Virtual Private Network (VPN)

A virtual private network (VPN) is a technology that creates an encrypted connection, often called a tunnel, between a device and a server run by a VPN provider or an organisation. Internet traffic travels through that tunnel before reaching the wider internet, so the local network cannot read it and websites see the VPN server's IP address rather than the user's own.

VPNs began as a business tool for letting staff reach a company's internal systems securely from outside the office. Today consumer VPN apps are widely used for privacy on public Wi-Fi and to appear to be in another country. That second use brings VPNs into contact with financial regulation, because banks, payment firms and crypto exchanges often have to block users from certain jurisdictions.

Imagine posting a letter in a locked box to a friend in another city, who opens it and posts the letter on for you. The postal workers along the way see only a locked box addressed to your friend, and the final recipient sees your friend's city on the postmark, not yours. A VPN does the same with internet traffic: your connection is sealed on the way to the VPN server, which then sends it on.

The friend, however, can read every letter. A VPN moves trust from your internet provider to the VPN company, which is why the provider's honesty and security matter as much as the technology.

When a VPN connection starts, the device and the server agree on keys and set up an encrypted channel using a protocol such as IPsec, OpenVPN or WireGuard. The device then routes some or all of its traffic through that channel. Data is protected by encryption while in transit between the two ends, but it is not encrypted end to end with the final website unless that site also uses its own encryption, as most now do with HTTPS. A VPN differs from onion routing systems such as Tor, which pass traffic through several relays so that no single operator sees both the user and the destination.

Two settings shape how much a VPN actually covers. Split tunnelling lets a user send only some apps or sites through the tunnel while the rest use the normal connection, which saves speed but leaves that other traffic exposed. A kill switch cuts the internet connection if the tunnel drops, so that traffic does not leak out unprotected without the user noticing. Leaks can also happen through the system that turns website names into addresses, so well-built VPN apps route those lookups through the tunnel as well. Business VPNs add another layer: they usually require staff to sign in with a password plus a second factor, and they record which employee connected and when, so that security teams can trace suspicious activity on internal systems.

• Remote work. Companies use VPNs so that staff can reach internal systems as if they were on the office network.
• Public Wi-Fi. Travellers use them to stop others on the same network from snooping on traffic.
• Privacy from internet providers. Users hide which sites they visit from their own provider, part of wider concerns about data privacy.
• Location shifting. People use them to reach content or services limited by geo-blocking, or to get round national censorship.

Many centralized exchanges are barred from serving customers in some countries, either because they lack a local licence or because of economic sanctions. They block those users by IP address and by checking identity documents during know your customer checks. Using a VPN to get round such limits usually breaks the platform's terms of service, and exchanges may freeze or close accounts, sometimes holding funds while they investigate.

For firms, IP data is part of compliance. US authorities have reached settlements with crypto companies, in 2020 and 2021, over failures to act on IP address information that showed users in sanctioned regions, and sanctions screening programmes now routinely look for signs of VPN use. Some decentralized applications also block certain regions at their web front end, though the underlying smart contracts remain reachable.

Using a VPN is legal in most countries, but some governments restrict or ban services they have not approved, and several require providers to log users or block certain sites. Where VPNs are legal, using one to commit fraud, evade sanctions or breach a service's terms is not made lawful by the tool.

VPNs also have practical limits. They do not stop malware or phishing, do not make a user anonymous to services they log into, and can slow connections. Free services in particular have been criticised for selling user data or showing intrusive adverts, and claims of "no logs" are hard for customers to verify without independent audits.