A commercial VPN service carries your traffic through a provider you must trust, and that provider can still see destinations and timing.
The local network may be blind to contents, yet privacy now depends on the provider logging policy, legal home, and security.
How it works
You shift trust from the cafe network to the company at the far end of the tunnel.
A breach of that company, or a lawful demand in its country, can expose connection records.
The destination site still sees the provider address and your account if you sign in.
The service is not a license to break the law, and it does not clean a device that is already compromised.
Concrete examples
- A cafe cannot read tunnel contents, yet the VPN company at the far end can see where you connect.
- A provider in another country must answer a legal demand for connection logs.
- A person signs into a bank through the tunnel and the bank still recognizes the account.
Protective measures
- Read the logging policy and the legal home of the provider before you rely on it.
- Assume the provider can see destinations even when the cafe cannot.
- Do not send traffic you would not want that company to handle.
- Keep the device patched, because the tunnel does not remove hostile software from it.
Related articles
What is a VPN tunnel? explains the encrypted tunnel itself, separate from how much you should trust a commercial operator.
What is zero trust security? refuses to treat a tunnel or a network location as proof that the caller is safe.
What is SSL and TLS encryption? describes session encryption to a website, which still applies inside or outside a provider tunnel.