The distinction that decides it
A commercial VPN puts you behind an address shared with hundreds of other subscribers. That crowd is the privacy mechanism — activity from the address cannot be attributed to you specifically, because it could belong to any of them.
A VPN server you run alone has a crowd of one. Every request from it is yours by definition, and it is registered to your name or your payment card at whatever host you rented it from. For privacy from the sites you visit, this is strictly worse than a commercial service.
It does still hide your traffic from your ISP and from the café Wi-Fi, because the tunnel is real. It simply moves the observation point to a server that is unambiguously yours, rather than into a crowd.
When self-hosting is right
Remote access to your own network. Reaching a NAS, a home server, a printer or a camera from outside is exactly what a personal VPN is for, and no commercial provider offers it.
Connecting your own devices to each other. A mesh VPN such as Tailscale, or the self-hosted Headscale, builds a private network between machines you own, wherever they are. By default there is no shared exit - though Tailscale does support exit nodes, including a paid Mullvad add-on that gives you a commercial shared exit if you want one.
Learning how any of this works. Setting up WireGuard by hand teaches more about routing, keys and NAT in an afternoon than reading about it for a month.
- Reaching home devices from outside — the original purpose of a VPN
- Linking your own machines with a mesh network like Tailscale or Headscale
- Getting past a restrictive network using an endpoint nobody has blocked yet
- Learning the mechanics rather than trusting a client to hide them
What it costs you in practice
A small VPS runs a few dollars a month, comparable to a two-year VPN subscription, so cost is not the deciding factor. The real costs are elsewhere.
You become responsible for patching. An unmaintained internet-facing server is a liability, and WireGuard being small and well-audited does not extend to the operating system underneath it.
You get one location. Commercial providers offer servers in dozens of countries; you get wherever you rented. More locations means renting and maintaining more servers.
Datacentre address ranges are widely blocked. Streaming services, and increasingly ordinary sites, treat traffic from hosting providers with suspicion, so expect noticeably more CAPTCHAs than before.
Avoid
- Self-hosting for privacy from websites — a single-user exit identifies you exactly
- Assuming WireGuard being secure makes an unpatched host secure
- Expecting streaming to work; datacentre ranges are blocked harder than consumer VPN ranges
The combination that actually works
The two approaches are not in competition, and plenty of people sensibly run both. A mesh VPN links your own devices for remote access; a commercial VPN provides the crowd when you want to be one of many strangers.
If you are choosing only one and your goal is privacy from the sites you visit, the commercial option is correct for the specific reason that other people use it too.