VPNs on home broadband: what they do and don't

With a VPN on, your device scrambles (encrypts) everything and sends it over your broadband line to the VPN company's server, which unscrambles it, fetches the website and sends the answer back down the same tunnel. Only the two ends of the tunnel can read it.

Three consequences follow, all from EFF's guides:

• Websites see the VPN, not you. Your data appears to come from the VPN server, whose IP address (the number that identifies a connection on the internet) replaces yours, so sites think you're wherever that server is. (Our guide to why your IP address shows the wrong location explains how sites guess.)
• Your provider sees a tunnel, not its contents. Your provider, and anyone else on your local network, can still see that you're connected to a VPN and which company runs it, but not which sites you visit.
• The VPN company sees everything instead. EFF's encryption primer says the VPN provider can see, store and modify your traffic, so using one shifts trust from your broadband provider to the VPN provider. It could sell that information just as a provider could. A VPN doesn't remove the company in the middle; it swaps it.

Each point below comes from EFF's VPN guide.

It isn't anonymity

Hiding your IP address doesn't hide you. EFF says companies can still track you through GPS, cookies, tracking pixels and browser fingerprinting (recognising your browser from its particular combination of settings). If you're signed in to an account, the site knows it's you whatever address you arrive from. For genuine anonymity EFF points to Tor, because no single Tor server can see your whole journey.

It isn't security software

A VPN encrypts the path, not the destination. It won't stop a phishing email, a dodgy download or a weak password. EFF lists steps it considers more impactful than a VPN: strong passwords, two-factor authentication, HTTPS-only mode in your browser, device encryption, end-to-end encrypted messaging, software updates, encrypted DNS and tracker blocking. Our guides to broadband scam calls and emails and securing your home router and Wi-Fi deal with those risks.

It isn't a legal shield

VPN companies receive law-enforcement requests too, and many keep as much information as internet providers do, under the laws of whichever countries they do business in. Paying by card links the account to you, and the company may still record your IP address.

Free isn't free

Free VPNs may sell your data, 'freemium' ones cap how much you can use, and subscriptions keep charging if you forget to cancel. An app-store listing doesn't make a VPN safe. Google Play's 'Verified' badge for VPN apps gives, in EFF's words, a small glimpse into the app's own security and privacy promises, but says nothing about the company's infrastructure or its other claims, so it's no replacement for checking the company. A 'no logs' promise is a claim, not a guarantee.

Proton VPN, a VPN company, makes the key point in its support guide to connection speed: every VPN runs its tunnel over your existing connection, so your broadband speed is the ceiling. It then lists what takes speed away:

• Distance. The farther away the server, the higher the latency (the delay before anything happens).
• Busy servers and poor routes. A heavily loaded server, or network trouble on the way to an overseas one, slows the tunnel however good your line is.
• Protocol and software. The protocol is the method the tunnel uses; Proton says WireGuard is usually fastest, and that antivirus or firewall software and background downloads can drag speed down.

The NCSC notes that internet voice calls and similar apps can avoid the extra delay by connecting directly, which is what split tunnelling does: some traffic uses the tunnel, the rest goes straight out, unprotected by the VPN. Virgin Media likewise says a work VPN could affect speed, especially in peak office hours. Our guide to latency, ping and jitter explains what to measure.

Test with the VPN off

A speed test run through a VPN measures the tunnel, not your broadband. Switch the VPN off before using our broadband speed test, then again with it on to see the difference. Apple makes the same point about its own privacy feature, iCloud Private Relay: because it uses a single connection, some speed test results may appear lower while it's on. Our guide to why speed test results differ covers other causes. If the line itself is the problem, no VPN setting will fix it: compare broadband deals at your postcode to see whether faster options, such as fibre broadband deals, are available where you live.

Sky, Virgin Media and TalkTalk each offer a free network filter that blocks categories of website for every device at home. TalkTalk says HomeSafe works through TalkTalk's DNS servers, so it can't filter a device that uses a different DNS server, or a VPN app that carries its lookups through its tunnel. Sky and Virgin Media instead block a category of service outright. From their help pages, checked October 2026:

So if a VPN won't connect on a new line, check the filter before blaming the VPN or the line; our guide to a website being blocked on your broadband walks through each provider's settings. And if you rely on a network filter for children, a VPN app on their phone may step around it, so pair it with device controls, which our guide to broadband parental controls covers.

EFF says streaming platforms are increasingly blocking devices that appear to use a VPN, so a VPN isn't a reliable way round geographic restrictions. Here's what two widely used services say.

Netflix

If Netflix shows error E106 or 'You seem to be using a VPN or proxy', something is making your device or network look as if it's connecting from somewhere other than your physical location, and Netflix recommends turning the VPN off. VPNs aren't supported for Netflix Live events or on an ad-supported plan at all, and with a VPN on you may only see titles Netflix has worldwide licensing for, so the catalogue can shrink rather than grow.

BBC iPlayer

You need to be in the UK to stream or download from iPlayer, and the BBC won't play a programme if it detects you might be using a VPN or proxy, because it can't be confident of your location. Disable it and refresh the page or reselect the programme. Programmes downloaded in the iPlayer app while in the UK can be watched anywhere.

