Do You Need a VPN in 2026? Here’s the Truth

Sponsorship / intent

• The creator states the video is not sponsored by a VPN provider, but later thanks DeleteMe as a sponsor.
• Core goal: counter “FUD” and marketing claims with real-world technical reasoning and current policy changes.

---

Are VPNs “a scam”?

• The video references Marcus Hutchins claiming consumer VPNs are “straight-up scams” due to marketing overreach and misinformation, arguing:
  • VPNs don’t protect much because web traffic is already encrypted (HTTPS/TLS).
  • “Sense of security” marketing (e.g., hiding photo leaks) is exaggerated.
• The creator partially agrees with calling out bad VPN marketing but disagrees with the conclusion that VPNs are useless.

---

Key technical point: TLS/HTTPS encryption ≠ full privacy

1) Not all data is encrypted at connection start

• Even with HTTPS/TLS, some handshake elements can be visible during initial setup.
• The creator emphasizes that encryption doesn’t automatically hide metadata/patterns.

2) SNI leakage shows which sites you’re visiting

• The creator demonstrates that SNI (Server Name Indication) can reveal the hostname / website destination even when payload content is encrypted.
• They state:
  • With tools like Wireshark, you can observe TLS ClientHello details that disclose destination websites.
  • Result: a local observer / ISP / network adversary can still infer browsing destinations.

3) Encrypted DNS helps only for DNS, not TLS SNI

• They agree with the general guidance to use encrypted DNS (e.g., DNS over HTTPS), but argue it won’t hide TLS connections.
• “Moral” stated plainly:
  • Encrypted DNS hides DNS queries,
  • VPN helps hide SNI,
  • because SNI visibility occurs during TLS session establishment.

4) ECH (Encrypted Client Hello) not reliable

• They mention ECH (masks server name in TLS handshake) but claim it doesn’t work in most cases, so SNI remains often visible.

---

Policy / surveillance changes: encryption doesn’t remove metadata collection

• Governments and ISPs are pushing “lawful access” / surveillance regimes.

• Major example: Canada Bill C-22 (referenced via NordVPN/Signal/others):

  • would require retention of certain metadata (up to a year),
  • and build capability for authorities to obtain it.
  • Firms claim they’d challenge this or possibly exit jurisdiction to avoid compromising “no-logs” / encryption protections.

• Example: UK ISP retention:

  • claims that ISPs must store websites visited for 12 months.

• Additional context:

  • Data brokers and ISP data collection/sale are described as widespread (FTC study, examples of fines for illegal location data sale).

---

Practical demonstrations / guidance claims

Network-level technical demo

• The creator runs:
  • DNS monitoring and SNI monitoring scripts
  • shows that SNI monitoring still reveals websites even when DNS is minimized or flushed.
• They test both:
  • on the internal network (before Starlink)
  • and between router and Starlink (internet side), still observing SNI/TLS client hello.

Phone Wi-Fi demo: website destinations visible before opening apps

• Using a fake Wi-Fi access point + packet capture:
  • shows significant outbound connections to sites (via SNI/TLS) even when the user hasn’t launched apps yet.
  • later verifies connections corresponding to opened apps (e.g., McDonald’s, Canva, Instagram/FB, etc.).

---

Non-technical reasons VPNs are used (performance, content, access)

Age verification concerns (major “elephant in the room”)

• The creator argues age verification is expanding and may involve:
  • submission of biometric data / passport info / facial recognition to third parties.
  • worries about cross-border data transfer and misuse (including training AI, sharing with other parties, hacks/leaks).
• Claims that VPN registrations spiked in the UK around age-verification-related changes.
• Mentions the possibility of VPN bans/restrictions (by countries listed as examples; also uncertainty about UK direction).

Regional content and access differences

• Examples where VPN switching countries changes outcomes:
  • IMGUR not available in UK; works after switching to Ireland.
  • Some sites block access when traveling/foreign IP; VPN can help access the “correct region” version.
  • Different catalogs (e.g., streaming services) and different pricing/currency experiences when traveling.
  • Travel payment guidance: prefer local currency and rely on card conversion rates rather than site conversion.

Reduced ads/trackers/malware risk (observed with VPN + settings)

• They demonstrate local news sites (e.g., Oxford Mail / Daily Mail) becoming unusable due to excessive ads.
• With a VPN enabled (and Proton NetShield enabled) they claim:
  • ads/trackers/malware/adult content can be blocked,
  • “white space” appears where ads used to be,
  • the site becomes readable and faster.
• They also suggest combining with browsers like Brave.

---

Provider recommendations / what to use

• Creator recommends checking:
  • privacyguides.org for VPN comparisons
  • Tech Lore’s recommendations / VPN finder
• Specifically mentioned as preferred:
  • Mullvad VPN and Proton VPN (creator personally uses Proton).
• Reinforced: “VPNs do not make you anonymous online” (warn against anonymity claims).

---

DeleteMe (non-VPN but related privacy angle)

• Creator uses DeleteMe to remove personal data from data broker / people search sites.
• Claims:
  • not just one-time removal; reduces ongoing exposure,
  • emphasizes reducing attack surface rather than solving all privacy problems.
• Includes a discount code reference.

---

Main speakers / sources mentioned

• David Bombal (primary creator/speaker)
• Marcus Hutchins (cybersecurity figure quoted; “consumer VPNs are scams” claim)
• Tom Scott (referenced video about VPN claims; audio clip blocked due to copyright claim)
• Ex-NSA chief (referenced via “kill people based on metadata” quote)

Referenced organizations/laws/news:

• NordVPN, Signal, Proton (quoted/mentioned responses to policy like Canada Bill C-22)
• EFF (commentary about proposals to ban VPNs)
• BBC, FTC, Big Brother Watch, ABC News, Vice, PCMag, The Register (as cited news/study sources)