What a VPN changes, and what it leaves untouched
A VPN does one thing well. It encrypts the traffic leaving your device and sends it through a server run by a company you have chosen, so your network operator sees an encrypted connection to one address and the destination sees the server’s address instead of yours. That is a real change and it is worth having when the observer you want to remove is your internet provider, a network you do not control, or a service that geo-restricts by address.
Almost every tracking technique that a person worries about operates a layer above that. Cookies live in your browser. Fingerprinting reads properties your browser volunteers. A logged-in account is you telling the service who you are, by name. Ad identifiers are baked into the operating system on a phone. None of these care which IP address the packets arrived from, so changing the address does not touch them. This is why the honest framing is that a VPN moves what one observer can see; it does not remove the observer that most tracking actually uses, which is the site or the ad network you are talking to directly.
The site makes this point on its own decision guide as well: once you sign in to an account, the address you arrived from is the least identifying thing in the exchange. A VPN and anonymity are different properties, and conflating them is the single most common mistake in this category.
Does a VPN stop browser fingerprinting?
No. Browser fingerprinting builds an identifier out of the characteristics your browser exposes to every site it loads: the exact browser and version, operating system, screen dimensions, timezone, language headers, installed fonts, the list of graphics and audio capabilities, and how your device renders a hidden canvas or WebGL scene. Combine enough of these and the result is distinctive enough to recognise the same browser across visits, with no cookie stored and nothing for a VPN to intercept.
The reason a VPN is useless here is mechanical. Fingerprinting happens inside the page, in JavaScript the site serves you, reading values the browser hands over willingly. The tunnel carries that request and response faithfully. It cannot rewrite what your browser reports, because rewriting it is not a network operation. Worse, a VPN can make fingerprinting slightly easier in one narrow way: your reported timezone and language often stay set to your real locale while your IP now claims to be in another country, and that mismatch is itself a signal.
What reduces fingerprinting is browser choice and behaviour, not a provider. A browser that presents a deliberately common, uniform fingerprint — the approach the Tor Browser takes — makes you resemble a crowd. Anti-fingerprinting settings and extensions help at the margin. Running two different browsers for two different purposes helps more than any subscription. If someone sells you a VPN as protection against fingerprinting, they are describing a job the product does not do.
Why cookies, accounts and ad identifiers ignore your VPN
Cookies are stored on your device by sites you visit and sent back on every subsequent request. A tracking cookie set by an advertising network embedded on thousands of sites can follow you across all of them regardless of your IP address, because the cookie travels inside the encrypted tunnel along with everything else. The tunnel protects the cookie in transit; it does not stop the cookie existing or being sent.
Logged-in accounts are more direct still. The moment you sign in to a search engine, a social network or a shopping site, that company knows exactly who you are and links the session to your real identity by design. Your VPN’s server address is a footnote in a record that already has your name, your email and your purchase history attached. Changing countries mid-session, in fact, is more likely to trigger a security check than to hide anything.
On phones there is an advertising identifier — a resettable ID the operating system assigns for ad attribution — which apps read directly through the system, never through the network. A VPN app installed on the same phone has no visibility into that at all. The countermeasures are in the operating system settings: reset or disable the advertising ID, deny apps tracking permission, and clear cookies. A VPN is on the wrong layer to help with any of them.
The leaks people mean: WebRTC, IPv6 and DNS
There is a second, narrower question hiding inside “can I be tracked” — can my real IP address leak out despite the VPN? Here the answer is a qualified sometimes, and it is worth being precise, because this site published the common misconception and had to correct it.
The frequent claim is that WebRTC always leaks your real IP even with a VPN running. That is wrong, and the corrections log says so plainly. WebRTC — the browser feature behind video calls — discovers your addresses by sending a STUN request to find out how you appear from the outside. Under a full tunnel, that STUN request goes through the tunnel like everything else, and it returns the VPN server’s address, not yours. It leaks your real address only where a separate path already exists: split tunnelling that excludes the browser, or an IPv6 connection the client is not carrying inside the tunnel. WebRTC is the messenger, not the hole.
That makes IPv6 the leak that actually matters. If your connection has IPv6 and the client tunnels only IPv4, an IPv6-capable site — or WebRTC — can reach your real address on the path the tunnel never covered. A DNS leak is the related failure: your device asks your ISP’s resolver which address a domain lives at, so even though the traffic is encrypted, your ISP holds the list of every domain you looked up. Neither is exotic, and both are testable. The site’s own testing guide walks through confirming the address changed, that DNS goes to the provider’s resolver, that no IPv6 address is exposed, and that traffic stops when the tunnel is killed.
Avoid
- Believing WebRTC always exposes your real IP — under a full tunnel it does not
- Ignoring IPv6 because the address “looks changed” on an IPv4 test page
- Treating a DNS leak as harmless because the traffic itself is encrypted
Do the provider ad-blockers help against tracking?
The four providers this site covers all ship a filtering feature — NordVPN’s Threat Protection, Proton VPN’s NetShield, and equivalents on PureVPN and FastestVPN — and it is easy to read these as anti-tracking tools. They do something useful, but not the thing fingerprinting requires. They block connections to known advertising, tracking and malicious domains at the DNS layer: when a page tries to load a tracker from a domain on the blocklist, the lookup is refused and the tracker never loads. That removes a category of network-level trackers and some malware domains. It does nothing about a first-party cookie, a logged-in account, or a fingerprint read by JavaScript the main site served itself.
It also helps to see how differently these features perform even at their stated job. AV-TEST measured malicious-URL blocking across five providers and found NordVPN blocking 83.42% of 3,209 malicious samples while Proton VPN’s NetShield blocked 4.43% — the widest possible spread on the same test, and the test was commissioned by NordVPN’s own parent company, NordSec. That gap is not a scandal: NetShield is built to block ads, trackers and known-bad domains rather than to act as an antivirus, and it was measured against a job it was not designed for. The point for tracking is simpler. Both features filter domains; neither alters your fingerprint. A DNS-layer blocklist and an anti-fingerprinting defence are different jobs, and no provider’s feature list closes that gap.
The sharpest illustration is on a provider’s own website. FastestVPN’s privacy policy, quoted in its published audit report, lists a Facebook Pixel among the analytics tools running on its site. A tracker on the marketing page of a company selling privacy is a reminder that the tracking discussed here runs at the site level, entirely outside anything a tunnel governs.
Anonymity versus privacy, and what a VPN really buys
The useful mental model is that a VPN relocates the observer rather than removing surveillance. Before the VPN, your ISP could see the domains you contacted. After it, your ISP sees an encrypted link to one server, and the VPN provider is now the party in a position to see where you go. The entire value of the swap depends on that provider keeping less than the ISP would, which is why a no-logs policy, an independent audit and jurisdiction dominate a VPN decision far more than any tracking-prevention claim.
Even the network layer carries a subtlety worth naming. WireGuard, the default protocol on all four providers here, keeps the client’s address on the server while a session is active — a design quirk that commercial providers paper over with an added layer, usually the part of the stack they do not publish. It is not a fingerprinting exposure, but it is a reminder that “the VPN hides your IP” is a claim with mechanics underneath it, and the interesting questions are always about what the provider retains.
So the practical answer to “can I be tracked on a VPN” is: yes, by anything that identifies you above the network. If your goal is to stop your ISP profiling your browsing, or to change your apparent country, a reputable VPN does that. If your goal is to not be recognised across the web, you need browser-level defences, discipline about accounts, and an acceptance that IP address is only one signal among many. A VPN is a component of that, not a substitute for it, and Tor exists precisely because splitting trust across three relays is a structurally stronger guarantee than trusting one company with all of it.