I Spent 15 Years in Cybersecurity. Stop Trusting VPNs.

Summary

Cybersecurity commentator Addie LaMarr argues that consumer VPNs are often marketed as broader privacy and security solutions than they really are. Her central point is that a VPN does not make users anonymous: it changes the IP address visible to websites and shifts some visibility from an internet provider to the VPN operator.

Main claims and analysis

1. VPNs have not always been privacy tools. LaMarr points to Facebook’s 2013 acquisition of Onavo. She says its free VPN collected information about users’ app activity for Facebook’s competitive research, and that Apple removed it from the App Store in 2018 over data-collection concerns. She presents Onavo as an example of how a service promoted as protective can also collect valuable user data.

2. A VPN centralizes trust rather than eliminating it. Without a VPN, different parties may see different parts of a user’s activity. With one, traffic is routed through the VPN provider, which may be able to see domains, connection times, and data-transfer patterns. LaMarr argues that “no-logs” is a provider’s promise, not a universal legal standard or guarantee, and says logging claims have sometimes been challenged when authorities sought records.

3. Brand reputation and sponsorships deserve scrutiny. LaMarr says Cape Technologies, formerly Crossrider, acquired brands including CyberGhost, ZenMate, Private Internet Access (PIA), and ExpressVPN. She also notes Crossrider’s past association with adware and malware distribution. In addition, she criticizes VPN review sites owned by companies that also own VPN products, as well as influencer ads from creators who may not independently assess the services. She emphasizes that this history does not, by itself, prove that every currently owned VPN is malicious.

4. Most people may not need a VPN running constantly. LaMarr says HTTPS encrypts the contents of most web traffic between a browser and a website. A VPN can hide domain queries from an ISP, but the VPN provider may then gain that visibility instead. She also lists possible downsides of always-on VPN use, including extra latency, captive-portal problems, malfunctioning apps, reduced streaming quality, and battery drain.

5. A VPN does not make users anonymous. It changes the IP address visible to a destination, but does not remove browser fingerprints, cookies, logged-in accounts, or other tracking methods. Logging into services such as email or social media can directly link activity to a real identity, regardless of VPN use.

6. Free VPNs still have to pay for infrastructure. LaMarr says some free services may earn money through data sales, ads or tracking, affiliate redirects, or bundled software. She advises checking an app’s privacy policy and identifying the company behind it, especially when ownership is opaque.

7. VPNs are useful in specific situations, not as a universal security fix. LaMarr lists possible uses such as accessing geo-restricted content, using untrusted networks for sensitive activity, circumventing censorship, or protecting journalists and researchers in adversarial environments. For routine browsing, she argues, HTTPS and modern device protections address many common risks more directly.

Practical takeaway

LaMarr recommends treating VPNs as tools for particular needs rather than all-purpose security shields. She says users may get more security value from spending the same money on a password manager and a hardware security key. She mentions that she uses a VPN selectively but does not name specific VPNs she recommends in the video.

Reviews, guides, and tutorials

• The video analyzes VPN industry claims and practices; it is not a step-by-step setup tutorial.
• It suggests reviewing a VPN’s privacy policy and ownership.
• It refers viewers to an earlier video that reportedly discusses VPN recommendations, but provides no recommendations here.

Main speaker/source

• Addie LaMarr — cybersecurity commentator and the video’s sole speaker.