Using a VPN while travelling: what it actually changes

What happens when you switch it on

Without a VPN, your traffic goes from the phone to the local network, Wi-Fi or mobile, and from there to the internet. With one, the FTC explains, data from your phone is first routed through servers controlled by the VPN provider. The UK's National Cyber Security Centre describes VPNs as encrypted network connections and as one way to protect data in transit across an untrusted network. It adds that they help by preventing direct connections to and from the local network, which protects against attacks from other devices on it.

So the local network still carries your traffic, but it sees an encrypted stream going to one server instead of where you are going. On iPhone, a VPN symbol appears in the status bar while it is connected, which is the quickest way to know it is really on.

On hotel and café Wi-Fi

This is where a VPN earns its place. The NCSC points out that with public hotspots in hotels or cafés there is no easy way to find out who controls them, or to prove that one belongs to who you think it does. Encrypting everything before it reaches that network removes much of the guesswork.

Keep the risk in proportion, though. The FTC notes that most websites now use encryption, so connecting through public Wi-Fi is usually safe for them, and that most apps do too, although it can be hard to tell. A VPN covers what is left. One practical snag: many hotel networks start with a login page, and the NCSC warns that an always-on VPN can clash with these captive portals. Join the Wi-Fi, complete the login page, then connect the VPN.

On mobile data, including a travel eSIM

Mobile networks are a different case. The NCSC's advice for working on the move is to use your mobile connection rather than unknown hotspots, because it has built-in security, and it treats a VPN as an alternative rather than an extra layer on top. On a travel eSIM, then, a VPN is optional rather than essential.

What it still changes is who sees your traffic. The FTC notes that a VPN typically hides the content of your traffic from your internet provider, which on mobile data means the mobile operator. If you share your phone's connection with a laptop, check that the VPN and the hotspot get along: the NCSC notes that device-wide VPNs can affect how tethering works. The hotspot set-up itself is in the laptop hotspot guide.

What a VPN does not do

• It does not make you anonymous. The FTC says sites can still tell that you are using a VPN and can track you through whatever you share with them, such as your email.
• It does not always encrypt. Not every VPN app encrypts all your traffic; some use protocols that leave part of it unprotected.
• It does not protect you from a scam website. Fake sites can be encrypted too, and what you type there reaches the scammers either way.
• It does not remove trust, it moves it. The FTC's phrase is that it shifts trust from the network to the VPN provider.

That last point is the one to act on. Many free VPN apps pay for themselves with in-app advertising or by sharing information with third parties, the FTC warns, so read the privacy policy before you install one.

Setting it up before you leave

Choose and install the VPN at home, on your own Wi-Fi, not in the hotel lobby. The NCSC recommends sticking to reputable providers, and the FTC suggests checking which permissions the app asks for and whether they make sense for what it does. Connect it once at home to see that it works, and learn where its switch is so you can turn it off quickly if a login page or an app misbehaves.

Rules about VPN use are not the same everywhere. Before you travel, check the local rules of the country you are going to, as well as the terms of any service you plan to use through it. That is a question for official sources in your destination, not for a travel checklist.