KotoVPN

Guide · Updated August 15, 2026

Can you be tracked while using a VPN?

Can you still be tracked while using a VPN?

Can you still be tracked while using a VPN?

Yes. A VPN changes the IP address a website sees, but it does almost nothing against the tracking that actually follows people. Browser fingerprinting, cookies, logged-in accounts and ad identifiers all work above the network layer, so a VPN relocates who can watch you rather than making you anonymous.

What a VPN changes, and what it leaves untouched

A VPN does one thing well. It encrypts the traffic leaving your device and sends it through a server run by a company you have chosen, so your network operator sees an encrypted connection to one address and the destination sees the server’s address instead of yours. That is a real change and it is worth having when the observer you want to remove is your internet provider, a network you do not control, or a service that geo-restricts by address.

Almost every tracking technique that a person worries about operates a layer above that. Cookies live in your browser. Fingerprinting reads properties your browser volunteers. A logged-in account is you telling the service who you are, by name. Ad identifiers are baked into the operating system on a phone. None of these care which IP address the packets arrived from, so changing the address does not touch them. This is why the honest framing is that a VPN moves what one observer can see; it does not remove the observer that most tracking actually uses, which is the site or the ad network you are talking to directly.

The site makes this point on its own decision guide as well: once you sign in to an account, the address you arrived from is the least identifying thing in the exchange. A VPN and anonymity are different properties, and conflating them is the single most common mistake in this category.

Does a VPN stop browser fingerprinting?

No. Browser fingerprinting builds an identifier out of the characteristics your browser exposes to every site it loads: the exact browser and version, operating system, screen dimensions, timezone, language headers, installed fonts, the list of graphics and audio capabilities, and how your device renders a hidden canvas or WebGL scene. Combine enough of these and the result is distinctive enough to recognise the same browser across visits, with no cookie stored and nothing for a VPN to intercept.

The reason a VPN is useless here is mechanical. Fingerprinting happens inside the page, in JavaScript the site serves you, reading values the browser hands over willingly. The tunnel carries that request and response faithfully. It cannot rewrite what your browser reports, because rewriting it is not a network operation. Worse, a VPN can make fingerprinting slightly easier in one narrow way: your reported timezone and language often stay set to your real locale while your IP now claims to be in another country, and that mismatch is itself a signal.

What reduces fingerprinting is browser choice and behaviour, not a provider. A browser that presents a deliberately common, uniform fingerprint — the approach the Tor Browser takes — makes you resemble a crowd. Anti-fingerprinting settings and extensions help at the margin. Running two different browsers for two different purposes helps more than any subscription. If someone sells you a VPN as protection against fingerprinting, they are describing a job the product does not do.

Why cookies, accounts and ad identifiers ignore your VPN

Cookies are stored on your device by sites you visit and sent back on every subsequent request. A tracking cookie set by an advertising network embedded on thousands of sites can follow you across all of them regardless of your IP address, because the cookie travels inside the encrypted tunnel along with everything else. The tunnel protects the cookie in transit; it does not stop the cookie existing or being sent.

Logged-in accounts are more direct still. The moment you sign in to a search engine, a social network or a shopping site, that company knows exactly who you are and links the session to your real identity by design. Your VPN’s server address is a footnote in a record that already has your name, your email and your purchase history attached. Changing countries mid-session, in fact, is more likely to trigger a security check than to hide anything.

On phones there is an advertising identifier — a resettable ID the operating system assigns for ad attribution — which apps read directly through the system, never through the network. A VPN app installed on the same phone has no visibility into that at all. The countermeasures are in the operating system settings: reset or disable the advertising ID, deny apps tracking permission, and clear cookies. A VPN is on the wrong layer to help with any of them.

The leaks people mean: WebRTC, IPv6 and DNS

There is a second, narrower question hiding inside “can I be tracked” — can my real IP address leak out despite the VPN? Here the answer is a qualified sometimes, and it is worth being precise, because this site published the common misconception and had to correct it.

The frequent claim is that WebRTC always leaks your real IP even with a VPN running. That is wrong, and the corrections log says so plainly. WebRTC — the browser feature behind video calls — discovers your addresses by sending a STUN request to find out how you appear from the outside. Under a full tunnel, that STUN request goes through the tunnel like everything else, and it returns the VPN server’s address, not yours. It leaks your real address only where a separate path already exists: split tunnelling that excludes the browser, or an IPv6 connection the client is not carrying inside the tunnel. WebRTC is the messenger, not the hole.

That makes IPv6 the leak that actually matters. If your connection has IPv6 and the client tunnels only IPv4, an IPv6-capable site — or WebRTC — can reach your real address on the path the tunnel never covered. A DNS leak is the related failure: your device asks your ISP’s resolver which address a domain lives at, so even though the traffic is encrypted, your ISP holds the list of every domain you looked up. Neither is exotic, and both are testable. The site’s own testing guide walks through confirming the address changed, that DNS goes to the provider’s resolver, that no IPv6 address is exposed, and that traffic stops when the tunnel is killed.

Avoid

  • Believing WebRTC always exposes your real IP — under a full tunnel it does not
  • Ignoring IPv6 because the address “looks changed” on an IPv4 test page
  • Treating a DNS leak as harmless because the traffic itself is encrypted

Do the provider ad-blockers help against tracking?

