People search “VPN not working for privacy” when they did what the internet told them to do and still feel followed. That frustration is reasonable. A VPN can be useful, but it solves a narrower problem than most anxious users think. It mainly changes who sees your traffic path and apparent network location. It does not automatically stop the site you are visiting from building a profile of you while you are there.
EFF’s Cover Your Tracks project is one reason this confusion lasts. Its whole lesson is that browser-level uniqueness can survive despite ordinary self-protection habits. If a site can still observe a distinctive browser, device hints, language, timezone, or other fingerprintable traits, then the user can feel persistently recognizable even after changing the network route.
The scale of tracking on ordinary websites also matters. Princeton’s web measurement work found Google-owned trackers on roughly 75% of the top one million websites and Facebook-owned trackers on about 25%. That means someone can land on a normal store, news page, or booking flow and still walk into a dense measurement stack. The VPN did not fail so much as the broader tracking environment stayed intact.
The hidden sharing economy behind that tracking makes the gap even clearer. The Irish Council for Civil Liberties reported that the average person’s data was broadcast in real-time bidding auctions 747 times per day in the United States and 376 times per day in Europe. A VPN can change one piece of the context, but it does not magically stop a site from firing trackers, writing identifiers, or participating in profile-building systems downstream.
This is why a VPN can feel both helpful and insufficient at the same time. It is useful against certain network-level observers. It may help with regional routing. It can reduce some location leakage. But it is not the same as a privacy defense layer that weakens recognition, strips tracking clues, and surfaces pressure when the session starts behaving like a funnel.
A better privacy mental model is layered protection. Browser hardening matters. Tracker blocking matters. Reducing identity glue matters. Visibility matters. If a user only has a VPN, they may still be leaving cookies, campaign tags, first-party identifiers, and fingerprint signals untouched. The web can keep feeling invasive because large parts of the invasion path are still open.
So if a VPN feels like it is not enough, the right conclusion is not “privacy is impossible.” It is “I only covered one layer.” That is exactly the gap Cloak is trying to make easier to understand in plain language.