Culvert VPN

Does a VPN hide you from Google and Facebook?

No. A VPN changes the IP address they see, but your account, cookies, advertising ID and the SDKs inside apps identify you wherever you connect from.

Privacy: who sees what · 5 min read · By Culvert VPN

No. A VPN changes the IP address that Google, Facebook and every other service sees when your phone connects, and that is all it changes. If you are signed in, they know who you are because you told them. If you are not, cookies in the browser, the advertising ID on the phone, and the SDKs those companies embed in other apps identify you just as well from a VPN address as from your home one. A VPN hides you from the network you are on; it does not hide you from the services you use.

What a VPN actually changes for them

Your IP address is one signal among many, and it is a weak one for identity, because it changes whenever you move between Wi-Fi and mobile data and is shared with everyone else behind the same router or carrier gateway. What Google and Facebook mostly use it for is location: a rough city-level guess, a "new sign-in from" notice when it changes, and the country that decides which version of a service you see.

With a VPN, that signal now says the VPN server's location. Sign in to Google from a server in Amsterdam and Google's activity page will show Amsterdam, and may ask you to confirm it was you. That is the entire effect. It does not touch anything below.

What it does not change

Your account. Signed in is signed in. Search history, YouTube history, Maps timeline, Facebook activity: all of it is tied to the account, and the account does not care about the address. This is the reason the anonymity post exists.

Cookies. The browser sends the same cookies to the same sites whether or not a VPN is on, so a site that recognised you yesterday recognises you today. Google's and Facebook's cookies reach most pages on the web through analytics scripts and embedded buttons, which is how they follow you across sites you never signed in to.

The advertising ID. Android gives every phone a resettable advertising identifier, and apps that include an ads or analytics SDK read it and send it along. It is the same ID on every network. Google's own services on Android also have device-level identifiers that no VPN touches.

SDKs inside other apps. A large share of apps embed Facebook's or Google's analytics or ads libraries. When you open such an app, the library reports to its owner with the advertising ID and whatever the app shares. A VPN carries that report to its destination like any other traffic; it does not read it or block it.

Fingerprinting. Screen size, fonts, installed languages, browser version and dozens of other details together form a signature that is often unique enough to track without cookies. None of it changes with your IP.

SignalWith a VPN
IP address and location guessChanged to the server's
Account you are signed in toUnchanged
CookiesUnchanged
Advertising IDUnchanged
SDKs embedded in appsUnchanged
Device and browser fingerprintUnchanged

Where it does help

There are cases where the IP address is the only thing a service has, and there the VPN does its job.

  • Sites you are not signed in to and have not visited before. No account, no cookie: the address is the identifier, and the IP address post explains what replaces it.
  • Keeping your home address out of the logs. A home IP is stable for weeks or months and points at a street, so a site's access log tied to it is a record of where you live. A shared VPN exit address is not.
  • Location inference. Services that guess where you are from your address will guess the server's city instead, which matters if you would rather they did not know.
  • The network side. Google and Facebook are not your ISP, but your ISP and the Wi-Fi owner do see which of their servers you talk to, and the VPN hides that.

What actually reduces tracking by Google and Facebook

If the goal is less tracking rather than a different address, the useful controls are on the phone and in the accounts, not in the VPN:

  1. Sign out, or use a separate browser profile for browsing you do not want tied to the account.
  2. Reset or delete the advertising ID under Settings > Privacy > Ads. On Android 12 and newer you can delete it, after which apps read a string of zeros.
  3. Turn off ad personalisation in your Google and Facebook account settings, and review the activity controls there.
  4. Use a browser with tracking protection on, and clear site data for sites you do not want to be remembered by.
  5. Check an app's Data safety section on Google Play before installing, and remove apps you do not need.

The ad tracking post goes through these in more depth, and the incognito post explains what private browsing adds and does not.

What the VPN app itself reports

A VPN app is also an app, and can embed the same SDKs as any other. Culvert VPN's app analytics are optional and disclosed, collected only if you leave them on; on the tunnel side it does not log the websites you visit, your DNS queries or the contents of your traffic, its servers see only an opaque connection id, and it keeps your client IP address for up to 30 days for abuse handling, as set out in its privacy policy.

For the one thing a VPN does change, the address every service and network sees, Culvert VPN shows you the exit IP it verified through the tunnel and is on Google Play.

Questions people also ask

Will Google know I am using a VPN?

It will see a sign-in or a search coming from the VPN server's address, and it may send a "new sign-in location" notice or ask you to confirm it was you. That is the extent of it; the account itself is unchanged.

Does a VPN hide my search history from Google?

Not if you are signed in, because history is tied to the account. Signed out and in a fresh browser window, Google has only the VPN's address and a cookie-free browser, which is as close as a VPN gets.

Can Facebook still track me across apps with a VPN on?

Yes. Its SDK inside other apps reads the phone's advertising ID and reports through the tunnel like any other traffic. Deleting or resetting the advertising ID in Android's settings does more about this than a VPN.