Every second podcast ad break seems to feature someone telling us our internet connection is one unencrypted click away from disaster, and that the only thing standing between us and total ruin is a $4-a-month VPN subscription. It’s a compelling pitch, and it’s also mostly nonsense. That doesn’t mean VPNs are useless — far from it — but the marketing around them has drifted a long way from what the technology actually does. We wanted to cut through that and give a straight answer to the question a lot of Australians are quietly asking in 2026: do we actually need one?
The honest answer is “sometimes, for specific reasons, and not the reasons most ads mention.” A VPN is a genuinely useful tool in the right circumstances, and a complete waste of money marketed on fear in the wrong ones. So let’s break down exactly what a VPN protects, what it doesn’t, when it earns its keep, and how to avoid the flood of shady free providers cashing in on the confusion.
What a VPN actually does
At its core, a VPN (virtual private network) does two things. First, it encrypts the traffic between your device and the VPN provider’s server, so anyone sitting between the two — most relevantly, whoever runs the wifi network you’re connected to — can’t read what you’re sending or receiving. Second, it routes your traffic through that provider’s server, so the website or service you’re visiting sees the VPN’s IP address rather than yours.
Those two things solve two real problems. The first is public wifi snooping. Open networks at airports, cafes, hotels and shopping centres are trivially easy to intercept traffic on if they’re not properly secured, and plenty of them aren’t. A VPN closes that gap by encrypting everything before it leaves your device, so even a poorly secured hotspot — or a malicious one set up specifically to capture data — can’t see anything useful.
The second is ISP-level visibility. Without a VPN, your internet provider can see every domain you connect to, when, and roughly how much data you’re moving, even if the content itself is encrypted by HTTPS (which almost everything is these days). In Australia this matters more than in a lot of countries, because our data retention laws require telcos to retain certain metadata for two years and make it available to a range of government agencies without a warrant in many cases. A VPN doesn’t make you invisible, but it does mean your ISP sees a connection to a VPN server rather than a browsing history — the VPN provider becomes the one holding that visibility instead, which is a trade-off worth understanding rather than an automatic win.
What a VPN won’t protect you from
This is the part most VPN advertising conveniently skips over, so it’s worth being blunt about it: a VPN does nothing to stop phishing, and it does nothing to stop malware. If you click a link in a text message pretending to be Australia Post and hand over your card details on a fake page, a VPN was running the entire time and it made zero difference. If you download a dodgy attachment or a cracked piece of software carrying a payload, the VPN encrypted the download perfectly well on its way to infecting your machine.
Encryption protects data in transit. It has nothing to say about whether the thing you’re connecting to is trustworthy, or whether the file you just opened is what it claims to be. Scammers targeting Australians are increasingly sophisticated, and government-run resources like Scamwatch’s phishing scams page are worth bookmarking if you want an up-to-date picture of the tactics currently doing the rounds — fake delivery notifications, bank impersonation, and increasingly convincing invoice scams targeting small businesses. If you want a practical rundown of the tell-tale signs before you ever click, we’ve covered this in detail in our guide on how to spot a scam website, and it’s a much better use of five minutes than assuming a VPN has your back on this front.
The same logic applies to malware generally, and to account security more broadly. A VPN doesn’t stop a keylogger, doesn’t stop ransomware, and doesn’t stop someone reusing a leaked password against your accounts. Those are separate problems that need separate tools — decent antivirus, careful downloading habits, and unique passwords for every account being the big three. If password reuse is something you haven’t sorted out yet, our recent piece on password managers compared for 2026 is a genuinely useful next step, because for most people it closes a bigger security gap than a VPN ever will.
When a VPN is genuinely useful
None of the above means VPNs are pointless. There are specific situations where they earn their subscription fee, and it’s worth being precise about what those are.
- Travel is the clearest case. Whether you’re overseas on holiday or working from a hotel business centre, you’re routinely connecting to networks you have no way of vetting, and a VPN gives you a sensible baseline of protection without having to think about it.
- Public wifi at home is the second case, and it’s more common than people assume. Cafes, libraries, co-working spaces and free council wifi in shopping strips all fall into the same bucket as hotel networks — convenient, and not something you should trust with banking logins by default.
- Avoiding ISP-level tracking of your browsing metadata is a legitimate reason on its own, particularly for anyone who simply doesn’t like the idea of their provider building a profile of their online habits, regardless of whether anything untoward is happening with that data.
- Getting around streaming geo-restrictions is the fourth reason, and it’s the one that needs the most caveats, so we’ve given it its own paragraph below.
On streaming: yes, a VPN can make Netflix, Disney+ or a UK broadcaster’s catchup service think you’re browsing from another country, unlocking a different content library. It’s also, technically, a breach of most of those services’ terms of service, and it sits in a genuine legal grey area rather than a clearly settled one. It isn’t a criminal offence in Australia to use a VPN for this, and nobody is getting a knock on the door over it, but it is a contract breach that can result in account suspension if the streaming service’s detection systems flag it — and most of the big ones actively try to. We’re not going to pretend this use case doesn’t exist, because it’s genuinely one of the most common reasons Australians sign up for a VPN in the first place, but going in with clear eyes about the trade-off (occasional buffering, potential account flags, and no real recourse if you’re locked out) is only fair.
Red flags of shady free VPN providers
This is where things get genuinely risky, and it’s the part of the VPN conversation that deserves far more attention than it gets. A VPN provider sits in an extraordinarily privileged position — every byte of your unencrypted traffic passes through their servers before it goes anywhere else. A reputable provider treats that as a serious responsibility. A shady one treats it as a business model, and free VPNs are where this problem concentrates.
Running VPN server infrastructure costs real money in bandwidth and hardware, so when a VPN is free, ask where the revenue is actually coming from. In a depressing number of cases, the answer is you — specifically, your browsing data, sold on to advertisers and data brokers. A few patterns are worth treating as immediate red flags:
- Vague or non-existent logging policies. If a provider can’t clearly state, in plain language, what it does and doesn’t log, assume the worst.
- No independent audit of their no-logs claims. Reputable providers commission third-party security audits and publish the results. Most shady ones simply assert “we don’t log” with nothing backing it up.
- Ownership hidden behind shell companies, often based in jurisdictions with weak privacy protections and no meaningful way to hold the operator accountable.
- Injected ads or trackers within your browsing sessions — a strong sign the app itself is monetising your traffic directly.
- Excessive permissions requested by the mobile app, well beyond what a VPN needs to function.
- A business model that simply doesn’t add up — free, unlimited data, no ads visible in the app, and no obvious revenue source anywhere.
This isn’t a hypothetical concern. Several free VPN apps have been caught over the years doing exactly this — logging far more than they claimed, then selling that data to third parties. Given how central personal information handling is to this whole equation, it’s worth understanding your actual rights around it. The Office of the Australian Information Commissioner has a clear, plain-English rundown on protecting your personal information, and it’s a useful frame for thinking about why a VPN’s own privacy practices matter just as much as the encryption it’s selling you on. If your provider’s core pitch is privacy and it’s quietly the least private part of your setup, that’s the wrong trade entirely — and it sits alongside the broader run of threats we outlined in our deep dive on the cybersecurity threats facing Australians in 2026, several of which start with exactly this kind of data being harvested and resold.
A few reputable paid options
We’re not going to turn this into a ranked top-ten list dressed up as objective advice, because that’s exactly the kind of content that got VPNs a reputation for hype in the first place. What we will say is that if you’ve decided a VPN genuinely suits your situation, spending a small amount annually on an established, independently audited provider is a far better bet than chasing a free option.
Providers like ProtonVPN, Mullvad and NordVPN have each built long track records, published independent audits of their no-logs claims, and operate under corporate structures that are at least publicly known and scrutinised. Proton in particular has built its reputation on privacy-first infrastructure originating from its email service. Mullvad has taken an unusually strong stance on anonymity, allowing account creation without an email address at all. NordVPN has the largest server network of the three and is a reasonable pick for anyone prioritising speed and streaming compatibility. None of these are sponsors of ours, none of these links are affiliate links, and none of them are the “best” in any absolute sense — the right pick depends on what you actually need it for, which is really the whole point of this article.
Whichever provider you land on, look for the same basics every time: a published, audited no-logs policy, a jurisdiction with reasonable privacy law, transparent ownership, and a straightforward explanation of how the business actually makes money. If a provider can’t tick those boxes clearly, it doesn’t matter how slick the app looks.
Final thoughts
A VPN is a tool for a specific job, not a general-purpose security blanket. It’s genuinely worth having if you travel, if you regularly connect to public wifi, or if keeping your ISP from building a browsing profile matters to you. It’s a reasonable, if legally grey, way to access geo-restricted streaming content, provided you understand the trade-offs involved. What it will never do is stop a phishing email, block malware, or make up for a reused password, so don’t let a VPN subscription lull anyone in the household into skipping the more foundational security habits that actually stop most real-world attacks.
If you do decide to sign up for one, treat the “free” tier of any VPN with real suspicion, do the five minutes of homework on logging policies and ownership, and put your money toward one of the established, independently audited providers instead. The whole point of a VPN is trusting a company with your unencrypted traffic — that’s not a decision worth making on the cheap.
