Yes. A VPN hides your real IP address from websites and your traffic from the network you’re on, but it doesn’t make you anonymous. You can still be tracked through cookies, accounts you’re signed in to, browser fingerprinting, software on your own device, and the VPN company itself if it keeps logs. A VPN breaks one link in the chain, the one between your address and the sites you visit, and leaves the others where they were.
Last updated 31 October 2026.
Who can see my browsing history?
Before tracking methods, it helps to know who’s in a position to watch. Here’s the list, with and without a VPN.
| Who | Without a VPN | With a VPN |
|---|---|---|
| Your internet provider | Every domain you visit, and when | One encrypted connection to a VPN server |
| Wi-Fi owner (hotel, café, office) | Every domain you visit | That you’re using a VPN |
| Websites and ad trackers | Your IP, cookies, fingerprint | The VPN’s IP, plus the same cookies and fingerprint |
| Accounts you’re signed in to | Everything you do while signed in | Still everything you do while signed in |
| Your device, its OS and apps | Whatever they’re allowed to collect | Exactly the same |
| The VPN company | Nothing | All your traffic, in principle |
The second column is where most people’s mental picture stops. Turns out the bottom four rows barely change when you connect. For the first two rows in detail, see can my ISP see my VPN.
What the providers and the EFF say
The clearest answer comes from a VPN company. NordVPN’s article Can you be tracked with a VPN? (dated 9 July 2026) opens: “A VPN can make your web traffic and real IP address hard to track, but it doesn’t make you completely anonymous.” It then names the methods: “account logins, cookies, browser fingerprinting, malware, or information you share online.”
The Electronic Frontier Foundation is shorter still. Its Surveillance Self-Defense guide, Choosing the VPN That’s Right for You (last reviewed 28 July 2026), says: “A VPN is not a tool for anonymity.” It lists the ways companies track you anyway: “GPS, web cookies, tracking pixels, or fingerprinting.”
When the vendor and the digital-rights group agree, you can stop arguing about it. The useful question is which links you can break yourself.
Cookies: the tracker already in your browser
A cookie is a small file a website stores in your browser. Third-party cookies, NordVPN’s article says, “are usually used for advertising and can track you across different platforms.”
Here’s the catch: a cookie identifies your browser, not your address. When you switch on a VPN, your IP changes but every cookie already stored stays put. An ad network that tagged you on Monday recognises you on Tuesday, whichever country your VPN server is in.
What helps: clear cookies regularly, block third-party cookies in your browser settings, and use a tracker blocker. Some VPNs bundle one. Our reviews note that Surfshark includes an ad blocker and cookie pop-up blocker in its cheapest plan, and Proton VPN’s NetShield blocks ads, malware and trackers. These work by filtering known tracker addresses, so they cut a lot without catching everything.
Signed-in accounts: you told them who you are
This is the biggest one, and the simplest. When you’re signed in to email, a search engine, a shop or a social network, that service knows it’s you. The VPN is irrelevant at that point.
NordVPN gives a plain example: if you sign in to Google while connected to a VPN, it may look as if you’re browsing from another region, but Google “can still link the activity to your account,” and the suggestions you see later will reflect it. The EFF adds that a VPN does nothing to protect “the browsing history saved in your browser or in your search history if you’re logged into an account.”
In practice, the fix is about habits, not tools. Sign out of accounts you don’t need while browsing, use a separate browser profile for personal research, and skip the “sign in with” buttons when a guest checkout works.
Browser fingerprinting: the one most people miss
Fingerprinting doesn’t store anything on your device, which is exactly what makes it hard to fight. The EFF’s guide What Is Fingerprinting? (last reviewed 27 August 2024) describes it as a site gathering “little bits of information about a user’s machine,” then putting them together “to form a unique picture.” Its examples: “screen resolution, your time zone, operating system version, remaining battery life, and more.”
Why it beats cookies: the EFF says a fingerprint works “as a substitute for a cookie, which can be easily deleted by the user,” and “a fingerprint can not be removed, since it does not store anything on the users’ machine.” Its Cover Your Tracks study, launched in 2010, found that “the vast majority of browsers” were both persistent and unique enough to track.
A VPN changes none of those details. Your screen size and installed fonts look the same from any server. The EFF’s advice is to use “special tools that resist fingerprinting” rather than tweaking settings yourself, since hand-tuned settings can make a browser stand out more, and that a tracker may even spot a randomisation tool and treat that as one more trait.
Your device, your OS and the apps on it
A VPN protects the network path. It has no say over what your own device collects and sends.