The four providers this site covers all ship a filtering feature — NordVPN’s Threat Protection, Proton VPN’s NetShield, and equivalents on PureVPN and FastestVPN — and it is easy to read these as anti-tracking tools. They do something useful, but not the thing fingerprinting requires. They block connections to known advertising, tracking and malicious domains at the DNS layer: when a page tries to load a tracker from a domain on the blocklist, the lookup is refused and the tracker never loads. That removes a category of network-level trackers and some malware domains. It does nothing about a first-party cookie, a logged-in account, or a fingerprint read by JavaScript the main site served itself.

It also helps to see how differently these features perform even at their stated job. AV-TEST measured malicious-URL blocking across five providers and found NordVPN blocking 83.42% of 3,209 malicious samples while Proton VPN’s NetShield blocked 4.43% — the widest possible spread on the same test, and the test was commissioned by NordVPN’s own parent company, NordSec. That gap is not a scandal: NetShield is built to block ads, trackers and known-bad domains rather than to act as an antivirus, and it was measured against a job it was not designed for. The point for tracking is simpler. Both features filter domains; neither alters your fingerprint. A DNS-layer blocklist and an anti-fingerprinting defence are different jobs, and no provider’s feature list closes that gap.

The sharpest illustration is on a provider’s own website. FastestVPN’s privacy policy, quoted in its published audit report, lists a Facebook Pixel among the analytics tools running on its site. A tracker on the marketing page of a company selling privacy is a reminder that the tracking discussed here runs at the site level, entirely outside anything a tunnel governs.

Anonymity versus privacy, and what a VPN really buys

The useful mental model is that a VPN relocates the observer rather than removing surveillance. Before the VPN, your ISP could see the domains you contacted. After it, your ISP sees an encrypted link to one server, and the VPN provider is now the party in a position to see where you go. The entire value of the swap depends on that provider keeping less than the ISP would, which is why a no-logs policy, an independent audit and jurisdiction dominate a VPN decision far more than any tracking-prevention claim.

Even the network layer carries a subtlety worth naming. WireGuard, the default protocol on all four providers here, keeps the client’s address on the server while a session is active — a design quirk that commercial providers paper over with an added layer, usually the part of the stack they do not publish. It is not a fingerprinting exposure, but it is a reminder that “the VPN hides your IP” is a claim with mechanics underneath it, and the interesting questions are always about what the provider retains.

So the practical answer to “can I be tracked on a VPN” is: yes, by anything that identifies you above the network. If your goal is to stop your ISP profiling your browsing, or to change your apparent country, a reputable VPN does that. If your goal is to not be recognised across the web, you need browser-level defences, discipline about accounts, and an acceptance that IP address is only one signal among many. A VPN is a component of that, not a substitute for it, and Tor exists precisely because splitting trust across three relays is a structurally stronger guarantee than trusting one company with all of it.

Questions

Can websites still identify me if I use a VPN?
Yes. A VPN changes the IP address a site sees, but sites identify returning visitors mainly through cookies, browser fingerprinting and logged-in accounts, all of which work above the network layer. If you are signed in to the service, it knows exactly who you are regardless of your VPN server’s location.
Does a VPN stop browser fingerprinting?
No. Fingerprinting reads properties your browser exposes — version, screen size, fonts, timezone, rendering behaviour — inside the page, in JavaScript the tunnel cannot rewrite. A VPN can even make it slightly easier, because your real timezone and language often stay set while your IP claims another country. Anti-fingerprinting defences live in the browser, not the VPN.
Does WebRTC leak my real IP address through a VPN?
Usually not. Under a full tunnel the WebRTC STUN request travels through the tunnel and returns the VPN server’s address, not yours. It leaks your real address only where a separate path already exists — split tunnelling that excludes the browser, or IPv6 the client is not carrying. WebRTC exposes the hole; it does not create it.
Do VPN ad-blockers like Threat Protection or NetShield stop tracking?
Only partly. They block connections to known ad and tracker domains at the DNS layer, which removes some network-level trackers. They do nothing about first-party cookies, logged-in accounts or fingerprinting. AV-TEST measured NordVPN at 83.42% and Proton VPN’s NetShield at 4.43% for malicious-URL blocking — a different job entirely from anti-fingerprinting.
What actually reduces tracking, if not a VPN?
Browser-level tools do the work a VPN cannot: a browser that presents a uniform fingerprint, blocking third-party cookies, staying signed out where possible, and resetting or disabling the mobile advertising ID. Combine those with a VPN for the network layer. For strong anonymity, Tor splits trust across three relays rather than one provider.

Terms used here

WebRTC leak

When a browser exposes your local or real address through the peer-connection API, independently of the VPN tunnel.

IPv6 leak

When a tunnel carries only IPv4 while your connection also has IPv6, so IPv6-capable sites see your real address.

DNS leak

When name lookups travel to your ISP’s resolver instead of through the tunnel, exposing every domain you visit.

IP address

The numeric address identifying your connection on the internet, visible to every site you contact.

Ad-blocking DNS

A resolver run by the VPN provider that refuses to answer lookups for known advertising and tracking domains.

Tor over VPN

Connecting to the Tor network through a VPN tunnel, so your ISP sees a VPN connection rather than Tor usage.

Related