Network Protection: Does a VPN Actually Stop Your Phone Carrier From Tracking You?
Introduction
Most people assume that activating a VPN prevents their mobile carrier from tracking what they do online. Their IP address changes, internet traffic passes through an encrypted tunnel, and the connection appears secure. However, a VPN only conceals certain information from the carrier, while other forms of monitoring continue through the cellular infrastructure itself.
Your carrier can still identify the subscription connected to its network, determine which cellular infrastructure is serving your device, measure data usage, and maintain records of ordinary phone calls and text messages. None of these activities requires the carrier to decrypt your VPN traffic.
This distinction has consequences beyond online privacy. In April 2024, the Federal Communications Commission (FCC) imposed approximately $196.5 million in penalties against AT&T, Verizon, T-Mobile, and Sprint for improperly sharing access to customers' location information. Those records originated within the carriers' own systems, where conventional VPN encryption offers no protection.
At Efani, we approach mobile security by examining the entire chain of connectivity, from the device and its internet traffic to the cellular network and subscriber account. One of the most persistent misconceptions about VPNs is that encrypting an internet connection somehow prevents the carrier from knowing where the connected phone is located.
VPNs remain useful privacy tools, but understanding precisely what they protect is essential for anyone concerned about surveillance, identity theft, or targeted attacks.
Is your cellphone vulnerable to SIM Swap? Get a FREE scan now!
Please ensure your number is in the correct format.
Valid for US numbers only!
What Can Your Phone Carrier Actually See?
Mobile carriers operate far more than internet gateways. Their infrastructure authenticates subscribers, manages connections between cell towers, routes communications, and maintains operational records. These functions continue regardless of whether the subscriber uses a VPN.
Your subscriber identity and device information
Every cellular connection must be associated with an authorized subscription. Mobile networks use identifiers such as the International Mobile Subscriber Identity (IMSI) and, in 5G systems, the Subscription Permanent Identifier (SUPI).
Modern network standards incorporate protections to reduce unnecessary exposure of permanent identifiers. For example, 5G introduced the Subscription Concealed Identifier (SUCI) to encrypt subscriber identities over the air, while temporary identifiers help limit tracking. However, carrier implementation varies, and fallback to legacy cellular protocols can still leave permanent identifiers exposed.
Nevertheless, the serving network must still recognize the subscription associated with an active connection. Carriers may also obtain device-identifying information, including the International Mobile Equipment Identity (IMEI), for network management and related purposes.
A VPN operates above these cellular authentication mechanisms and does not alter them.
Your physical location through cell towers
A connected phone communicates with cellular infrastructure to maintain service as it moves between coverage areas. The network maintains information about serving cells, registration areas, and mobility events.
Depending on the network's capabilities, carriers can use radio measurements, timing information, and other positioning techniques to estimate a device's location. Accuracy varies considerably with tower density, geographic conditions, and the positioning method. A single cell may identify a broad coverage area, while additional measurements can produce more precise estimates.
Disabling GPS or location permissions for applications does not eliminate this information. Those settings govern access to device-derived location data, while cellular location records arise from the infrastructure providing network connectivity.
The distinction is fundamental: a VPN can hide internet destinations from the carrier, but it does not prevent the carrier from maintaining information about the cellular connection itself.
Your calls, messages, and connection activity
Ordinary cellular calls and SMS messages are handled through carrier communications infrastructure. Even when voice services use IP-based technologies such as VoLTE, a consumer VPN does not automatically protect the carrier's underlying voice and messaging systems.
The operator can maintain records of calling numbers, timestamps, call durations, and messaging activity.
For internet usage, the carrier can also observe connection timing, data volumes, packet sizes, and the destination IP address of the VPN server.
These records reveal a different category of information from the websites and application traffic that a properly functioning VPN is designed to conceal.
What Does a VPN Actually Hide From Your Carrier?
A virtual private network establishes an encrypted tunnel between a device and a VPN server. Instead of sending individual internet connections directly through the carrier's ordinary routing path, the device encapsulates protected traffic and sends it to the VPN endpoint.
The VPN server removes the tunnel's encryption layer and forwards the traffic toward its intended destination. Responses travel back through the VPN server before reaching the device.
With a properly configured full-tunnel VPN, the carrier generally observes an encrypted connection to the VPN endpoint rather than the individual internet destinations carried inside it.
An important detail often overlooked in VPN advertising is that HTTPS already encrypts most modern web traffic.
When you visit a properly secured banking website, HTTPS generally prevents the carrier from reading your passwords, transaction details, and protected webpage contents. However, the carrier may still observe destination IP addresses and obtain domain information through unencrypted DNS queries or other connection metadata.
Encrypted DNS and newer TLS privacy mechanisms can reduce some of that visibility independently. A VPN adds another protective layer by concealing the internet destinations and DNS activity carried through its tunnel.
That protection depends on the traffic actually entering the tunnel. Split tunneling, DNS leaks, incorrect IPv6 routing, or connection failures can allow some traffic to bypass it.
Encryption also leaves certain metadata observable. Packet sizes, timing patterns, and connection duration may support traffic analysis under particular conditions, although such analysis does not automatically reveal an accurate browsing history.
A VPN transfers trust to another operator
There is another aspect of VPN privacy that deserves more scrutiny.
When traffic is routed through a VPN, the provider becomes a privileged intermediary. Depending on its infrastructure, it may observe the user's source IP address, connection times, destination IP addresses, DNS queries, and other operational metadata.
End-to-end HTTPS generally continues to protect encrypted webpage contents, but the VPN operator may still obtain substantial information about network activity.
The practical privacy question therefore extends beyond whether the carrier can inspect your traffic. It also involves who operates the VPN, what information that operator retains, and whether its security practices justify the trust being placed in it.
Carrier Tracking Is a Documented Privacy Problem
Carrier location tracking is not merely a theoretical consequence of cellular network architecture. Regulatory investigations have demonstrated how sensitive network-derived information can become when access controls and data-sharing arrangements fail.
In April 2024, the FCC announced penalties totaling approximately $196.5 million against four major U.S. wireless carriers over historical arrangements involving customer location information.
According to the regulator, the carriers provided access to location information through third-party aggregators, which subsequently made that information available to other entities. The FCC concluded that the carriers had failed to ensure appropriate consent and safeguards.
The penalties included approximately $80 million for T-Mobile, $57 million for AT&T, $47 million for Verizon, and $12 million for Sprint.
The carriers disputed the enforcement actions, leading to ongoing administrative and legal challenges regarding the FCC's forfeiture process and regulatory authority. Regardless of the final judicial outcomes of these specific proceedings, the underlying enforcement actions highlight how cellular location data was handled across third-party networks.
These proceedings concerned historical location-data practices, not proof that the same arrangements remain in operation today. Nevertheless, the cases demonstrate why information collected through cellular infrastructure deserves scrutiny.
Verizon's privacy disclosures reveal an important distinction
Verizon's Custom Experience programs provide another example of how different types of network information can be used.
According to Verizon's published documentation, the Custom Experience program uses information about website visits, application usage, and related activity to develop customer interests and preferences.
The additional Custom Experience Plus program, which requires opt-in participation, can use further information, including call-related records and location data derived from Verizon's network.
Verizon explains that network-derived location information can remain available for that program regardless of whether location services are disabled on the customer's device.
A properly functioning VPN can reduce direct carrier visibility into the internet destinations carried through its tunnel. However, it does not remove the cellular network's ability to maintain the location information described in Verizon's disclosures. It also should not be assumed to prevent every form of application-usage profiling, since the underlying collection methods may differ.
For executives, investors, journalists, and other high-risk individuals, location records can reveal travel patterns, recurring meetings, professional relationships, and potentially sensitive movements when combined with other information.
What concerns me most is that these records can become valuable to an attacker without any need to compromise the encryption protecting the phone's internet traffic. Improper disclosure, unauthorized access, or compromised infrastructure can expose information that a VPN was never designed to conceal.
SIM Swap Protection
Get our SAFE plan for guaranteed SIM swap protection.
Why Free VPNs Can Become a Privacy Risk
A VPN changes which organization can observe sensitive network metadata, making the provider's ownership, business practices, and technical implementation particularly important.
Free services are not inherently unsafe, and legitimate providers sometimes offer free tiers supported by subscriptions or other transparent funding models. However, services with unclear ownership, intrusive advertising, unsupported privacy claims, or insecure infrastructure may introduce new risks.
Recent academic research provides substantial evidence of these concerns.
Researchers examined 281 Android VPN applications
A 2026 study presented at the Network and Distributed System Security Symposium (NDSS), titled MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs, evaluated 281 popular Android VPN applications.
The researchers found:
- 61 applications transmitted some data without encryption.
- 29 leaked user traffic, including DNS traffic, outside the VPN tunnel.
- 76 transmitted advertising identifiers.
- 107 failed to implement identified VPN configuration safeguards.
- Five transmitted sensitive VPN configuration files in plaintext.
These findings illustrate why a VPN icon on a smartphone is not sufficient evidence that network traffic is being handled securely.
Another investigation, Hidden Links: Analyzing Secret Families of VPN Apps, published in 2025, identified three families of VPN applications with more than 700 million combined Google Play downloads.
Researchers uncovered shared infrastructure and hard-coded Shadowsocks passwords among applications that appeared to represent separate services. The exposed credentials created opportunities to undermine the confidentiality of affected VPN connections.
The download figure represents combined downloads rather than unique users, and the findings apply to the investigated application families rather than the entire VPN industry.
Still, the research raises questions about how easily users can establish who operates a VPN and whether apparently independent providers share insecure infrastructure.
Before selecting a VPN, I would prioritize transparent ownership, clearly documented logging practices, responsible infrastructure management, and meaningful independent assessments over promises of complete anonymity.
A paid VPN may offer a more sustainable business model, but payment alone does not establish that the provider is trustworthy. The same evidence standards should apply regardless of price.
Monthly
Yearly
Why a VPN App Can Fail Even With Strong Encryption
The reliability of VPN protection depends on what happens when the encrypted connection is interrupted, the device changes networks, or the operating system handles traffic differently than expected.
Mobile phones frequently transition between Wi-Fi and cellular connections, lose signal, restart applications, and recover from background process interruptions. VPN tunnels may need to reconnect during these events.
If the operating system permits ordinary internet traffic while the tunnel is unavailable or fails to immediately close existing active socket connections upon tunnel creation, as observed in certain default mobile OS behaviors some background traffic may escape the intended protection.
Users introduce another potential failure point when they manually disable VPNs to troubleshoot financial applications, streaming services, or connectivity problems and forget to reactivate them.
Always-on VPN and kill switches solve different problems
An automatically reconnecting VPN is not necessarily configured to block unprotected traffic.
Always-on mechanisms help establish or restore VPN connections, while kill switches and fail-closed policies are intended to restrict traffic when the tunnel becomes unavailable.
Android supports an always-on VPN feature alongside a separate Block connections without VPN setting, which allows the operating system to restrict non-VPN traffic.
Apple provides VPN On Demand and stronger managed-device VPN configurations. Supported enforcement mechanisms depend on the operating system, application capabilities, and device-management arrangement.
These options reduce dependence on manual activation, but their security properties should not be treated as identical.
VPN routing vulnerabilities have been demonstrated
In 2023, researchers disclosed TunnelCrack, a collection of attacks exploiting weaknesses in how VPN clients handled network routing.
The investigation examined more than 66 VPN products across multiple operating systems and identified circumstances in which attackers could manipulate routing decisions, causing traffic to bypass the intended encrypted tunnel.
One technique involved convincing the VPN client that certain external destinations belonged to the local network. Another exploited routing behavior associated with the VPN server's address.
The attacks required specific conditions and attacker capabilities, rather than occurring automatically during ordinary VPN use. However, they demonstrated that strong encryption alone cannot compensate for insecure routing decisions.
Mullvad also reported in 2022 that Android transmitted certain connectivity-check traffic outside the VPN tunnel, even when its lockdown setting was enabled. That finding involved particular operating-system functions rather than universal exposure of application traffic.
These investigations are historical and do not establish that every current VPN remains affected. Their lasting significance is that network protection must account for operating-system behavior, connection enforcement, and routing rules alongside cryptography.
For high-risk users, persistent VPN configurations with appropriate fail-closed controls are preferable to depending exclusively on a manually activated application. However, even well-configured always-on systems can have documented exceptions.
VPN vs. Firewall and Network Protection: Why Encryption Alone Is Not Enough
The term network protection encompasses several technologies that address different security problems.
A VPN creates an encrypted traffic path. A firewall evaluates whether network connections should be permitted according to defined rules, while DNS filtering can prevent access to known malicious or unwanted domains.
These functions are complementary rather than interchangeable.
Consider a malicious cryptocurrency exchange website designed to steal login credentials.
A VPN may securely encrypt the connection to that website without recognizing that it is fraudulent. A DNS-based network threat protection service may block the domain if it has been identified as malicious, while a firewall can enforce separate connection restrictions.
Neither filtering nor firewall rules guarantee protection against every attack, but they address threats that encryption alone leaves unresolved.
This is why effective firewall and network protection should be evaluated as part of a broader security architecture, particularly for devices used to access financial accounts, corporate systems, and other sensitive resources.
How Efani's Black Seal Protection Fits Into Mobile Network Security
At Efani, we have long focused on protecting the subscriber account and the mobile number itself, particularly against unauthorized SIM swaps and port-out attacks.
Our SAFE service uses an 11-layer verification process, manual review of sensitive account changes, and additional controls designed to reduce unauthorized provisioning.
These protections address risks that VPN encryption cannot reach because changing ownership or control of a mobile number occurs through the carrier's administrative and provisioning systems.
We are now gradually rolling out Black Seal Protection, expanding our approach into VPN-based network protection and related traffic security capabilities.
Black Seal's current platform brings together several functions:
- Network Protection: VPN encryption designed to protect mobile internet traffic and mask the carrier-assigned IP address from internet destinations.
- Encrypted DNS: Protection for domain lookups against interception and manipulation during transmission.
- Malicious Filtering: Blocking of recognized phishing domains, malware-related infrastructure, and other identified threats.
- Custom Filtering: Category-based controls for restricting selected content and connections.
- Wi-Fi Network Security: Capabilities intended to identify and reduce risks associated with insecure wireless networks.
- Mobile Number Scan: Phone-number exposure and risk monitoring that complements protections at the mobile identity layer.
The benefit of combining these capabilities is architectural: traffic encryption, domain filtering, and network security controls address different stages of a potential attack.
A VPN can reduce what an untrusted network observes, while malicious-domain filtering may prevent a connection to known harmful infrastructure. Meanwhile, carrier-account verification addresses attempts to transfer the customer's number through unauthorized provisioning.
IAs with any network defense system, traffic encryption and filtering should be evaluated as components of a layered strategy rather than absolute guarantees. Our goal with Black Seal Protection is to reduce exposure across multiple network vectors without suggesting that any single application can eliminate every form of mobile surveillance or target compromise.
I see this as an important distinction for customers who face elevated risks. Protecting internet traffic is worthwhile, but it should never create a false sense of security around the mobile number, account recovery process, or underlying cellular network.
What High-Risk Mobile Users Should Prioritize
For executives, cryptocurrency investors, entrepreneurs, and other high-risk individuals, practical network security protection should begin with understanding which threats each safeguard addresses.
A reliable security configuration should include several complementary measures:
- Use a trustworthy VPN with appropriate connection enforcement. Examine the operator's ownership, privacy practices, and security assessments. Configure automatic connection and stronger fail-closed controls where supported, and verify that sensitive traffic uses the intended tunnel.
- Protect DNS queries and filter malicious destinations. Encrypted DNS and threat filtering can reduce interception and exposure to known phishing or malware infrastructure, although they cannot identify every malicious connection.
- Harden the device itself. Keep the operating system updated, restrict unnecessary permissions, and avoid untrusted applications. VPN encryption cannot compensate for a compromised endpoint.
- Strengthen authentication and recovery procedures. Use passkeys or hardware security keys for sensitive accounts where available, and reduce reliance on SMS-based verification when stronger options exist.
- Secure the mobile carrier account. SIM-change and port-out verification procedures are essential because these attacks occur outside the VPN tunnel.
- Minimize location and identity exposure. Review application permissions, carrier privacy settings, and public information that could link professional activities, financial accounts, and physical movements.
For particularly sensitive work, separating public-facing communications from private financial or organizational access may provide additional protection. The objective is to prevent a compromise in one area from creating unrestricted access to the rest of an individual's digital life.
Does a VPN Actually Stop Your Carrier From Tracking You?
A properly functioning VPN can significantly reduce a carrier's visibility into internet destinations and unencrypted traffic carried through its tunnel. It is a valuable privacy control, particularly when using untrusted networks or seeking to limit observation of browsing activity.
However, it does not eliminate the carrier's ability to identify the subscription, maintain cellular location information, or record activity associated with ordinary communications services.
The security of the VPN itself also depends on provider trust, routing behavior, operating-system enforcement, and protection against traffic leaks.
At Efani, we address these risks through complementary layers. Black Seal expands our network encryption and filtering capabilities, while SAFE focuses on mobile identity and carrier-account security.
I believe effective mobile protection starts with recognizing the limitations of individual security tools and designing safeguards around them. A VPN has an important role in that architecture, but the encrypted tunnel is only one part of the mobile security problem.
Frequently Asked Questions
Can my carrier see which websites I visit when I use a VPN?
A properly functioning full-tunnel VPN generally prevents the carrier from directly observing website destinations and DNS queries carried inside the encrypted tunnel. However, the carrier can still observe the VPN connection, data usage, and traffic timing, while excluded or leaking traffic may remain visible.
Does a VPN hide my location from cell towers?
No. A VPN can change the public IP address visible to websites, reducing some forms of IP-based location inference. It does not prevent the cellular network from maintaining information about the towers and coverage areas serving the device.
Is an always-on VPN safer than a manually activated VPN?
A properly configured always-on VPN can reduce the risk of forgotten activation and unexpected disconnections. Stronger fail-closed controls can restrict traffic when the tunnel is unavailable, although coverage and enforcement vary across platforms.
Is a firewall the same as network protection?
A firewall is one component of network protection. It controls connections according to security policies, while VPN encryption, DNS filtering, endpoint security, and carrier-account safeguards address other categories of risk.
