I get this pitch constantly: "I'm covered, I've got a VPN." No. You've got one layer, and it's the layer that gets the most marketing budget and the least actual protection per dollar. A VPN is a tool. It's not a strategy. If you think a $10/month subscription is your OPSEC plan, I need you to sit down, because we're about to have an uncomfortable conversation.

What a VPN Actually Does (and Doesn't Do)

A VPN encrypts traffic between your device and the VPN provider's server, and it swaps your visible IP address for one belonging to the provider. That's it. That's the whole mechanism. Your ISP can't see your browsing traffic anymore, and the website you're visiting sees the VPN's IP instead of yours.

That's genuinely useful — for hiding your IP from a website, for getting around a geo-block, for keeping your ISP from selling your browsing history. It is not useful for hiding you, the person, from anyone who's actually looking. Those are two completely different problems, and VPN marketing wants you to believe solving the first one solves the second. It doesn't.

The 5 Things a VPN Cannot Protect You From

1. Browser Fingerprinting

Your browser leaks a fingerprint made of screen resolution, installed fonts, canvas rendering quirks, timezone, language settings, and a dozen other data points that combine into something close to unique — regardless of what your IP address says. Sites like amiunique.org will show you exactly how identifiable you already are. A VPN changes your IP. It changes nothing about your fingerprint.

2. Account Linking

If you log into your real Gmail, your real Instagram, or anything tied to your actual identity while connected to a VPN, you've defeated the entire purpose in one click. The VPN hid your IP from the network layer — but the platform now has your identity handed to it directly, IP or not. Cookies, session tokens, and logged-in accounts don't care what IP you're routing through.

3. Metadata

Every file you send, every photo you post, every document you share carries metadata — timestamps, device info, sometimes GPS coordinates embedded directly in the file. A VPN protects the pipe the file travels through. It does nothing to strip what's baked into the file itself.

4. DNS Leaks

A shocking number of "VPN protected" connections still leak DNS queries outside the encrypted tunnel due to misconfiguration, split tunneling, or IPv6 traffic the VPN client doesn't handle. That means your ISP — or anyone monitoring the network — sees exactly which domains you're resolving, VPN or not. Test yours at dnsleaktest.com right now. I mean it. Go check.

5. Behavioral Patterns

Writing style, posting times, the specific phrases you always use, the topics you gravitate toward — none of that changes when your IP changes. If you've built an identifiable pattern under one persona and then reuse that same pattern under a "new" anonymous one, correlation analysis will connect them. This is how a lot of anonymous accounts get unmasked, and it has nothing to do with networking.

What Real OPSEC Looks Like

Real OPSEC isn't a product you buy once. It's a set of disciplined habits that assume every individual layer can fail, so no single failure exposes the whole picture.

Compartmentalization

Separate identities never touch each other. Different email, different phone number, different payment method, different browser profile, different writing habits — for each persona you operate. The moment two compartments share even one data point, they're no longer separate.

Clean Devices

A dedicated device or virtual machine used only for one identity, with no crossover apps, accounts, or browser history from your real life. Your daily driver phone, logged into your real social accounts, is not a device you should also use for anything requiring anonymity.

Alias Infrastructure

Burner emails, aliased payment cards, separate VoIP numbers, and — yes — a VPN, all stacked together and never mixed with real-identity infrastructure. The VPN is one brick in this wall, not the wall.

When You Need Both

A VPN plus real OPSEC discipline is a legitimately strong posture. Use the VPN to keep your ISP and local network out of your business day-to-day. Layer real OPSEC habits — compartmentalized identities, clean devices, disciplined behavior — on top for anything that actually needs to stay anonymous. Neither one replaces the other. People get hurt when they think the VPN is doing OPSEC's job.

Think about who's actually in your threat model. If it's your ISP selling browsing data, or you're on public Wi-Fi at a coffee shop, a VPN alone solves that problem completely — there's no reason to overcomplicate it. But if your threat model includes someone who's motivated to find out who you actually are — a stalker, an investigator, a doxxer, a nation-state, a jealous ex with too much free time — the VPN is a single brick pulled from a wall that still has a dozen open gaps. Match the tool to the actual threat, not to the marketing copy.

The OPSEC Stack We Recommend

If a VPN provider's marketing copy tells you their product makes you "anonymous online," that's a red flag, not a feature. Anonymity isn't a subscription. It's a practice. Buy the VPN if it serves a real purpose in your stack — just stop treating it like a magic cloak, because it never was one.