A VPN isn't a silver bullet. It can’t guarantee total security or anonymity online. Instead, it is a tool that allows you to hide your browsing data from your internet service provider (ISP), adopt a virtual IP address, and access geo-restricted content.

However, there are still a lot of misconceptions about what a VPN can and cannot do — a problem made worse by the exaggerated marketing claims pushed by some VPN companies.

Given that, it’s unsurprising that when we analyzed nearly 30,000 Google Play Store reviews, a clear trend emerged: a lot of people aren’t getting the privacy and security protection they thought they were paying for.

In part, this stems from users misunderstanding what a VPN does. But it also shows that the industry needs to do a better job of setting realistic expectations.

On the whole, people are satisfied with their VPNs. Across our full dataset, just 35% of overall comments were negative. However, when we isolated feedback related to privacy and security, the proportion of negative comments rose to 41%.

This article is the second in a series investigating the real-world experience of using major VPN services, driven by our exclusive analysis of Android VPN reviews. The first article examined billing and pricing issues.

Lab-tested security vs Play Store reality

Proton VPN received the highest proportion of positive comments regarding privacy and security, with 68% of its feedback on the topic being positive.

That's significantly higher than Surfshark, which recorded a positive sentiment rate of just 31%. ExpressVPN (53%) and NordVPN (34%) sat in between.

It's worth noting, however, that all four services offer essentially equivalent protection and are among the most secure VPNs available. They all feature advanced encryption and proprietary protocols, and have been audited by third parties to confirm their security credentials.

So what’s causing the disconnect between our lab tests and real-world user experience? It seems that for many, it stems from several myths about what a VPN can actually protect you from.

Myth #1: A VPN stops every 'hacker'

When analyzing the Play Store reviews, we noticed that a significant number of people were concerned about the threat of hackers. And for obvious reasons — people lose money, privacy, and their health to malicious actors online every day.

Unfortunately, a VPN can't help in every scenario, and that seems to have left many disappointed.

One Proton VPN reviewer, for example, alleges it is the “worst app ever” because they had “been hacked by someone else while using this VPN.” Meanwhile, a NordVPN comment says that “hackers” had “managed to set up a way of getting passed [sic] the VPN on all my devices.” Another simply says: “got hacked the second day, don’t trust.”

However, others proudly claim that their VPN “protects my identity from hackers.”

Like most things, the reality is somewhere in the middle. While a VPN protects your data in transit (encrypting the data between your device and the server you’re connecting to), it does nothing to protect data you’ve already handed over to a third party — like an email address or password stored on an external database.

A standard VPN also won't stop you from falling victim to phishing scams, where an attacker tricks you into voluntarily entering your credentials on a fake website. However, VPN companies are increasingly releasing products to help prevent this.

If you're looking for more details on what a VPN can and can't do, check out the cheat sheet at the end of this article.

Myth #2: A VPN offers bulletproof protection

In our tests, these VPNs have never leaked an IP address. That would be a big deal. Yet across Play Store reviews, a surprising number of people report that their VPN appeared to fail.

One NordVPN reviewer said the app “did not hide my IP address from being tracked,” while a comment about Surfshark claimed it “failed to hide my IP address at least twice in the first 3 weeks.” Another noted that their VPN “leaks IP after some time [...] giving you a wrong sense of privacy and security.”

It’s impossible to diagnose the specific issues at play without more context. However, true encryption failures are extremely rare, particularly among well-regarded providers.

In reality, most reported leaks stem from configuration errors (like not having the kill switch enabled), browser tracking or basic steup errors. To make sure your connection isn't dropping data, always enable your app's kill switch and verify your real IP address is hidden using a diagnostic tool like Cloudflare's trace page.

If you’ve checked your settings and still suspect your VPN is genuinely leaking your IP address, leave a comment below and our team will see if we can help troubleshoot it.

Myth #3: A VPN equals total anonymity

Exaggerated marketing claims around online privacy seem to have influenced reviewers throughout the data. Some accuse providers of betraying them, writing reviews like "do not trust this app for privacy," while others complain about the amount of telemetry data collected by the apps themselves.

However, these reviews highlight an uncomfortable truth: masking your IP address only goes so far. Cookies, browser fingerprints, device information, language settings, and SIM card regions are all routinely logged, analyzed, and leveraged by advertisers and platforms to track your identity regardless of your IP.

