Introduction

Open your Mac. Launch Safari. Go to any site. While the page loads, your ISP logs the domain, the time, your IP address, and the amount of data exchanged. Not out of curiosity. Because that’s how the network works, and in most jurisdictions, it’s allowed or required.

A VPN doesn’t make you invisible. It doesn’t turn your Mac into a digital fortress. But it solves a specific, real problem: preventing third parties from snooping on your browsing and potential malicious activities without your knowledge. This article explains how, why, and especially where it stops.

The Problem

Your ISP Sees Everything (Almost)

When you type a URL into your browser, here’s what your ISP sees, even if the site uses HTTPS:

• Your IP address, which is basically you, at your physical address
• The domain you’re visiting. DNS resolution happens in the clear on most networks (Chrome and Firefox can encrypt DNS via DNS over HTTPS, but it’s not universal, it depends on your configuration and region)
• The time and frequency of your connections
• The amount of data exchanged

HTTPS encrypts the content of pages. Not the metadata. And metadata is often more revealing than content itself. Regular calls to a labor law specialist lawyer say more than the conversation itself.

In Europe, ISPs keep this metadata for several months to two years, depending on the country. In France, the law requires a one-year retention period (a controversial framework at the European level but maintained in France). In the US, in 2016 the FCC adopted rules requiring ISPs to protect your browsing data. In 2017, Congress repealed them before they took effect. Result: no obligation to protect, ISPs do what they want with your metadata. It’s not a dystopia, it’s the legal framework in effect.

Public Wi-Fi is Worse

At a café, hotel, airport: the network isn’t owned by someone trustworthy. Anyone on this network, or its manager, can observe the domains you’re visiting, launch man-in-the-middle attacks on poorly configured connections, or serve you a fake captive portal that looks exactly like your bank’s page.

HTTPS protects content. Not your IP address. Not the domains you visit. And not against a malicious Wi-Fi access point that mimics the “Starbucks_Free” network nearby.

It’s Not Paranoia

If you’re self-employed, freelance, or run a small business, your browsing habits reveal your clients, suppliers, strategic research, and legal concerns. It’s intelligence economics served on a platter. For free.

Read: What Digital Sovereignty Means in Practice

The Mechanism

How It Works

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a remote server. All your internet traffic goes through this tunnel before reaching its destination.

When you connect to a VPN:

1. Your Mac establishes an encrypted connection with a VPN server (located in the country of your choice)
2. Your DNS requests and web traffic travel inside this tunnel, unreadable to anyone between you and the server
3. The VPN server makes requests on your behalf to the sites you’re visiting
4. The sites see the IP address of the VPN server, not yours

Simple analogy: instead of sending a letter with your name and address on the envelope, you hand it to a trusted intermediary who re-sends it from their own office. The recipient gets the letter, but they don’t know where it’s from. And the mail carrier who transported it between you and the intermediary can’t open it, it’s sealed.

Protocols: Not All Equal

Under the hood, a VPN uses an encryption protocol. The three you’ll encounter:

• WireGuard, the modern standard. Minimalistic code (a few thousand lines), fast, auditable. That’s what you want.
• OpenVPN, the veteran. Reliable, proven, but heavier (tens of thousands of lines) and slower than WireGuard. Still very common.
• IKEv2/IPSec, supported natively by macOS, making it a solid choice on a Mac without installing third-party apps. Stable, quick to reconnect when you change networks.

The trend is clear: WireGuard is becoming the reference protocol. If your VPN provider doesn’t offer it, it’s a red flag.

Why It’s Designed This Way

The VPN wasn’t invented for privacy. Originally, it’s a tool for businesses: allowing remote employees to access the internal network as if they were in the office. The encrypted tunnel between two points is the founding concept.

The “privacy” use is an adaptation. Instead of connecting an employee to their company, you connect an individual to an intermediate server to hide their traffic from their ISP. The mechanism is the same. The intention has changed.

This is important to understand because it explains the limits: a VPN does very well what it was designed for, creating a secure channel between two points. It doesn’t do the rest.