Apps with location access. The EFF lists GPS among the ways you’re tracked regardless of a VPN. A weather app with location on knows where you are whichever server you pick.
Operating system telemetry. Microsoft’s support page on diagnostics, feedback and privacy in Windows says Optional diagnostic data “may also include information about the websites you browse.” That data leaves your PC through the VPN tunnel, encrypted, and arrives at Microsoft intact. If you’ve opted in and want to change it, the path on Windows 11 is Start > Settings > Privacy & security > Diagnostics & feedback, then choose under Diagnostic data. Phones have similar settings for analytics sharing.
Malware and stalkerware. NordVPN’s article warns that stalkerware “can also be installed by someone you trust.” Anything running on the device sees what you see, before encryption ever happens.
Work devices. NordVPN also notes that an employer who installs monitoring software, such as a keylogger, “would still be able to see what websites you visit.” A personal VPN on a managed laptop doesn’t change that.
The VPN provider: the party that sees it all
When you use a VPN, you move trust from your internet provider to the VPN company. The EFF puts it bluntly: “while a VPN hides your browsing data from the ISP, it’s all visible to the VPN provider.” NordVPN agrees that a provider “can technically track your activity if it keeps logs,” including “your real IP address, connection times, DNS queries, or websites visited.”
So the no-logs promise is everything, and a promise is only as good as whoever has checked it. According to our reviews, Proton VPN has passed five consecutive annual audits by Securitum and publishes the reports; NordVPN has had six independent no-logs reviews since 2018; Surfshark two by Deloitte; ExpressVPN three KPMG audits of its privacy commitments. Our Proton VPN review and NordVPN review go through what each audit covered.
Don’t forget payment, either. The EFF points out that paying by credit card ties your identity to the account, and that a provider “may still collect your IP address when you use the service.”
A worked example: one week of travel
Say a journalist flies to a conference, connects to a VPN on airport and hotel Wi-Fi, and stays signed in to their email and a news app all week.
The hotel network sees an encrypted VPN connection. Good. The websites they read see a VPN server’s address. Good. But their email provider logs every sign-in to the same account. The news app reports its usage under the same user ID. An ad network recognises the same browser from a cookie set two weeks earlier at home, and its fingerprinting script confirms it from the screen size, time zone and fonts. Their phone’s photo app adds location tags to every picture.
Five ways to link that week to one person, and the VPN blocked none of them. It did its own job well: nobody on the hotel network could read their traffic. If you’ve ever assumed a VPN covered the rest, this is the week that shows it doesn’t.
How to reduce tracking, step by step
- Turn on the VPN’s kill switch and leak protection. NordVPN’s article says that if the connection drops without a kill switch, “your real IP and browsing activity can become visible again.”
- Block third-party cookies in your browser’s privacy settings, and clear existing ones.
- Use a browser that resists fingerprinting, as the EFF recommends, rather than adjusting settings by hand.
- Sign out of accounts you don’t need, or use a separate browser profile.
- Review app permissions for location, and set OS diagnostic data to the minimum.
- Pick a VPN with public, independent no-logs audits. For more on what a VPN does and doesn’t cover, read what a VPN can and can’t hide.
FAQ: tracked with a VPN questions
Can Google track me if I use a VPN?
Yes, if you’re signed in to a Google account, because the activity is tied to the account, not your address. Cookies and fingerprinting can also link visits when you’re signed out. A VPN only changes the location Google sees.
Can the police track a VPN user?
A VPN makes direct traffic monitoring harder, but law enforcement can request records from websites, account providers, payment companies and VPN providers, depending on local law. The EFF notes that VPN providers face legal requests too, which is why independent no-logs audits matter.
Does incognito mode plus a VPN make me anonymous?
No. Incognito stops your browser saving history on your device and starts with no cookies, which helps. Your fingerprint, any account you sign in to, and the VPN provider’s view are unchanged.
Can a free VPN track me?
It can, if it logs. NordVPN’s article says some free VPNs make money through connection logs that may include your IP address, the sites you visit, connection times and data used. Check for a published, independent audit before trusting any VPN, free or paid.
The short version
- Yes, you can be tracked with a VPN; it hides your IP and network traffic, not your identity.
- Cookies, signed-in accounts and browser fingerprinting all work through a VPN.
- Your device, its operating system and its apps can still report what you do.
- The VPN company sees all your traffic, so only trust one with independent no-logs audits.
- Combine a VPN with cookie blocking, a fingerprint-resistant browser and fewer signed-in sessions.