Who Can See Your Traffic With a VPN? Four Observers
The local network, the VPN operator, the employer and the destination each see a different slice. Compare them before trusting a tunnel with privacy.
A tunnel changes where your traffic becomes observable. It does not make it unobservable, and the party that gains visibility is the one you routed through. Whether that trade is worth it depends on which hop you distrust, so the useful comparison is between the observers rather than between brands.
Four parties sit on one connection
Follow a request from the laptop outward and four positions appear: the access network you joined, the VPN exit, the corporate estate if the device is managed, and the destination itself. Each occupies a different place in the path, so each collects a different kind of evidence. The table is the whole argument in one view.
| Observer | Sees | Does not see |
|---|---|---|
| Local network and ISP | That a tunnel exists, its endpoint, volume and timing | Destinations carried inside the tunnel |
| VPN operator | Source address, destinations, unencrypted content | Content protected end to end by TLS |
| Managed employer | Device telemetry, DNS and proxy logs, policy decisions | Nothing about the device is hidden from its owner |
| Destination | Exit address, account, cookies, client fingerprint | Who is behind the exit address |
Read the table from the threat outward. If the café Wi-Fi is the concern, the first row is what changes; if the ISP is the concern, you have swapped one operator for another and the second row now matters more. The rows do not compete; each describes a different position on the same path.
The access network still sees the tunnel
Your ISP or the hotel network sees a connection to an IP address, the bytes transferred and the times they moved. It does not see the sites inside the tunnel, provided name resolution also travels inside it and the destination is reached through the exit rather than directly.
Two leaks survive more often than people expect. DNS queries sent to the local resolver still name the sites, and the server name in an ordinary TLS handshake is readable on the path unless encrypted client hello is in use. Neither is fixed by installing a client; both are configuration questions.
The VPN operator, and the employer behind it
A commercial provider stands exactly where your ISP stood: it forwards your packets and can read anything that is not separately encrypted. A password typed into a plain HTTP form is legible at the exit even though the first hop was encrypted. The tunnel moved the trust, it did not delete the exposure. Read the provider's logging policy before assuming the swap improved anything.
On a managed work laptop the organisation owns the endpoint, so device management, DNS logging and proxy records observe it whether or not a tunnel is connected. A personal VPN does not make a managed device private, and on many networks it is a policy violation rather than a privacy measure.
Traffic from other devices in your home is not visible to that employer unless the work laptop is deliberately acting as their gateway. That distinction matters when a household shares one connection and assumes the worst.
The destination, and the neighbours at the exit
The site you visit sees the exit address, the account you signed in with, cookies and browser characteristics. A tunnel changes only the first item, and logging in ties the exit address back to you regardless.
Shared services add a subtler risk. If the provider does not isolate customers from each other, a machine listening on a port may be reachable by other customers on the same exit. Blocking inbound traffic by default at the host firewall covers most of that risk. Testing it means connecting a second device to the same service and trying to reach a listening port.
Some things never change: account identifiers, application-level tracking, and the phone's own knowledge that it is forwarding traffic when you tether. A tunnel is a routing decision, not a change of identity.
Pick the observer you are hiding from before picking a product. If it is the local network, almost any correctly configured exit helps. If it is the provider's own logging, the contract is part of the decision. If it is your employer, no personal tunnel will do the job.