What It Changes in Practice

Before / After

Without a VPN:

• Your ISP sees all the domains you visit and can profile your habits
• On public Wi-Fi, your traffic is exposed to local snoopers and potential malicious activities
• Sites see your real IP address and your geographical location
• Your DNS requests pass in the clear (Chrome and Firefox can encrypt via DoH, but it’s not guaranteed depending on your configuration)

With a VPN:

• Your ISP only sees encrypted traffic to a single server, zero visibility on your browsing
• On public Wi-Fi, the encrypted tunnel makes your traffic unreadable to the local network and therefore immune to attacks or data siphoning
• Sites see the IP address of the VPN server, not yours
• Your DNS requests are resolved by the VPN server, not your ISP

Real-Life Use Cases

Working from public places. If you work regularly from cafés, coworking spaces, hotels, or airports, a VPN is cheap insurance. It’s the layer of protection between you and a network you don’t control.

Preventing your ISP from profiling you. You might not have anything to hide. But that’s not the point. The point is: why should your ISP be able to build a complete profile of your browsing habits, and in some cases sell it?

Keeping a stable IP address while traveling. If you work in several countries, some services behave differently, or even block you, if your IP address changes jurisdictions every couple of days. A VPN lets you appear to be in a fixed country, no matter where you are physically.

Bypassing censorship. In some countries, entire parts of the internet are blocked. A VPN lets you access them. It’s less a use case for freelancers in Europe and more about freedom of information, but it’s worth mentioning.

The Limits

This is where most affiliate sites turn a blind eye.

A VPN doesn’t make you anonymous. If you’re logged into Google, Facebook, your Apple account, they know who you are, VPN or not. The VPN hides your IP address at the network level. It doesn’t hide your identity at the application level. You log in with your credentials? The VPN doesn’t change anything. If you want real anonymity (and you know why), it’s Tor you need, and that’s another topic, with other compromises.

A VPN doesn’t protect against malware. If you download an infected file, the VPN doesn’t care. It encrypts the transport, not the content. A VPN isn’t an antivirus, not a firewall, not an anti-phishing filter (even if some providers integrate a DNS blocker, it’s a bonus, not a guarantee).

The VPN changes the intermediary. It doesn’t remove the intermediary. Without a VPN, your ISP sees your traffic. With a VPN, it’s the VPN provider that sees it. That’s why choosing the provider is critical: audited no-logs policy, open-source code, solid jurisdiction. If your VPN provider keeps logs or cooperates with intelligence agencies, you’ve just replaced one problem with another.

Free VPNs are (almost always) the problem, not the solution. If the service is free and the company isn’t a non-profit, your traffic is probably what they’re monetizing. Hola was caught selling its users’ bandwidth as a botnet, SuperVPN let millions of users’ data leak despite a “no-logs” policy. You’d be solving one problem by creating a worse one. The only notable exception: free tiers of paid providers (Proton VPN free, for example), funded by paying customers, not your data.

A VPN doesn’t bypass all geographical restrictions. Netflix, Disney+, and streaming platforms have become very effective at detecting and blocking VPN server IP addresses. It works sometimes, it doesn’t work other times, and it can change from one day to the next. If your main use is geo-blocked streaming, adjust your expectations.

In Summary

A VPN creates an encrypted tunnel between your device and a remote server. Your ISP no longer sees what you’re doing online, your real IP address is masked, and your traffic is protected from attacks on public networks. It’s not a magic armor, it’s a precise tool for specific problems, with clear limits: it doesn’t make you anonymous if you’re logged into Facebook or Instagram, it doesn’t block malware, and it shifts your trust to a provider you need to choose carefully.

In Practice: if you work from public places, travel regularly, or the idea of your ISP building a complete profile of your browsing habits bothers you, a VPN is a very reasonable investment given the protection it provides. The choice of provider (audited no-logs policy, open-source code, jurisdiction outside surveillance alliances) will make all the difference between real protection and security theater. We’ll detail exactly how to choose, criteria, comparison, recommendations, in a future dedicated article.

Read: Privacy macOS: The Settings to Change in 15 Minutes

Technical terms? Check the glossary.