Walk into any tech podcast in 2026 and a VPN ad will play within the first five minutes. The pitch is always the same: download our app, click a button, become anonymous. The reality is more complicated, and most users buying commercial VPNs are protecting the wrong thing against the wrong adversary.

This article is not against VPNs. A good VPN solves real problems: shifting your apparent location, encrypting traffic on hostile Wi-Fi, bypassing geographic restrictions. But "anonymity" is not on that list, and pretending otherwise is dangerous.

Why Commercial VPNs Are Not Anonymity

A commercial VPN replaces one trusted party (your ISP) with another (the VPN provider). That is the entire transaction. You are not anonymous; you are simply being logged by a different company.

The "no-logs" claims are marketing. Some providers genuinely keep minimal logs. Others have been caught lying. Court orders, subpoenas, and quiet cooperation are routine. In several documented cases, providers handed over logs they publicly swore did not exist.

The payment trail is the second problem. If you paid with a credit card, your real identity is linked to that VPN account forever. Even if the provider keeps zero connection logs, the billing database alone is enough to confirm "yes, this user paid us during the period in question," and that is often all an adversary needs.

The legal jurisdiction is the third problem. Providers headquartered in the United States, the United Kingdom, or any Five Eyes member are subject to national security letters and gag orders. Panama, Switzerland and similar marketing-friendly jurisdictions sound better, but extradition treaties and mutual legal assistance still apply.

So if commercial VPNs are not anonymity, what should you actually use?

Option 1: Self-Hosted WireGuard or OpenVPN on Offshore VPS

The strongest control you can have over a VPN is to run it yourself. WireGuard is the modern default: clean code, fast, easy to configure. OpenVPN is older but battle-tested.

The setup is straightforward:

1. Rent a VPS in a jurisdiction you trust.
2. Install WireGuard (a single apt-get on Debian).
3. Generate keys, configure peers, open UDP 51820 in the firewall.
4. Point your devices at the new endpoint.

Total time: about thirty minutes for someone comfortable on a Linux command line. The result is a VPN where you are the no-logs provider. You decide what is recorded. You decide what is shared.

The trade-off is that your traffic all exits from one IP, so you do not get the herd-immunity of a shared commercial endpoint. For threat models where the adversary is your ISP, your employer, or a content platform's geographic filter, that is perfectly fine.

Option 2: Tor

For genuine anonymity, Tor remains the strongest publicly available tool in 2026. Three-hop routing, encrypted in layers, no single relay knows both the source and destination. Run by volunteers worldwide, funded in part by privacy nonprofits, audited continuously.

Tor is slower than a VPN. That is intrinsic to the design. It is also incompatible with most streaming services, and many sites block Tor exit nodes outright. These are not bugs to fix; they are the price of the only widely deployed system that actually breaks the link between you and what you do online.

When the threat model is "powerful adversary, real consequences," Tor is the answer. For everyday "I do not want my ISP profiling me," it is overkill.

Option 3: Shadowsocks and V2Ray

In censorship-heavy regions where VPN protocols are blocked, Shadowsocks and V2Ray are the practical answers. These tools disguise traffic as ordinary HTTPS, making it hard for deep packet inspection to identify and block.

They are not anonymity tools either. They are anti-censorship tools. The distinction matters: if your problem is reaching the open internet from inside a national firewall, Shadowsocks works. If your problem is hiding from a sophisticated adversary, it does not.

Option 4: Mullvad (the One Commercial VPN Worth Naming)

If you genuinely need a commercial VPN and want the cleanest privacy posture available, Mullvad is the standard answer. They accept cryptocurrency. They accept literal cash mailed in an envelope. They issue you a random account number rather than asking for an email. They have published audits. Their pricing is flat. They do not run referral programs that incentivize misleading reviews.

That does not make them anonymous. You are still trusting one company. But the trust required is the minimum possible for a commercial VPN, and the company has earned its reputation through years of consistent behavior.

What About the Big Names?

The major commercial VPNs that dominate YouTube sponsorships and affiliate-driven review sites are marketing-heavy commercial options with US or Panama legal exposure. NordVPN, ExpressVPN, Surfshark and the rest are competent products for the use cases they actually solve (Netflix region-switching, public Wi-Fi encryption, basic ISP-level privacy). They are not anonymity tools, and treating them as such is a category error that gets people in trouble.

Read the EFF's privacy resources for a sober view of what VPNs do and do not provide, and Privacy Guides for current vetted recommendations.

Putting It Together

Choose by threat model, not by ad spend:

• ISP privacy on home network: self-hosted WireGuard on a cheap offshore VPS
• Public Wi-Fi protection: Mullvad, or your self-hosted endpoint
• Censorship circumvention: Shadowsocks, V2Ray, or Tor with bridges
• Genuine anonymity: Tor, used correctly, with no leaks
• Marketing video about NordVPN: nothing, do not buy on impulse

The pattern across all these options is the same: the closer you get to controlling the infrastructure yourself, the stronger the privacy guarantee. The further you outsource trust, the more you depend on a company's promises holding up under legal pressure.

The Hosting Layer Most People Forget

Online anonymity isn't just about Tor Browser or VPN. If you run any service yourself (email server, Matrix homeserver, blog, Tor relay), where you host it matters. Anonymous hosting requires no KYC, crypto payment, and offshore jurisdiction. Anubiz Host offers offshore VPS from $17.90/mo, Monero/Bitcoin accepted, no KYC, with DMCA-ignored locations in Iceland, