VPNs are among the most heavily advertised products online, usually with claims about hackers and security that overstate what they do. Here is the accurate version.
What a VPN actually does
Routes your internet traffic through a server operated by the VPN company, encrypted along the way. Two consequences: your internet provider cannot see which sites you visit, and the sites you visit see the VPN’s address instead of yours.
That is the whole function.
What it protects against
Your internet provider building a profile of your browsing, which they do and sell in some countries.
Geographic restrictions, since you appear to be wherever the server is.
Snooping on genuinely unencrypted connections, which are now rare because nearly everything uses HTTPS.
What it does not protect against
Websites identifying you when you are logged in. A VPN hides your address, not your account.
Tracking through cookies and browser fingerprinting, which works regardless.
Malware, phishing, and weak passwords, despite what the advertising implies.
The trust transfer
You are not eliminating someone who can see your traffic. You are choosing a different one. The VPN company sees everything your provider would have seen, and their promise not to log it is a promise.
Free VPNs make money somehow, and that somehow is usually your data.
Who genuinely benefits
People in countries with censorship or surveillance. People who need to appear in another country. People on networks they do not trust at all.
For ordinary browsing on a home connection in a country with reasonable privacy law, the benefit is modest and the advertising is not honest about it.