VPN Privacy Guide

What different parties can see — and what a VPN actually changes.

What your local network / ISP sees

Without a VPN

All destination domains/IPs — Every website you visit, every API call, every CDN request
Connection timing and volume — When you're active, how much data you transfer
Unencrypted traffic content — HTTP (not HTTPS), DNS queries (unless DoH/DoT), SNI in TLS handshake
Device metadata — MAC addresses on local network, DHCP hostname, mDNS/Bonjour names

With a VPN

Only the VPN server IP — All traffic appears to go to one destination
Encrypted tunnel — Content, destinations, and SNI are hidden inside the tunnel
Connection timing/volume still visible — ISP sees you're connected to VPN and how much data flows
VPN protocol detectable — WireGuard, OpenVPN, IKEv2 have distinct signatures

MyVPNCheck observation

We see the VPN exit IP (the public IP of the VPN server), not your home IP. We cannot see your local network, ISP, or whether you're using a VPN at all — only the exit IP and its network metadata.

What your VPN provider sees

Always visible to the VPN provider

Your real public IP — The IP your ISP assigns you (the tunnel entry point)
All destination IPs/domains — Every server you connect to through the tunnel
Connection timing, volume, duration — Full traffic metadata
Protocol and port information — Even inside the encrypted tunnel

Depends on VPN implementation

DNS queries — If VPN pushes its own DNS, it sees all lookups. If you use DoH to a third party, it sees only the DoH endpoint.
Kill switch behavior — Whether traffic leaks when tunnel drops
Split tunneling config — Which apps/traffic bypass the tunnel
Account linkage — Your payment info, email, device IDs linked to activity

MyVPNCheck observation

We have zero visibility into what your VPN provider sees. We only observe the exit side — the VPN server's public IP. We cannot verify your VPN provider's logging policy, kill switch, or internal practices.

What websites (like MyVPNCheck) see

Always visible to websites

Source IP address — The VPN exit IP (or your real IP if no VPN)
TCP/TLS connection metadata — Port, cipher suite, TLS version, SNI (domain name)
HTTP headers — User-Agent, Accept-Language, Referer, cookies, etc.
Browser fingerprint — Canvas, fonts, screen resolution, timezone, WebGL, audio context, battery, etc.

What a VPN changes for websites

Source IP — Replaced with VPN exit IP
Approximate geolocation — Now shows VPN server location
Network/ASN — Now shows VPN/hosting provider, not your ISP

What a VPN does NOT change for websites

Browser fingerprint — Uniquely identifying browser configuration
Account tracking — If you're logged in, the site knows it's you
Cookies & local storage — Persistent identifiers across sessions
Behavioral patterns — Typing rhythm, mouse movements, click patterns
WebRTC exposure — May leak local/public IPs (tested by our WebRTC check)

MyVPNCheck observation

We observe exactly what any website observes: the public IP your browser presents, TLS connection metadata, and WebRTC candidates. We do not fingerprint, track, or correlate across visits. Results stay in your browser memory only.

Quick Comparison

Data	Local Network / ISP	VPN Provider	Website (with VPN)
Your real IP	✅ Yes	✅ Yes	❌ No (sees VPN exit)
Destinations (domains/IPs)	✅ Yes	✅ Yes	✅ Yes (only its own)
Traffic content (HTTPS)	❌ No (encrypted)	❌ No (encrypted)	✅ Yes (to that site)
DNS queries	✅ Yes (unless DoH)	✅ Yes (if VPN DNS)	❌ No
Browser fingerprint	❌ No	❌ No	✅ Yes
Account identity	❌ No	✅ Yes (billing)	✅ Yes (if logged in)
Connection timing/volume	✅ Yes	✅ Yes	❌ No

Key Takeaway

A VPN changes the network path — it hides your traffic from your local network/ISP and replaces your IP with the VPN server's IP for websites.

A VPN does not stop:

Account-based tracking (you're logged in)
Cookie-based tracking
Browser fingerprinting
Behavioral profiling
Your VPN provider from seeing everything

Use a VPN for network privacy. Use browser hardening (Firefox + uBlock Origin, container tabs, cookie auto-delete), compartmentalization, and mindful account usage for application-layer privacy.