Do You Need a VPN? What the FTC Says About Privacy and Wi-Fi

Do you need a VPN? A VPN routes your internet traffic through a provider's servers, and some also encrypt it. The US Federal Trade Commission (FTC) says a VPN "generally isn't going to make you entirely anonymous," and its newer guidance says connecting to public Wi-Fi is "usually safe." Here is what the FTC says about when a VPN helps and what to check first.

Do you need a VPN, and what does it actually do?

The FTC says traffic from your phone is first routed through servers controlled by the VPN provider, so a website can appear to receive your traffic from the VPN rather than from your device. Some apps also encrypt the data between your phone and the VPN server. On an open Wi-Fi network, someone watching the network then "only sees gibberish."

Does a VPN make you anonymous?

No. The FTC says a VPN "just shifts trust from those networks to the VPN app provider." Websites may still detect that you use a VPN, and information you hand over directly, such as an email address on a form, can still be used to track you. The FTC also notes that installing a VPN app means "giving the app permission to intercept all of your internet traffic," so you should not grant that lightly.

Is public Wi-Fi safe without a VPN?

The FTC's 2023 consumer guidance says public Wi-Fi was risky when most sites did not encrypt data, but that "connecting through a public Wi-Fi network is usually safe" now because most websites use encryption. It advises looking for the lock symbol or "https" in the address bar. It also warns that encryption only protects data on its way to a site: if a scammer runs the site, your data "won't be safe from scammers operating the site."

Are free VPN apps safe?

The FTC says many VPN apps are free because they sell advertising inside the app, and free apps may also earn money by sharing user data or routing traffic through third parties. It cites a study of nearly 300 VPN apps in which some did not encrypt traffic, asked for sensitive permissions, or shared data with third parties for advertising or analytics. It also warns that "not all VPN apps actually encrypt your information."

What should you check before installing a VPN app?

• The developer: read outside reviews. An app's own promises about security are not proof.
• Permissions: be wary of requests, such as reading text messages, that do not fit what a VPN needs.
• Encryption: confirm through reliable reviews that the app really encrypts your traffic.
• The privacy policy: check whether it shares data with advertisers or other third parties.

What we could not confirm

The FTC's VPN advice was published in February 2018, so it may not reflect current products. The 2023 public Wi-Fi page does not mention VPNs at all, so the FTC has not said there whether you need one. We have not tested any VPN and do not recommend one. A VPN may still suit other needs, such as a workplace VPN your employer requires, which these pages do not address.

Summary

The FTC says a VPN does not make you anonymous and only shifts trust from the network to the VPN provider, and that public Wi-Fi is usually safe because most websites use encryption. Free VPN apps may share data, so check the developer, the permissions, whether traffic is really encrypted and the privacy policy. The FTC's VPN advice dates from February 2018.

Related articles

• Do You Need a Password Manager? What the UK's NCSC Advises
• What Is a Passkey, and Is It Safer Than a Password?
• How to See Who Has Access to Your Gmail in 2 Minutes With Google's Security Checkup