What a VPN Provider Can — and Can't — See About You

Quick overview: who sees what after you connect

When you turn a VPN on, two things change at the network level. Your Internet Service Provider (ISP) no longer sees the specific websites, domains or page content you visit. Instead the ISP sees an encrypted connection from your device to a single VPN server: that connection’s endpoint IP, timestamps, protocol and the volume of data transferred.

The VPN provider becomes the network endpoint that the rest of the internet sees on your behalf. That means outgoing requests (websites, apps, DNS lookups) leave from the VPN server’s IP address and the provider routes the packets. Because the VPN server handles your traffic, the provider can observe much more network-level metadata than your ISP did, and—depending on configuration—some or all DNS queries and unencrypted contents.

Whether anything sensitive is exposed depends on the VPN protocol in use, how DNS is handled, browser/OS leakage (WebRTC, IPv6), any split-tunnel rules you enabled, and the provider’s logging and telemetry practices. Below is a precise list of what a VPN provider can see, what it normally cannot, how leaks happen, and what to check if you want to verify your privacy.

Exactly what a VPN provider can see

Here are the concrete items a VPN provider can observe at the network or application level when you use their service:

• Your real (source) IP address — the provider sees the IP address your device used to establish the VPN session and can therefore associate sessions with an account or client ID if they log that mapping.
• Timestamps — when you connected and disconnected, and the duration of each session.
• The VPN-assigned IP address — the public IP that the outside world sees for your traffic while you’re connected.
• Destination IP addresses and ports — every connection the VPN forwards has a destination IP and port, which directly reveals the server you reached (and, by implication, the website or service in many cases).
• DNS queries — if the VPN handles DNS for you (typical), the provider can see the domains you resolve. If your device leaks to a different resolver, the VPN provider will not see those queries but they will be visible elsewhere.
• Connection metadata — session duration, total bytes in/out, protocol in use (OpenVPN, WireGuard, IKEv2, etc.), and packet-level timing and size characteristics.
• Unencrypted traffic contents — any plaintext protocol (HTTP, FTP, some older mail protocols) or app data that is not end-to-end encrypted is visible in full.
• Client/telemetry data — many VPN apps collect device model, OS version, client IDs, app version and account identifiers. Whether these are retained or linked to sessions depends on the provider’s implementation and policy.

Some of these items are trivial for the provider to collect; others require deliberate logging. For example, seeing destination IPs is inherent to routing traffic. Persisting a mapping between your real IP, account and timestamps is a logging decision and not strictly required to route packets, but many providers keep such records for operational or legal reasons.

What a VPN provider normally cannot see

There are limits to visibility even for the operator of the exit node. These are the main things a VPN provider typically cannot see:

• Contents of properly encrypted traffic — when you use HTTPS or properly implemented end-to-end encryption inside an app (Signal, modern TLS-based APIs), the provider cannot read the page text, form fields, or message content. They still see the destination IP and, unless protected by newer protocols, the TLS Server Name Indication (SNI) revealing the domain.
• Local device data — files, password manager vaults, local databases and other data on your device aren’t visible to the VPN unless the VPN app has local access permissions and explicitly collects them.
• Encrypted payloads inside an inner tunnel — if you run Tor over VPN, the VPN can see you connected to Tor (it sees the Tor entry node IP), but it cannot see Tor-layer destinations or hidden-service traffic payloads.

Note: even when contents are encrypted, traffic analysis (timing, packet sizes, destination IPs) can sometimes be used to infer activity. That kind of inference is not “reading” content, but it can reduce anonymity in some contexts.

Common leak vectors and how to test them

Most real-world privacy failures are due to leaks, misconfiguration or split-tunnelling rather than some esoteric fault of the VPN protocol. Here are the common vectors and how to check them.

DNS leaks

If DNS queries reach your ISP or a third-party resolver instead of the VPN’s resolver, domains you visit may be visible outside the tunnel. To test: connect to the VPN and use a DNS leak test site like dnsleaktest.com or ipleak.net. The results should show your VPN provider’s DNS servers; if you see your ISP or another resolver, you have a leak.

