VPN and proxy for ordinary users: what actually protects you

The question keeps coming back: “if I use a VPN, am I protected?” The short answer is that a VPN solves a real problem, but a much narrower one than the adverts suggest. And what it leaves uncovered is exactly where the GDPR and the AI Act come in.

What a VPN actually does

A VPN (virtual private network) creates an encrypted tunnel between your device and one of the provider’s servers. Your traffic reaches the internet from that server’s IP address, not yours. Three practical effects follow:

• your internet provider no longer sees which sites you visit, only that you are connected to a VPN server;
• the sites you visit record the server’s IP address, not your real one;
• traffic on public Wi-Fi becomes unreadable to anyone intercepting it.

A proxy does only the second: it changes the visible IP address without necessarily encrypting the traffic. It is faster and simpler to set up, but the protection is considerably weaker.

What a VPN does not do

This is where most misunderstandings arise. A VPN does not stop:

• Cookies and similar tracking technologies — they work at browser level, not connection level.
• Device fingerprinting — the combination of screen resolution, installed fonts, extensions and settings identifies you statistically without an IP address.
• Tracking through accounts — if you are logged in to Google, Meta or an online shop, the IP address hardly matters.
• Data you hand over yourself — forms, email addresses, phone numbers, orders.

Where the GDPR comes in

An IP address is personal data. The Court of Justice confirmed it in 2016 in C-582/14, Breyer: a dynamic IP address is personal data for an online service provider that has legal means of identifying the person with the help of third parties. Two useful consequences follow.

First. Using a VPN applies, for yourself, the data minimisation principle of Article 5(1)(c) of the GDPR. The Regulation imposes minimisation on controllers; nothing stops you applying it at source by generating less data than you otherwise would.

Second, and more important. The VPN provider is itself a controller of your personal data. It processes your real IP address, payment details and sometimes connection metadata. It owes you information (Article 13), needs a lawful basis (Article 6) and is bound by the rules on transfers outside the European Economic Area (Chapter V).

The selection criteria that actually matter are therefore:

• the provider’s jurisdiction and the regime applying to data transfers;
• the connection log policy, confirmed by an independent audit, not merely stated on the website;
• the business model. A free VPN has to be paid for somehow; if not by your subscription, very probably by your traffic. And consent hidden in the terms and conditions does not meet the conditions of Articles 4(11) and 7 GDPR.

Where the AI Act comes in

Regulation (EU) 2024/1689 does not regulate data collection, which stays with the GDPR. It regulates the systems built on the data. The connection is direct: the fewer traces you leave, the less raw material ends up in behavioural profiles and training datasets. Some reference points already apply:

• From 2 February 2025 — Article 5 prohibits, among other things, untargeted scraping of facial images from the internet or CCTV footage to build or expand facial recognition databases, emotion recognition at work and in education, and biometric categorisation that infers race, political opinions, religious beliefs or sexual orientation;
• From 2 August 2026 — the Article 50 transparency obligations apply: systems that interact directly with people must disclose that they are AI, and artificially generated content, including deepfakes, must be marked.

A note on the timetable: Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026, postponed the obligations for high-risk systems under Annex III to 2 December 2027, and those for systems in products regulated under Annex I to 2 August 2028. The Article 50 transparency obligations were not postponed.

What the AI Act does not give you is a right to be invisible to AI systems. It gives you the right to lodge a complaint with a market surveillance authority (Article 85) and, once the high-risk rules apply, the right to an explanation of certain individual decisions taken with the help of high-risk systems (Article 86).

What you can actually do

1. 1
   Choose a paid VPN

   with a clear jurisdiction and a no-logs policy verified by an external audit.

2. 2
   Do not rely on the VPN alone

   add a browser that blocks trackers, and separate accounts into distinct profiles.

3. 3
   Log out of the big accounts when browsing freely

   an active VPN and an open Google session cancel each other out.

4. 4
   Refuse non-essential cookies

   in Romania, the obligation to obtain consent comes from Law no. 506/2004 on privacy in electronic communications. Details in cookie banners and GDPR in Romania.

5. 5
   Use the rights you already have

   access (Article 15), erasure (Article 17), objection to direct marketing (Article 21). They are free, and the controller must answer within one month.

6. 6
   Complain to the authority when needed

   when a controller does not answer, or answers only formally, complain to ANSPDCP, the Romanian supervisory authority.

Conclusion

VPNs and proxies are tools of digital hygiene, not shields. They reduce the amount of data you generate, but they do not replace legal rights and do not make up for poor habits. Real protection comes from combining the two: a reasonable technical setup, and actually using the rights the GDPR and the AI Act provide.

Frequently asked questions