A VPN moves the point at which your traffic joins the public internet. That is a real and sometimes valuable change. It is not anonymity, it is not encryption of things that were not already encrypted, and it does not remove you from the systems that identify you.
What it actually is
An encrypted tunnel from your device to a server somebody else operates, which then makes requests on your behalf. Your traffic joins the public internet there rather than where you are sitting.
That is the whole mechanism. Everything a VPN can and cannot do follows from it, and the journey splits in two: the first leg, encrypted and visible only to you and the operator; the second leg, ordinary internet traffic leaving the operator's building.
The three things it genuinely changes
The local network can no longer see where you go. On unknown Wi-Fi, the operator and anyone else on it loses the list of sites you visit. They retain that you are using a VPN, how much data you move, and when.
The destination sees the operator's address, not yours. Services you visit no longer learn your home connection or your rough location from the address alone.
You appear to be where the server is. Which is why a VPN defeats simple geographic blocks, this being the reason most people first install one.
These are real, and worth having in the situations where they apply.
What it does not change
You are still logged in. Every service that knew who you were before knows now — the tunnel changed your address, not your identity, and an account is an identity you volunteered.
Cookies, browser fingerprinting and mobile advertising identifiers are untouched. They operate above the layer a VPN works at, and they were the identification method that mattered anyway.
It adds no encryption to what was exposed. Nearly everything is already carried over HTTPS, so content was encrypted before the VPN and is encrypted after it. What changes is who can see the destinations, not whether the contents were protected.
Volume and timing still describe behaviour. A long evening of steady high-bandwidth traffic looks like what it is, regardless of tunnelling.
And DNS may or may not travel through the tunnel. When it does not, the local network still learns every domain you look up, which is most of what you were hiding. Worth checking rather than assuming, because it is silent when it is wrong.
The trust swap
Here is the part usually left out.
You have not removed an observer. You have appointed a different one, and the new one sees more than the old one did. Your network operator saw only the traffic crossing their network; the VPN operator sees every destination you reach, from everywhere you connect, for as long as you use them.
So the question is not whether to trust, but whom, and on what basis. Three things matter more than any marketing claim. The jurisdiction they operate under, which determines what they can be compelled to produce. The funding model, because a service you do not pay for is paid for somehow and the traffic is the obvious asset. And whether they are technically capable of seeing what they promise not to retain — a promise not to log is a policy, and policies are easier to change than architectures.
When it is the right tool
Often, and in ordinary situations rather than exotic ones.
A network you do not control and have no reason to trust. A network operator you would specifically rather not hand a browsing list to, which includes plenty of employers and landlords. A service fenced off by geography. Keeping work traffic off a home network, or the reverse.
These are common and legitimate, and the trade — one observer swapped for a better-chosen one — is a sensible trade to make in all of them.
When it is not
Against an adversary who can watch both ends, the tunnel is not the weak point and removing it changes nothing.
Against a service you are logged into it does nothing at all, because you told them who you are before the question of network paths arose.
And where the threat is the platform rather than the path, a VPN is the wrong shape of tool entirely. No amount of tunnelling addresses what a service does with what you gave it.
Close
Most security tools relocate trust rather than eliminating it, and the useful habit is to ask, of any tool, whom you are now trusting instead. The answer is usually available, rarely advertised, and more informative than the feature list.