Do families need a VPN? Start with who you're trying to keep out

Turn on a VPN, open a social app and you are still signed into your account. The app still knows whose post you are uploading. The relatives who receive your video can still save it.

A VPN changes the route your connection takes. Whether that helps depends on who you want to keep from seeing what you're doing: the owner of the Wi-Fi network, your internet provider, the website itself, or the people receiving your photos. Those are different points in the same journey.

What the connection looks like

With a VPN, traffic routed through it travels in an encrypted connection from your device to the VPN provider. It then goes from that provider to the website. The website sees the VPN's network address in place of your usual one. Mozilla explains the connection.

Your local network and internet provider can see a VPN connection, but the tunnel conceals the destinations and contents carried inside it. The VPN provider becomes another business you're trusting with information about the connection. Encryption between your browser and an HTTPS website still protects the contents from the VPN provider. EFF's explanation of VPN protection

For family photos, this puts the decisions in order: choose the recipient and the service, check the account's sharing controls, then decide whether you also want a VPN for the connection.

Public Wi-Fi doesn't automatically mean your messages are exposed

Most websites now use HTTPS, which encrypts what travels between your browser and the site. The FTC says public Wi-Fi is therefore usually safe for that traffic. A VPN can conceal additional connection information from the network, but it isn't the thing that first makes an HTTPS login encrypted. FTC guidance on public Wi-Fi

HTTPS also doesn't tell you that a website is honest. A fake login page can use it. Check the actual address before entering a password, especially after following a message asking you to sign in. A VPN will faithfully carry the password to the wrong recipient if you enter it there.

A different network address doesn't remove your other location clues

An app with permission to read your phone's location doesn't need to guess it from your internet address. Your account may also contain a home address, saved places or previous activity. Google, for example, describes using device location, saved account information and IP addresses as separate sources. Changing one doesn't clear the others. Google's location explanation

If location collection is the concern, open your phone's app permissions. Our location-data guide shows the iPhone and Android controls and explains why previously collected records need a separate deletion request.

Check what the VPN actually covers

“VPN on” can mean a whole-device connection or a feature inside one browser. For example, Firefox's built-in VPN covers Firefox traffic; it doesn't cover the separate social, messaging or photo apps on the device. Mozilla documents this separately from its device-level VPN app. Firefox's coverage explanation

Read that distinction before installing anything. Then check the service's settings for excluded apps or websites and any usage limit. If the reason you wanted a VPN was to protect traffic from a particular app, a browser-only feature won't do that job.

Mozilla VPN, for example, says it and its partner Mullvad do not log network activity. The same policy says Mozilla keeps IP addresses in server logs for 90 days and receives account and billing information. A promise about browsing activity doesn't mean the business has no record of you subscribing or connecting. Mozilla's VPN privacy notice

For any VPN you're considering, find out who operates it and what information it keeps. If it cites an independent audit, open the report and check the date and scope: did the auditors inspect the app, the servers and logging, or just one of those? An audit of the app doesn't establish what the servers retain. EFF also points out that practices can change after an audit. EFF's provider-selection guidance

If your aim is to keep strangers out of family albums, start with the album's access list and a unique password with recovery set up. If your aim is to reduce what a network can learn from the connection, a VPN addresses that particular part of the job.