The Wi-Fi Hacker Isn't Watching You Anymore. Your Internet Company Is.
For years, the advice was simple: use a VPN, or a hacker at the next café table could steal your password over public Wi-Fi.
That problem is mostly gone. Nearly every site now uses HTTPS — the little padlock in your address bar. It scrambles what you type, so a snoop on the network sees nonsense.
But someone is still watching. The company you pay for internet sees every site you visit. And in the United States, it can sell that information. Legally.
Your internet provider can sell where you go
All your traffic flows through your provider. That means it sees every site you visit, and when.
In 2017, Congress canceled privacy rules that would have made providers ask your permission before selling your browsing history. The repeal was signed into law that April. Since then, your provider does not have to ask.
In 2021, the FTC studied the six biggest providers, which together serve 98% of the U.S. market. It found them merging what you browse and where you are into advertising profiles, and sharing real-time location with other companies.
That's a bad deal. You pay for the connection, and your trips around the web get packaged and sold anyway.
The padlock doesn't hide where you go
HTTPS protects what's on a page: your password and your messages. It does not hide which sites you visit, or how often.
Think of mail. The envelope hides the letter. The address is still printed on the outside.
So your provider still sees the pattern: which bank you use, and which clinic's site you keep coming back to.
What a VPN actually changes
A VPN — a virtual private network — sends your traffic through a scrambled tunnel to the VPN's own server first. After that, your provider sees just one connection: the one to the VPN. Your list of sites stays off its books.
This moves the question, though. Now the VPN company is the one that could see your list. So pick that company with care.
Start with the "no-logs" policy — a promise to keep no records of what you do. A promise on a website is easy to make. In 2023, police walked into the office of a VPN company called Mullvad with a search warrant. They left with nothing. The company keeps no user records, so there was nothing to take.
The opposite happens too. In 2024, the FTC fined the security company Avast $16.5 million for selling its users' browsing data. A security label proves nothing by itself. Read the privacy policy before you pay, and look for independent audits.
Hide where you go from your provider — start with Total VPN →
What a VPN still can't do
A VPN protects the connection only. It won't remove a virus, and it won't spot a fake login page.
Advertisers also use a trick called browser fingerprinting: details like your browser version and screen size form a picture of you, even with cookies blocked. A VPN weakens that picture without erasing it.
And every "Accept All" you click just to make a cookie banner disappear hands over more. Advertisers count on you being too tired to care. Slowing down is part of the defense.
One app or three?
To close those gaps, you need two more tools: an ad-and-tracker blocker, and an antivirus. You can buy them separately and manage three subscriptions.
Or you can get one package. Bundles like this are now a normal, independently reviewed product. PCMag notes that Surfshark One combines antivirus with its VPN, and that NordVPN's top tier adds a threat-protection layer.
Total VPN is built as the same kind of all-in-one: one subscription designed to combine the VPN with ad and tracker blocking and antivirus. For someone who wants simple, one app you keep running beats three you have to manage.
Only want the VPN itself? A standalone Surfshark VPN or NordVPN does that one job well.
Either way, the goal is the same: the list of where you go stops being for sale.