Can You Be Tracked With a VPN?

Many people turn on a VPN expecting the internet to stop watching them. The honest answer to "can you be tracked with a VPN?" is yes, in several ways. A VPN is very good at one job: it moves your traffic through an encrypted tunnel, so your local network cannot read it and websites see the VPN's IP address instead of yours. Most modern tracking, though, does not depend on your IP address at all. It depends on cookies stored in your browser, on the unique shape of your device, on location sensors in your phone, on advertising IDs, and above all on the accounts you sign in to.

This article walks through each of those methods, explains what a VPN does and does not change, and finishes with a practical checklist. If you want the bigger question of anonymity, read can a VPN make you anonymous alongside this one. Here we focus on tracking, the everyday collection of data about what you do online.

What a VPN changes and what it leaves alone

Think of the people and systems that can observe your online activity. A VPN affects some of them a lot and others not at all.

Who or what	Without a VPN	With a VPN
The café, hotel or office network	Can see which sites you connect to (and the content of any unencrypted traffic)	Sees an encrypted connection to the VPN server
Your internet provider	Sees the sites and services you connect to	Sees that you use a VPN, not the sites inside the tunnel
The website you visit	Sees your real public IP address	Sees the VPN's IP address instead
Cookies already in your browser	Recognise you	Still recognise you
Your browser's fingerprint	Identifies your setup	Identifies your setup in the same way
Your phone's GPS and Wi-Fi location	Available to apps with permission	Still available to apps with permission
Your logged-in accounts	Link activity to you	Link activity to you

The pattern is clear. A VPN protects the path between your device and the internet and swaps the IP address that websites see. The rest of the table, the identifiers that live on your device or in your accounts, is untouched. The article does a VPN hide your IP explains the first half in detail. The sections below cover the second half.

Cookies and other browser storage

A cookie is a small piece of data a website asks your browser to keep, such as a login session, a language choice or a shopping basket. Cookies are useful. They also let sites recognise a returning visitor. First-party cookies belong to the site you are visiting. Third-party cookies are set by other companies whose code is embedded in the page, such as advertising networks and analytics services. When the same third party is embedded on thousands of sites, it can recognise your browser on all of them and build a picture of your interests.

A VPN does not touch any of this. If your browser already holds a tracking cookie, it sends that cookie whether you connect through a VPN or not. Switching on a VPN and then visiting the same shop with the same browser lets the shop's advertiser see the same cookie it saw yesterday, now from a different IP address. Modern tracking systems are designed for exactly this situation, because home IP addresses change and phones move between networks all day.

Cookies are not the only storage. Sites can also use local storage, cached files and similar browser features to keep identifiers. Clearing cookies alone may not clear everything.

What helps:

• Block third-party cookies in your browser settings, or choose a browser that does this by default.
• Clear site data regularly, or let the browser clear it when you close it.
• Use separate browser profiles, for example one for banking and shopping and another for casual reading, so trackers cannot easily join the two.
• Be aware that private windows only forget data locally once you close them. VPN vs incognito mode explains why that is a different tool from a VPN.

Browser fingerprinting

A fingerprint does not need to store anything on your device. Instead, a website asks your browser many small questions and combines the answers: browser version, operating system, screen size, installed fonts, language, time zone, graphics hardware, supported media formats and more. Each answer is common on its own. Together they can be rare, sometimes unique enough to recognise your browser again later without any cookie.

A VPN does not change those answers. Your screen size, fonts and graphics hardware are the same through a tunnel as outside it. In one respect a VPN can even make the fingerprint more distinctive: your IP address says you are in one place, while your browser's time zone and language say you are somewhere else. That mismatch is an unusual combination, and some systems treat it as a signal.

Example: Dana uses the same laptop and browser for work research and for personal shopping. She connects to a VPN for the research. A shopping site that has already built a fingerprint of her browser sees the same fingerprint through the VPN and links the visits, even though the IP address is different.

You can see how identifiable your own browser is with the EFF's Cover Your Tracks test. It shows how unique your fingerprint looks and whether your browser blocks common trackers.

What helps:

• Use a browser that offers fingerprinting protection and keep it updated. Popular configurations blend in better than heavily customised ones.
• Avoid installing many extensions. Each one can make your browser more unusual.
• Know that making a browser look identical to thousands of others is difficult, and that no setting guarantees it.

Location tracking beyond your IP address

When a website says "we noticed you are in Chiang Mai", it usually guessed from your IP address. A VPN changes that guess, which is why it can change the city or country a site thinks you are in. But your device has many better ways to know where you are:

• GPS and the phone's location services. Maps, weather, delivery and social apps may ask for precise location. If you allow it, the VPN is irrelevant to those apps.
• Wi-Fi and Bluetooth positioning. Phones estimate location from nearby Wi-Fi networks and Bluetooth beacons, even indoors where GPS is weak.
• Browser geolocation. A website can ask your browser for your location. If you press Allow, the browser answers using the device's sensors, not your IP address.
• Photos. Pictures taken with location tagging on can contain coordinates in their metadata. Many platforms strip it when you upload, but not all do.
• Time zone and language. Your device settings quietly reveal the region you normally live in.

The practical consequence is simple. If an app has location permission, connecting to a VPN does not hide your real position from that app. Open your phone's privacy settings and look at which apps can use location, and whether they can use it only while you use the app. Switching from "always" to "while using" for most apps is a quick improvement.

Ad tracking and advertising IDs

Advertising uses several layers of identifiers, and few of them are your IP address.

