VPN Metadata: What Each Observer Can Still See
Encryption hides content, not the fact of a connection. Separate what the access network, VPN exit, resolver and destination observe, and what each keeps.
Encryption hides what you sent, not that you sent something. Sizes, timing and the outer addresses remain available to parties at different points along the path. Each observer gets a different slice, and the privacy question is what that slice can support. Start by naming who is looking before deciding what the exposure means.
Name the Observer Before the Claim
Four positions matter in a typical tunnel: your access network, the VPN operator's exit, any resolver that receives a name, and the destination itself. Each sees a different combination of source, destination, name, size and time. A general statement about what a VPN reveals is almost always a statement about one of those positions.
| Observer | Usually visible | Not visible |
|---|---|---|
| Access network | VPN endpoint, volume, timing | Inner destinations |
| VPN exit | Your traffic, destination addresses | Your home address |
| Resolver | The names it resolves | Your full page content |
| Destination | Exit address, request, protocol details | Your physical location |
Keep them separate in the analysis. Merging them produces claims that cannot be tested. An observer's position also decides what a legal request could obtain from them later.
Content and Destination Are Different Questions
Encryption protects the payload of a connection, and HTTPS protects it again on its own exchange. Destination addresses, however, are routing information, and the exit must forward to them. DNS resolvers receive the names they answer, and other hostname visibility depends on the protocol in use. Assuming every intermediary sees a full URL is as wrong as assuming none sees anything.
Account identifiers, device labels and diagnostic IDs often live in management systems rather than packet fields. A protocol specification does not describe the analytics around it. A tunnel that hides addresses from the access network can still expose them to the exit, so identical metadata has different value in different hands.
Observable Is Not Retained
An endpoint can process data to deliver traffic without keeping a history of it. It can also retain diagnostics, aggregate totals, or per-account records for a limited period. These are different behaviours with different consequences, and the word anonymous rarely distinguishes them. A packet that passes through a server leaves no automatic record of where it went.
Ask what is collected, whether it is joined with an account, how long it is kept, and who can read it. A total across all users answers a different question from a timestamped record tied to one identity. That distinction is the difference between a privacy policy and a marketing sentence.
Write the answer down before comparing providers. A verbal assurance is not a retention policy.
Ask Specific Questions About Retention
Put the questions in writing before comparing products. Which events are logged, at what granularity, for how long, and under whose control? Is the data aggregated, sampled, or deleted on a schedule? Can the operator produce a per-account history if asked?
Those answers belong in the decision record. Without them, the comparison is a slogan contest.
The RFC 6973 privacy guidance is a useful frame for these questions because it separates data minimization from retention and secondary use. A listing that names the country of an exit tells you where you connect. It says nothing about what that operator stores.