Still, here is the uncomfortable truth: in 2026, a VPN alone covers maybe 40% of your digital footprint. The other 60% leaks through channels most VPN marketing conveniently ignores. (And if you are still using a free VPN, the situation is worse — as we documented in our free VPN safety analysis.)

VPNReview ran a series of leak tests in June 2026 across five major VPN services. Every single one passed basic DNS and IPv6 leak checks. And every single one still left identifiable traces that a motivated tracker could use to build a profile.

Here are the five leaks — and what actually closes them.

1. DNS Query Leakage (Even When the VPN Says “No Leaks”)

Most VPN leak tests check one thing: whether DNS queries go through the VPN tunnel or leak to the ISP. By that definition, the VPNs VPNReview tested — NordVPN, Mullvad, ProtonVPN, ExpressVPN, and Surfshark — all passed.

The problem is subtler.

DNS queries contain metadata. Even encrypted queries through the VPN tunnel generate timing patterns, query volumes, and domain clusters that a network observer — say, a government agency monitoring the VPN’s exit node — can correlate. A 2024 study from Karlstad University demonstrated that DNS-over-HTTPS traffic patterns alone can identify visited websites with 85% accuracy.

What helps: Use a VPN that runs its own recursive DNS resolver rather than forwarding to a third party. Mullvad and ProtonVPN both operate their own DNS infrastructure. Run a secondary encrypted DNS resolver locally — Quad9 (9.9.9.9) over DoT, or NextDNS with query logging disabled. This adds a second layer of indirection that breaks simple timing correlation.

2. WebRTC Leaks (The One That Still Works)

WebRTC is a browser API for real-time communication — video calls, screen sharing, file transfers. It also, by design, reveals your local IP address to any website that asks, even when a VPN is active.

VPNReview tested this in June 2026 using browserleaks.com/webrtc on five browsers. Firefox with media.peerconnection.enabled set to false passed. Ungoogled Chromium passed. Standard Chrome and Edge on default settings? Both exposed the local network IP (192.168.x.x) and, in one case, the router’s public IP through a STUN request that bypassed the VPN tunnel entirely.

The fix: Firefox users: set media.peerconnection.enabled to false in about:config. Chrome/Edge users: install uBlock Origin and enable “Prevent WebRTC from leaking local IP addresses” in the extension settings. Or use a browser that ships with WebRTC disabled — Mullvad Browser and Tor Browser both do.

3. Browser Fingerprinting (The IP Address Is Irrelevant)

Most people think of privacy as “hide my IP.” Browser fingerprinting makes the IP address almost irrelevant.

When a website runs fingerprinting scripts — and roughly 40% of the top 10,000 websites do — it collects: your screen resolution, installed fonts, WebGL renderer string, Canvas hash, audio context fingerprint, timezone, language preferences, and dozens of other data points. Combined, these create a unique identifier that is often more precise than an IP address.

VPNReview ran the EFF’s Cover Your Tracks tool on a clean Firefox profile behind NordVPN. The result: “Your browser has a unique fingerprint.” The VPN changed the IP from Berlin to New York. The fingerprint stayed identical.

But here is the catch: aggressively blocking fingerprinting also makes you stand out. A browser with all fingerprinting protections enabled looks different from 99.9% of browsers, which is itself a fingerprinting signal.

The pragmatic approach: For most users, Firefox with “Strict” Enhanced Tracking Protection strikes the right balance — it blocks known fingerprinting scripts without making the browser look unusual. Privacy maximalists can use Mullvad Browser, which deliberately makes every user’s fingerprint look identical. Resist the urge to install privacy extensions you do not understand — each one changes your fingerprint in detectable ways.

4. SNI Leakage (The Domain Name Travels in Plaintext)

When your browser establishes a TLS connection, the Server Name Indication (SNI) field tells the server which domain you want. Until recently, SNI was sent in plaintext — meaning anyone between you and the VPN server could see the domain name, before the encrypted tunnel was fully established.

In 2026, this is improving. Encrypted Client Hello (ECH) — the successor to the deprecated ESNI — encrypts the entire TLS handshake, including SNI. Cloudflare enables ECH by default on all zones. Mullvad’s browser and Firefox 128+ support ECH. But Chrome’s ECH support is still experimental, and Safari does not support it at all.

So: if you are using Chrome behind a VPN, the domain you are visiting is visible to the VPN provider and any observer between the VPN client and server. If you are using Firefox with ECH enabled, it is not.

Check your own browser: Visit https://crypto.cloudflare.com/cdn-cgi/trace and look for sni=encrypted. If it says sni=plaintext, your TLS handshake is leaking domain names.

5. Account and Behavioral Fingerprinting (You Logged In)

A VPN hides your IP. It does not hide your Google account, your Amazon login, your Reddit username, or the fact that you visit the same three news sites every morning at 8:15 AM.

Behavioral patterns — browsing schedules, typing cadence, scroll behavior, mouse movements — are increasingly used for identification. A 2023 study from the University of Chicago demonstrated that browsing patterns alone can re-identify users with 70% accuracy across different IP addresses, browsers, and devices.

What you can realistically do: Use container tabs (Firefox Multi-Account Containers) to isolate logged-in sessions. Do not log into Google while browsing in your privacy-optimized profile. Use separate browser profiles for “logged-in life” and “anonymous browsing.” And accept that on any platform where you have an account, the VPN only hides the network path — not your identity.

What Actually Works: A Summary

The VPN Still Matters

None of this means VPNs are useless. Far from it. A VPN remains the single most effective tool for hiding your network activity from your ISP, protecting your IP address from websites, and securing your connection on public Wi-Fi. As our guide to the best VPNs for privacy explains, the right VPN still matters — a lot.

For the threats a VPN does address, NordVPN’s audited no-log policy and NordLynx protocol make it a solid choice for general-purpose privacy (affiliate link). For users who want the absolute minimum data exposure, Mullvad’s anonymous signup — you get a 16-digit account number, no email required — eliminates the account-to-identity link that every other VPN requires.

The key takeaway: a VPN is one tool in a privacy toolkit. It is not the entire workshop. Pair it with encrypted DNS, a privacy-respecting browser, and a clear separation between your logged-in and anonymous browsing sessions. That is what actual privacy looks like in 2026.

Disclosure: This article contains affiliate links. VPNReview may earn a commission if you purchase through these links, at no extra cost to you. NordVPN is an active affiliate partner (Impact, aff_id=151134). Mullvad has no affiliate program — our recommendation is based on merit alone. All opinions are our own.