A VPN is an important first step in improving your privacy, but if you continue to use services that monitor your every move, it’s not enough on its own. Check your browser, the services you use and you might find that there are other factors at play revealing your identity.

‘Not a catch-all’ — VPN providers' defense

We reached out to each of the VPN companies mentioned in this report for comment.

Proton VPN, NordVPN, and Surfshark all acknowledged that a VPN is not a catch-all solution for every digital threat. Instead, they highlighted additional security features they offer and noted that many reported issues stem from configuration errors and non-IP tracking rather than a failure of the VPN.

ExpressVPN did not respond to our request for comment.

Proton VPN highlighted its NetShield feature, which blocks ads, trackers, and malware domains. Addressing leak complaints, the company explained that genuine tunnel traffic does not leak, and that reported issues typically occur when split tunneling, connection dropouts, or browser extensions leave specific traffic outside the encrypted connection.

Surfshark pointed to its Web Content Blocker — which it says blocked nearly 1.2 million phishing and malware sites in the past month — and its Alternative ID tool, which generates email aliases to protect contact details.

Meanwhile, NordVPN, which said that it "does not advertise complete immunity," highlighted its next-gen antivirus and credential leak monitoring tools. It added that perceived IP leaks are frequently down to device configuration rather than an IP exposure.

Combined, it's clear that leading VPN companies are developing more comprehensive and effective cybersecurity products to accompany the core VPN technology. However, if the limitations — as well as the benefits — of these additional tools aren't communicated clearly, the industry risks creating the same expectation gap it appears to face with its core technology.

What a VPN can and can't do — A cheat sheet

A VPN can:

• Encrypt your browsing traffic: Shield your internet activity from your Internet Service Provider (ISP), network manager, or public Wi-Fi admin.
• Spoof your location: Replace your real IP address with one in another location, making it harder for sites to track your physical whereabouts and help you access geo-restricted content.
• Bypass local network blocks: Circumvent restrictions imposed by Wi-Fi administrators, government censors, and geo-fenced content.
• Prevent bandwidth throttling: Stop ISPs from slowing down your speeds when they detect specific activities like streaming or torrenting.
• Secure DNS requests: Direct web address lookups through private, encrypted DNS servers to prevent ISP-level logging and DNS leaks.
• Protect your IP addressagainst DDoS attacks and IP tracking by hiding your actual home IP address during gaming or P2P connections.

A VPN can't:

• Protect the data you share: It can't stop companies from collecting data you submit directly or protect that data if those companies suffer a breach.
• Prevent phishing: It can't stop you from falling for phishing, text, or phone scams, although many providers now offer tools that help on top of the VPN.
• Make you completely anonymous:Web cookies, browser fingerprinting, and account logins can still track your identity online regardless of your IP address.
• Block hardware-delivered malware:It offers no protection against threats introduced directly to your device via physical hardware (like infected USB drives).
• Protect against digital forensics: It cannot shield files or logs stored directly on your physical device if it is accessed with forensic tools.
• Remove existing infections: It cannot retroactively clean malware or spyware already installed on your system.
• Stop OS-level zero-day attacks: It can't stop sophisticated, nation-state spyware that exploits underlying vulnerabilities in your device's operating system.

Methodology

We collected almost 30,000 user reviews published on Google Play Store since the beginning of the year for the four VPN providers featured in this report using the google_play_scraper library.

As individual reviews often address multiple topics (e.g. streaming and security), we broke reviews down into sentence-level units. This expanded our analysis to over 47,000 entries, with individual entries permitted to sit across multiple categories when suitable.

Each sentence was assigned to specific categories using regex keyword filtering, and analyzed for sentiment using a pre-trained BERT model that took into account the user’s star rating.

While all machine learning sentiment pipelines carry a minor margin of error, every VPN provider was subjected to the exact same pipeline to ensure consistency and fair comparison. Human review was also conducted throughout.

Data processing scripts were developed in Python with AI assistance, and all final outputs were manually reviewed.

Sam is VPN Managing Editor at TechRadar. He has worked in the VPN industry since 2018 and has previously written for CNN, Al Jazeera, WIRED, and Deutsche Welle as a freelance journalist. He focuses on VPNs and digital privacy, cybersecurity and internet freedom.

Before joining TechRadar, Sam carried out research on global digital rights issues at Top10VPN. His research has been cited by the United Nations and UK Parliament, as well as publications such as The Guardian, Washington Post and BBC.