A VPN tunnel reroutes traffic around Comcast, Spectrum, and Verizon Fios routers
A VPN can fully encrypt a connection so an ISP can't see a single domain visited, and that same person can still be signed into a Google account on Chrome, letting Google log every search and every clicked result anyway. The tunnel moves who's watching. It doesn't remove the watching. So what does it actually take to close both gaps at once?
A VPN changes the path traffic takes. When a device connects to a VPN server, usually run by one of several providers on the market, the device first builds an encrypted tunnel to that server using one of a handful of common tunneling protocols. Every outbound request, DNS lookups included, along with the actual HTTP or HTTPS payloads, gets wrapped in that encryption before it ever reaches the ISP's network. The ISP still sees that a connection exists and can see the IP address of the VPN server, but it can't see the destination websites or the content of the traffic. From the ISP's seat, the subscriber is just trading encrypted packets with one server address, over and over, for the length of the session.
The same logic holds for a coffee shop's Wi-Fi router or a hotel network operator, sitting in the same spot an ISP does, able to see unencrypted traffic passing through its own hardware. A VPN's encryption makes that traffic just as unreadable to the network owner as it is to a home ISP. Real-time decryption of properly implemented VPN encryption is considered computationally infeasible with current consumer, or even enterprise, hardware. That's why this works the same way whether someone's on home broadband or airport Wi-Fi.
The practical edge of this protection is the VPN server itself. Once encrypted traffic reaches that server, it gets decrypted and sent on to its actual destination, which means the VPN provider now has roughly the same visibility the ISP used to have. So the question of whether a VPN hides activity from an ISP has a clean answer: yes, at the network transport layer. Whether that activity stays hidden from everyone else depends on what happens after the tunnel ends. That gap, between hiding traffic from the ISP and hiding activity from everyone else, is what the rest of this piece works through.
Business Insider's guide to the gap between ISP-blocking and account-level tracking
Business Insider's VPN service guide says it plainly: a VPN will hide search history and browsing activity from an ISP, but it takes more than that for real privacy. The guide flags a scenario that trips up a lot of people: someone connects to a VPN and stays signed into a Google account on Chrome, or a Microsoft account on Bing. Google or Microsoft still logs the search, the clicked result, and the account behind it, completely separate from whatever the VPN is doing to the ISP's view. The VPN moved the observer. It didn't remove the observation. Anyone who leans on a VPN alone while staying logged into a Google or Microsoft account is still handing that account a searchable history.
There's a second wrinkle worth knowing if the goal is staying unnoticed, not just unreadable: an ISP can usually tell a VPN is running, even without seeing what's inside the tunnel. Encrypted traffic funneled consistently to one known VPN server IP is a pattern that's easy to spot. ISPs can't read the contents, but they can often tell VPN traffic is happening at all. Most people won't care. But anyone in a situation where using a VPN itself, not just what's inside it, carries consequences needs to think about server choice and obfuscation features, not just encryption strength.
NordVPN's documentation on what rerouting actually blocks
The account-level gap above is really a limit on what encryption alone can do. The next question is whether the encryption mechanism itself holds up the way people assume, and NordVPN's own documentation on what a VPN hides backs up the same mechanism from the provider's side: connecting to a VPN routes search requests through the VPN server instead of the ISP's, and that rerouting is exactly what strips the ISP's ability to see typed queries or visited domains. This tracks with how VPN encryption gets described across the industry: it scrambles data so it's unreadable to the ISP or to whoever owns the Wi-Fi network, with real-time interception treated as impractical even for parties determined to try. That lines up with the Business Insider point above: the mechanism works, but it only covers the network layer, not the account layer.
What this means for anyone comparing VPN subscriptions this year
Put the ISP-blocking mechanism and its account-level limit together and you get a two-part answer for anyone shopping for a VPN right now. First, a VPN is a genuinely effective, well-documented tool against one specific and very common threat: ISP-level logging of browsing activity. That matters, since ISPs can see unencrypted data and browsing history by default, private browsing sessions included. That alone justifies running a VPN if the worry is an ISP building a browsing profile, selling aggregated data, or handing over logs under a legal request.
Second, a VPN doesn't replace logging out of search accounts, clearing cookies, or switching to privacy-focused search tools, if the real goal is avoiding tracking by the sites and services being visited rather than by the network carrying the traffic. Google and Bing tying searches to a signed-in account has nothing to do with network encryption, nothing at all. Anyone who wants both protections needs to pair the VPN with account-level habits, not treat the subscription as the whole fix.
The practical move for anyone comparing VPN providers right now is to check two things beyond price. First, protocol support: newer protocols like WireGuard generally outperform older OpenVPN setups on speed. Second, the provider's own logging policy, because a VPN that logs user activity just moves the privacy problem from the ISP to the VPN company instead of actually solving it. A VPN closes the ISP-level gap on its own. It closes the account-level gap only when paired with logging out of tracked accounts, and it closes the provider-level gap only when someone actually checks the no-logs policy before signing up. All three checks matter. None of them covers for the other two.