Buy a VPN only when the problem is ‘‘my traffic must leave my device via a different country or provider’
VPNs are a tool with clear, narrow properties: they route traffic from your device to the VPN provider’s servers and encrypt the hop between you and those servers. That protects you from local network snoopers and can present an IP address in another country. It does not, by itself, make you anonymous on the Internet, remove every tracking vector, or magically make commercial content available where rights holders block it without breaking the provider’s terms. The Federal Trade Commission warns buyers that VPNs route traffic through third-party servers and that free VPNs may monetise users’ data; the Electronic Frontier Foundation and other commentators set out the limits of what a consumer VPN can and cannot protect against. ftc.gov
Three common purchase mistakes
- Buying a VPN to stop all tracking. VPNs hide your IP from sites, but do not stop cookies, browser fingerprinting, first-party tracking or profile building by logged-in services.
- Buying a VPN for ‘‘better speed’’ or reliability. A VPN can slow you, and in many cases a faster public DNS or a less-congested route (or a local ISP plan) fixes the problem at lower cost.
- Buying a VPN to avoid legal exposure for high-risk behaviour. A consumer VPN adds a network layer of protection but is not a legal shield; logs, subpoenas, or operational errors can still reveal activity. VPNs are not a substitute for legal advice or enterprise-grade controls. ftc.gov
When a VPN is the right purchase
Buy a consumer VPN if one or more of these apply: you must appear to originate from another country to access geo-restricted resources (with the caveat that streaming services may block VPNs), you need to encrypt traffic on an untrusted Wi‑Fi network, or you require a simple cross-platform client that provides an immediate encrypted tunnel without self-hosting. For those use-cases, the paid services in our catalogue (for example ExpressVPN, NordVPN and Surfshark VPN) have differing pricing and capabilities; our catalogue lists entry monthly prices for comparison.
When a VPN is the wrong move — and what to do instead
Below are common buyer scenarios and concrete alternatives that are cheaper, easier to maintain, or better for the actual threat.
1. You only want to stop DNS snooping: use encrypted DNS
If your concern is that your ISP or a public Wi‑Fi is watching the names you resolve (the domains you visit), encrypted DNS — DNS over HTTPS (DoH) or DNS over TLS (DoT) — protects DNS lookups without routing all your traffic through a VPN. Modern browsers and operating systems support DoH/DoT, and Cloudflare and Mozilla document this approach as the intended privacy improvement for DNS queries. Encrypted DNS is faster to deploy, has less latency cost than a VPN, and avoids routing everything through a third party. Note, however, that concentrating DNS to a single resolver raises different privacy considerations (fewer entities see more queries). developer.mozilla.org
2. You only need a quick privacy layer on a phone: consider Cloudflare WARP or DNS-only modes
Cloudflare’s 1.1.1.1 app and WARP offer a middle ground: DNS-only mode encrypts DNS without tunnelling app traffic; WARP encrypts device traffic to Cloudflare’s edge but is positioned as a performance/security convenience rather than a privacy panacea. For many mobile users who only want to avoid obvious ISP snooping or flaky captive portals, WARP (or WARP’s DNS-only setting) is a simple, often free, alternative to a paid VPN subscription. Cloudflare documents these modes in its support and developer pages. blog.cloudflare.com
3. You want to avoid tracking but run many browser sessions: change browser and tracking controls
Most persistent cross-site tracking comes from cookies and fingerprints rather than the IP address alone. Use a privacy-focused browser, block third-party cookies, enable tracker-blocking extensions, and isolate sessions in separate containers or profiles. Firefox’s rollouts around Trusted Recursive Resolvers (DoH) and tracker protection show how browser controls can address many privacy needs without a full-device VPN. support.mozilla.org
4. You run a small office and need to protect multiple devices: self-host WireGuard or use a site-to-site appliance
For small business networks the right choice is often a router-based VPN or a self-hosted WireGuard instance rather than multiple consumer VPN accounts. WireGuard is a modern, efficient protocol with an official quickstart and strong community documentation; running a single server and configuring the office router to route traffic centrally gives you control over logs, routing and costs. That’s cheaper at scale than per-seat commercial VPN subscriptions and avoids routing business data through a consumer VPN provider. wireguard.com
5. You need streaming in another country but want reliability: test providers’ claims and expect churn
Many buyers pay for a VPN to unblock streaming libraries. Streaming services aggressively block known VPN IPs; a paid VPN might work today and be blocked tomorrow. If unblocking content is your main need, accept recurring testing and switching costs, or use a travel-friendly option such as renting a cloud VM in the target country and routing your own traffic through it — which keeps you in control of the endpoint. No consumer purchase guarantees indefinite streaming access.
Free and low-cost real options in our catalogue
Not all needs require a paid plan. Two vendors in our catalogue publish free plans that are useful for light or cautious users: Proton VPN publishes a Free plan with no data limits and no artificial speed caps according to its pricing page; PrivadoVPN reports a free tier too. If your need is occasional protection on a phone or testing a VPN workflow, these free plans are a cheaper and lower-commitment alternative to starting a paid subscription. Always check the provider’s documentation for device limits and any feature restrictions. protonvpn.com
For readers comparing price points in the consumer market: our catalogue shows entry monthly prices (for example PrivadoVPN at $1.11 entry monthly and Proton VPN at $2.99 entry monthly). Use those figures to compare commitment costs if you decide a paid VPN is unavoidable.
Checklist: decide rationally before you buy
- Define the single, concrete problem you want to fix (DNS privacy, geo-IP, insecure Wi‑Fi, cross-site tracking).
- Try the least invasive fix first: enable DoH/DoT, switch browsers, use WARP DNS-only, or reserve a cloud VM for location needs.
- If you still need a tunnel, prefer a vendor with a clear logging policy, audited claims, and a test period or trustworthy free tier; check the vendor’s own docs for exact limits. ftc.gov
- For business use, favour self-hosted WireGuard or a managed SASE/Zero Trust appliance over consumer per-seat VPNs.
Final judgement
VPN subscriptions solve a narrow set of problems well — untrusted local networks and quick IP-location changes. Many buyers reach for a VPN expecting broader protections (no tracking, perfect anonymity, guaranteed streaming access). Those expectations are where the purchase becomes the wrong move. Try encrypted DNS and browser controls first; consider Cloudflare’s WARP/DNS modes for lightweight needs; and for offices, self-host or buy a router-level solution. If, after those steps, you still need a tunnel, use one of the paid services in our catalogue or a vetted free plan from providers that publish precise limits. The purchase will then match the problem.
Buying a VPN is often unnecessary — encrypted DNS, browser limits, or a self‑hosted WireGuard server will fix the problem more cheaply and transparently.