IPv6 leaks

Some VPNs only tunnel IPv4 traffic by default. If your device keeps an active IPv6 path, traffic over IPv6 can bypass the VPN. Options: disable IPv6 on your device or use a provider that supports IPv6 tunneling. Test using IPv6 leak checks at common leak-test sites.

WebRTC and browser leaks

WebRTC can expose local and public IP addresses to websites even when a VPN is active. To prevent this, disable WebRTC in browser settings or use a privacy extension. Online WebRTC leak tests (for example at browserleaks.com/webrtc) show whether your public IP is leaked.

Split tunnelling and per-app exceptions

If split tunnelling is enabled, some apps may bypass the VPN and connect directly. Audit your VPN client’s split-tunnel settings and verify app behavior by checking the public IP from within the app (if possible) or by using packet capture tools on your device.

How to run a basic verification

1. Connect to your VPN server.
2. Visit an IP-check site to confirm your public IP changed to the VPN-assigned IP.
3. Run DNS, IPv6 and WebRTC leak tests and confirm only the VPN’s endpoints appear.
4. If you use split tunnelling, repeat tests for apps that are excluded to confirm expected behavior.

Jurisdiction, logging and legal requests — why policies matter

Technical capability and legal obligation are distinct. A provider technically capable of recording everything can still refuse to keep logs; conversely, a legally compelled provider may be required to retain or hand over records even if they prefer not to. When evaluating risk, consider these points:

Jurisdiction: the country where a provider is incorporated determines what law enforcement or intelligence agencies can legally compel. Some jurisdictions have mandatory data-retention or surveillance laws; others have weaker or no such mandates.

No-logs and RAM-only infrastructure: providers that run servers from RAM-only storage (no persistent disk) and claim limited logging reduce the chance that historical records survive a seizure or warrant. Independent audits and transparency reports add credibility, but audits vary in scope—look for audited claims that match what you care about (connection logs, DNS logs, billing records).

Retention windows and shared IPs: even when logs exist, short retention periods and shared IP addresses make tying an action to an individual harder. If a provider keeps timestamps and source IPs tied to accounts for long periods, a court order can link an account to activity.

In short, what a VPN provider can legally be forced to disclose depends on the law where they operate and whether they actually retain the relevant logs. Technical protections (RAM-only servers, ephemeral keys) reduce exposure, but only policies and audits show whether those protections are implemented.

Short FAQ: practical answers

Can my ISP see what websites I visit with a VPN? No — the ISP sees only an encrypted connection to the VPN server (unless there's a leak). They can see the VPN server IP, timestamps and traffic volume.

Does a VPN hide info from the provider? Not from the provider itself. By design the provider handles your traffic and therefore can see destination IPs, DNS queries (if it handles DNS) and session metadata unless the provider takes steps not to log those items.

Can governments track VPN users? Governments can track users if the VPN provider logs identifying data or if the government controls or seizes the provider’s infrastructure. Choose a provider with an appropriate jurisdiction, minimal logging, and independent audits if you need protection against legal requests.

Will a VPN change your Google Maps location or device GPS? No — a VPN changes IP-based location only. Apps that use device GPS will still report real GPS coordinates unless you use a separate location-spoofing mechanism.

Does a VPN hide your IP from police? A VPN hides your IP from websites and services by making them see the VPN’s IP address instead of yours. If law enforcement obtains logs from the provider that map VPN-assigned IPs back to real IPs or accounts, they can trace activity — that’s why logging policy and retention matter.

Final practical note

If your threat model requires strong anonymity (targeted surveillance, state-level actors), combine tools and practices: minimize telemetry in apps, use chain-of-trust services (Tor, end-to-end encrypted messaging), pick a provider with short retention and RAM-only servers, and verify your connection with leak tests regularly. If your goal is routine privacy and a safer experience on public Wi‑Fi, a standard audited VPN with DNS protection and IPv6 handling will address most practical risks.