The VPN you didn't know you had

Netflix points out that some antivirus software comes with a VPN that might be switched on. Its check takes a minute:

1. On a device on the same network, open fast.com and let the test finish.
2. Click 'Show more info' and note the country next to 'Client'. If it doesn't match where you are, a VPN is probably on somewhere: turn it off and try again.
3. If that doesn't help, Netflix suggests resetting the device's network settings.
4. Still stuck? Give your broadband provider the country and IP address shown next to 'Client'. If they match your home, Netflix says the provider should contact Netflix. If they don't match and no VPN is on, Netflix suggests asking the provider to confirm your connection uses its DNS server (and to switch you to it if not), then restarting the Netflix app.

The BBC also says to contact your provider if an IP-lookup site shows wrong details with no VPN on. For buffering rather than blocking, see our guide to why streaming keeps buffering.

VPNs are legal in the UK, as the Government's 1 August 2025 explainer on the Online Safety Act says. Its stated line through 2025 was that it had “no current plans to ban the use of VPNs” (as reported by ISPreview, November 2025); in July 2026 it went further (see below). What the law restricts is promotion to children: platforms must block content that promotes VPNs or other workarounds to young users, and those deliberately targeting UK children with VPN promotion could face enforcement action, including significant financial penalties.

The Online Safety Act 2023 became law on 26 October 2023 with Ofcom as regulator; services likely to be accessed by children had to complete children's risk assessments by 24 July 2025, and age checks followed. VPN use jumped. According to Ofcom's chief executive, as reported by ISPreview on 11 November 2025, daily active users of VPN apps in the UK temporarily doubled to around 1.5 million after the 25 July 2025 deadline, then fell back to around 1 million by the end of September 2025. ISPreview notes these are a third party's app-level estimates, and Ofcom admits that whether VPN use is rising among children is hard to measure.

On 16 February 2026 the Prime Minister proposed powers to age-restrict or limit children's VPN use, and the question went to a national consultation launched at the start of March 2026 (ISPreview). In its July 2026 response the Government said it will not ban or age-gate VPNs, while keeping the issue under review: platforms must take robust steps to prevent, detect and respond to children getting round age checks, Ofcom has been asked to research how services can detect circumvention including via VPNs, VPN providers are being asked to make their products safer, and the Government says it is prepared to act further if circumvention is not being tackled. It also promised practical guidance for parents on how VPNs work at household level (GOV.UK, government response, July 2026, updated 19 August 2026).

What that means for parents

The same response puts VPNs in proportion. It says children typically get round age checks with less sophisticated methods than VPNs, and cites Internet Matters research: 32% of children admitted bypassing age checks, most often by entering a fake birthdate (13% of 9 to 16-year-olds) or borrowing someone else's account (9%). So a VPN is one way round your provider's filter and a site's age check, but not the only one. Device-level controls and the age settings on each account are the layers that still apply when a VPN is on.

EFF's view is that VPNs are best suited to routing your connection through a different network. Here's how the usual reasons stack up.

Reasons that hold up

• You want to hide which sites you use from your broadband provider, and you trust the VPN company more.
• You use untrusted networks away from home (hotels, cafes, shared flats) and want a VPN company you trust between you and them.
• You need to reach a work network or your own home network remotely. Reaching home from outside is harder if your provider uses CGNAT (sharing one public IP address among several customers); our guide to CGNAT, static IPs and IPv6 explains why and what to ask a provider.

Reasons that don't

Security, anonymity and speed (see above), and other countries' streaming catalogues: the services increasingly detect VPNs, and on Netflix the catalogue can shrink.

If you do choose one

EFF's checklist: read the privacy policy; look for public third-party audits; understand the business model (who pays, if you don't); check the company's reputation and which countries' laws it answers to; and avoid broken encryption such as PPTP, an old protocol, in favour of common modern ones like OpenVPN or WireGuard.

Lighter alternatives

• Safari on Apple devices: iCloud Private Relay, part of iCloud+, routes Safari browsing through two relays. Apple says your network provider still sees your IP address, DNS lookups are encrypted, and a second relay assigns a temporary address. Some sites may need extra sign-in steps.
• Keeping lookups away from your provider: encrypted DNS and your browser's HTTPS-only mode, both on EFF's list, are free settings. Whichever DNS service answers your lookups still sees the site names, as our DNS guide explains.

A VPN can be the hidden cause of what looks like a broadband fault. Before reporting one:

1. One device has no internet, the rest are fine. Turn the VPN off on that device. Apple's iPhone and iPad Wi-Fi help suggests removing VPN or security software to test. If it then connects, the VPN is the problem; our guide to Wi-Fi connected but no internet covers the other causes.
2. The VPN won't connect on a new line. Check the provider's filter: Sky's default 13 rating blocks VPNs, and Virgin Media's parental controls block 'Address hiding'.
3. Netflix or iPlayer refuses to play. Run the fast.com 'Client' check above, and look for a VPN inside your antivirus suite.
4. Everything is slower than it should be. Compare speed tests with the VPN off and on, and try a closer server.

If the VPN turns out to be innocent and the line itself is slow or unreliable, our guide to reporting a broadband fault explains your options. The broadband providers hub and provider pages such as Sky broadband deals and Virgin Media broadband deals show what each offers. We compare deals through a partner's tool; you order with the provider you choose, and we don't switch you ourselves.