• Advertising IDs. Phones give each device a resettable advertising identifier that apps can read to connect your activity across apps. Both major mobile systems let you reset it or limit its use in the privacy settings.
• App tracking code. Many free apps include analytics and advertising libraries. These send data from inside the app, over the VPN if it is on, to the company behind the library.
• Logged-in advertising accounts. If you are signed in to a large platform that sells ads, your activity on its services and on partner sites can be tied to your account.
• Email addresses and phone numbers. Advertisers can match a hashed email address across services. When you sign up to a newsletter with the same address everywhere, you give them a durable key.
• Retargeting. The ad that follows you after you look at a product comes from a cookie or an ID, not from your IP address.

A VPN removes one input from this system, your network location. It does not stop an app from sending its advertising ID or stop a login from linking sessions. For ad tracking, the effective steps are settings changes: reset or limit the advertising ID, deny the "allow app to track" prompt on phones that show it, use a separate email address for sign-ups, and use tracker-blocking features in your browser.

Social accounts, logged-in identity and doxxing

The strongest identifier on the internet is a login. If you sign in to a social network, an email service or a shopping account, that service knows who you are, no matter which IP address you connect from. A VPN cannot make a signed-in session anonymous, because you told the site your name.

Social platforms also reveal information that has nothing to do with network tracking:

• Public posts, photos and tags can show where you live, work or study.
• Reusing the same username across services lets others connect your profiles.
• Friends and followers can reveal location by tagging you.
• Photo backgrounds, street signs and shop fronts are often enough to identify a place.

This is the reality behind doxxing, the practice of collecting and publishing someone's personal details. A VPN can help in a narrow case: it stops someone who sees your connection, for example in a game lobby or a chat tool that exposes IP addresses, from learning your home IP address and approximate location. That protection is real. But most doxxing works by joining details you shared yourself, such as usernames, photos, workplace information and old posts. A VPN cannot take those back.

Steps that reduce this risk:

1. Use different usernames and profile photos for accounts you do not want connected.
2. Review each social account's privacy settings: who can see posts, tag you or find you by phone number or email.
3. Turn off location tagging on photos and posts, or remove it before sharing.
4. Search for your own name and usernames occasionally to see what is publicly findable.
5. Use unique passwords and two-factor authentication so your accounts are harder to take over.

Browser privacy settings vs a VPN

Browser privacy tools and a VPN address different problems. Neither replaces the other.

Tool	What it helps with	What it does not help with
VPN	Hides traffic from the local network and your internet provider, changes the IP address websites see	Cookies, fingerprints, logins, GPS, advertising IDs
Tracker blocking and third-party cookie blocking	Stops many advertising and analytics trackers from recognising your browser	Your internet provider's view of connections, your IP address
Private or incognito window	Forgets history and cookies on your device after you close it	Anything visible on the network or to websites during the session
Separate browser profiles	Keeps cookies and logins for different activities apart	Your IP address, your fingerprint's basic traits
Phone privacy settings	Limits location, advertising ID and app permissions	Traffic content on untrusted Wi-Fi
Logging out	Stops activity from being tied to an account	Cookies and fingerprints that still identify the browser

If you are deciding what to do first, browser and phone settings often give more privacy for tracking specifically, because they target the identifiers that advertisers actually use. A VPN adds value when the local network is a concern, for example public Wi-Fi, or when you do not want your internet provider or the site to see your home IP address.

A practical checklist for reducing tracking

Use this as a one-time setup and a quick routine:

1. Update your browser and phone. Updates often add tracking protections.
2. Turn on tracker and third-party cookie blocking in your browser's privacy settings.
3. Check your fingerprint with a testing tool and see whether your browser stands out.
4. Audit app permissions. Remove location, camera, microphone and contacts access from apps that do not need them. Prefer "only while using the app".
5. Reset or limit your advertising ID in your phone's privacy settings.
6. Split your browser use. Keep one profile or browser for accounts you sign in to and another for general browsing.
7. Use different email addresses for important accounts and for newsletters or one-off sign-ups.
8. Turn on a VPN when your network is the concern, for example on hotel, airport or café Wi-Fi, and test that it works. The help guide on checking if your VPN is working covers this.
9. Check your accounts' privacy pages every few months, because defaults change.
10. Think before you post. What you publish yourself is often the easiest thing to track.

Limits and common mistakes

• Believing the VPN made you invisible. It changed your IP address and protected your traffic on the network. It did not log you out of anything.
• Staying logged in to everything. A VPN with an open social media account is still a social media account with your name on it.
• Granting location permission and then expecting privacy. Apps with permission use GPS directly.
• Ignoring the browser. Cookies and fingerprints work through a tunnel exactly as they do without one.
• Assuming "private" mode means "untraceable". It stops local history. It does not hide your activity from the network or the sites you visit.
• Using unknown free tools. A poorly run VPN or browser extension can become a tracker itself. What a VPN cannot protect you from covers more of these limits.
• Skipping the fundamentals. A strong, unique password and two-factor authentication protect you from far more harm than any tracking setting.

None of this means a VPN is pointless. It means a VPN is the right tool for a specific job: protecting your connection and hiding your home IP address from the sites and networks in the path. For tracking, treat it as one layer in a group that includes browser settings, phone permissions and your own habits.

Summary

You can still be tracked with a VPN. A VPN changes your IP address and shields your traffic from the local network, but cookies, browser fingerprints, location sensors, advertising IDs and logged-in accounts keep working. Reduce tracking by blocking third-party cookies, testing your fingerprint, limiting app permissions, resetting the advertising ID and separating your accounts. Use the VPN for the problems it genuinely solves.

If you want a VPN for those jobs, a prepaid XPASS pass gives you a fixed period of access with no automatic renewal.