You install a VPN, open a private window, and still see an ad for the shoes you browsed yesterday. Nothing is broken. You were just asking two different tools to do a job neither one was built for.

VPNs and privacy-focused browsers both get marketed as the answer to online tracking, and the marketing blurs them together. They work at different layers of the connection, they hide different things from different parties, and understanding that split is the difference between feeling private and being harder to follow.

Two Tools, Two Layers

A VPN operates at the network layer. It creates an encrypted tunnel from your device to a server somewhere else, and everything you send travels through that tunnel before reaching the open internet. Your real IP address is hidden from websites, and your internet provider sees only an encrypted stream going to one server.

A private browser operates at the application layer. It controls what your browser accepts, stores, and reveals: cookies, scripts, cross-site requests, and the small quirks of your setup that make you identifiable.

One protects the pipe. The other protects what flows through it and what gets remembered afterward.

What a VPN Hides, and From Whom

From websites: your IP address. A site sees the VPN server's address instead, usually shared with many other users. That alone defeats a lot of crude tracking that glues your visits together by network address.

From your internet provider: the contents of your traffic and, in most cases, the domains you visit. Your provider can still tell that you're using a VPN, how much data you move, and when. It can't read the pages.

From the local network: nearly everything. Hotel Wi-Fi, airport hotspots, and coffee shop routers can't inspect or tamper with your traffic inside the tunnel. This is the most concrete, least hyped benefit of a VPN.

From the VPN provider: nothing. You moved your trust rather than removing it. The provider sits between you and the internet, which means it can see your traffic metadata. Big, well-audited providers are the safer bet, and it's worth asking how a free service funds itself. Some do it honestly; some sell what they see.

What a VPN does not do is hide you from the sites you log into. Your email provider knows exactly who you are the moment you sign in, no matter which server your traffic came from.

What a Private Browser Actually Does

Browsers like Firefox with strict tracking protection, Brave, and Safari block third-party cookies by default, cut off known trackers, and limit the fingerprinting techniques that identify you by screen size, fonts, and canvas rendering. Tor Browser goes further: it routes traffic through the Tor network, so sites see an exit node rather than your IP, and it standardizes browser details so everyone looks similar.

What these browsers don't touch is your network path. If you browse with a hardened Firefox over your home connection, your internet provider can still see which servers you connect to and which domain names you request. Encryption hides page contents, not the fact of the visit.

This is also where a common mix-up lives. Incognito or private mode only stops your browser from saving local history and cookies when you close the window. It does nothing about your IP address, your provider, your employer's network, or the accounts you sign into. It's a shared-computer feature, not a privacy shield.

Where the Two Overlap

Trackers rarely rely on one signal. They combine an IP address with a cookie, a cookie with a fingerprint, a fingerprint with a referral header. A VPN breaks the network-address link. A private browser breaks the cookie and fingerprint links. Used together, the combined picture gets noticeably fuzzier, and each tool covers a weakness in the other.

Used alone, each leaves an obvious handle. A VPN with a standard browser still leaks cookies that identify you across sites. A private browser on your home connection still connects from an address that a determined tracker can note.

What Neither One Fixes

• Signed-in accounts. Gmail, Instagram, your bank, your work tools. The account is the identifier, and it doesn't care about your IP.
• Things you type and submit. Forms, search boxes on logged-in services, delivery addresses, loyalty cards.
• Your phone. Apps, location services, and mobile carriers collect independently of your laptop's setup.
• Phishing and malware. Hiding your address doesn't stop a fake login page from working.
• Managed devices. If your employer owns the laptop, tools installed at the device level can see what a VPN and browser cannot hide.
• Payment and loyalty networks. Your card issuer and the store's rewards program link purchases to you directly.

Which One Do You Actually Need?

Start from the threat, not the product. Ask who you're trying to keep your activity from.

• Untrusted networks and your provider: a VPN first. It's the right tool for hotel Wi-Fi, an ISP you don't trust, or a region where you want your traffic to exit somewhere else.
• Cross-site ad tracking and profiling: a private browser first. It's free, it works everywhere, and it addresses the tracking most people actually encounter.
• Both, if you want a genuinely harder-to-follow setup. A VPN plus a hardened browser covers the two main ways you get linked across the web.
• High-risk situations — sources, activism, sensitive research: use Tor Browser, which is purpose-built for anonymity. A commercial VPN is a privacy tool, not an anonymity guarantee, and it isn't designed to protect you from a serious adversary.

Two practical notes. Some networks and jurisdictions restrict VPN use, so check the rules that apply to you before relying on one. And a VPN doesn't make an unlawful act lawful — it changes who can see your traffic, not what you're allowed to do.

A Setup That Works Without Overthinking It

1. Make a tracking-protection browser your default. Turn strict protection on and leave it there. This is the highest-value change for most people.
2. Add encrypted DNS in your browser settings so your provider sees less of your domain lookups.
3. Install a paid VPN from a provider with a clear, published privacy policy — but only if you have a real reason for it. If you do, use it on public Wi-Fi and any network you don't control.
4. Keep separate browser profiles for separate lives: work, personal, and anything you'd rather not have cross-referenced.
5. Use private windows for what they're for — one-off logins on a shared machine — and not as a substitute for either tool.
6. Check your own exposure once in a while with a site that displays your IP address and DNS resolver. If they show what you expect, your setup is doing its job.

Neither tool makes you invisible, and anyone selling that promise is selling something else. What they do is remove the easy handles: the address that ties your sessions together, the cookie that follows you between sites. Layer them where it matters, skip them where it doesn't, and keep the accounts and devices you care about in mind — that's where most real exposure lives.

Photo: Monster / Pexels