrypts traffic between your device and the VPN server — it does not log you out of accounts or prevent application-layer tracking. When you log into Google, you voluntarily identify yourself. Google then links all your activity to your account regardless of which IP address you're connecting from. The VPN only helps at the network level; logged-in accounts, cookies, and browser fingerprinting continue to identify you at the application level.

Question 2

Which statement best describes what a VPN actually does to your overall privacy?

• A. It eliminates network surveillance by encrypting everything end-to-end
• B. It shifts who can surveil your traffic — from your ISP to your VPN provider — without eliminating surveillance
• C. It provides true anonymity by masking all identifying information
• D. It blocks tracking cookies, browser fingerprinting, and logged-in account tracking

Answer: (B)

A VPN is a trust-shifting mechanism, not a trust-eliminating one. Your ISP can no longer see which sites you visit, but your VPN provider now can. If the VPN provider logs your activity, sells data, or is legally compelled to produce records, your privacy is no better than it was with your ISP — and potentially worse, since VPN providers face less regulatory scrutiny than large ISPs in some jurisdictions. The key question is not 'am I using a VPN?' but 'who do I trust more — my ISP or this VPN provider?'

Question 3

Connecting to a VPN prevents websites from tracking you through cookies and browser fingerprinting.

• T. True
• F. False

Answer: False

A VPN secures the network connection between your device and the VPN server — it operates at the network layer. Cookies, browser fingerprinting, and logged-in accounts operate at the application layer, which the VPN does not touch. A site that has set a tracking cookie on your browser can still read it when you visit through a VPN. A fingerprinting script can still identify your browser by screen resolution, installed fonts, and other attributes. These are fundamentally different privacy threats that require different mitigations (privacy-focused browsers, cookie clearing, script blocking).

Question 4

Free VPN services are a reliable way to protect your online privacy because they provide the same encryption as paid services at no cost.

• T. True
• F. False

Answer: False

Free VPN services face a fundamental business model problem: if they don't charge users, they must generate revenue another way. Many free VPNs have been documented selling users' browsing data to advertisers, injecting ads into web traffic, or providing data to third parties. Some have been found to log user activity despite 'no-log' claims. Using a free VPN for privacy protection often replaces one potential surveillance threat (your ISP) with a confirmed one (the VPN provider itself). The encryption quality is irrelevant if the party operating the VPN is monetizing your data.

Question 5

Why is the trustworthiness of a VPN provider more important to your privacy than which encryption protocol the VPN uses?

Model answer: A VPN routes all your traffic through the VPN provider's servers, giving that provider complete visibility into everything you do online — even if the traffic is encrypted between your device and their server. Strong encryption only protects data in transit; once it arrives at the VPN server, the provider can see it in plaintext. If the provider logs your activity, sells it, or hands it to third parties, the encryption provided zero privacy benefit. Protocol strength (AES-256 vs. AES-128, OpenVPN vs. WireGuard) matters only for protecting data from interception between your device and the server — a threat that is far less common than the VPN provider itself being untrustworthy.

This is the 'trust shift' concept central to the topic. Marketing materials for VPNs emphasize encryption algorithms and protocol names because these sound technical and impressive — but they address a secondary threat. The primary threat is that you've just handed all your traffic to a company you probably know nothing about. Provider selection, jurisdiction, logging policy history, and third-party audits matter far more than which cipher suite is used.