What others see when you use a VPN

The big picture

This comparison assumes traffic uses an encrypted consumer VPN and source address translation at its internet exit: user → ISP → VPN server → destination. Traffic outside the tunnel, such as split-tunnel exclusions, is a separate case.

What changes

What does the ISP see? 🏢

Your ISP can see that your connection is talking to a VPN server. If all traffic and DNS go through the VPN tunnel, the actual websites and services you use become much harder for the ISP to observe.

Easy for the ISP to see

• Your line connecting to a specific VPN server IP.
• Traffic volume, start/end times, and connection duration.
• Sometimes the VPN protocol can be guessed, such as WireGuard, OpenVPN, or IPsec.
• Plaintext DNS outside the tunnel exposes query names. DoH/DoT normally hides query contents from the intervening ISP, but not from the resolver processing them.

Harder for the ISP to see

• The actual websites or game server IPs inside the VPN tunnel.
• Properly authenticated HTTPS already protects request bodies, form data, and URL paths from the ISP without a VPN. The VPN additionally hides destination IPs inside its tunnel.
• Detailed in-app actions such as URL paths or gameplay events.

What does the VPN provider see?

Using a VPN moves part of the trust from the ISP to the VPN provider. The provider sits between your original connection and the exit side, so its logging policy matters.

Information it may handle

• Your original IP address, connection time, and selected VPN server.
• Destination IPs and traffic volume on the exit side. If the provider handles DNS, queried domains may also be visible.
• Properly authenticated HTTPS normally hides bodies and passwords. Unencrypted HTTP may be read after it leaves the VPN exit. Destination IPs and unencrypted SNI can also provide clues.

What do websites and apps see? 🌐

For traffic using the assumed VPN path, the service sees the exit IP. The destination service can read request data it receives over HTTPS; logins and cookies also remain.

Visible to the service

• VPN exit IP, estimated location, ASN, and whether it looks like a VPN or data center.
• Logged-in account, cookies, device information, and browser fingerprints.
• GPS or Wi-Fi-based location if browser location permission is granted.
• Security systems may flag access from an unusual country or network.

What do game servers see? 🎮

Game traffic using the VPN with source translation at the exit exposes that exit IP. Games are also sensitive to latency and packet stability, so VPN effects are often more noticeable than on normal websites.

Common game-specific effects

• Region detection or matchmaking may follow the VPN server location.
• Routing through a VPN can increase ping or jitter.
• Some games restrict VPN or data-center IP ranges for anti-abuse reasons.
• Account IDs, device IDs, platform information, and anti-cheat signals do not disappear because of the VPN.

Takeaway

For traffic inside the tunnel, a VPN changes what the ISP and VPN provider can observe. It hides more destination detail from the ISP and hides your original network IP from the destination, but the VPN provider and logged-in services still have important signals.

Keep these in mind

• The ISP can still see that you are connected to a VPN server, plus timing and volume.
• Websites and game servers see the VPN exit IP plus account/device signals.
• A VPN does not guarantee protection from traffic correlation or monitoring on the device. Enterprise TLS inspection using a trusted certificate is also outside this simplified comparison.

Specifications and related guides

RFC 8446: TLS 1.3 / RFC 8484: DNS over HTTPS / RFC 7858: DNS over TLS / VPN security boundaries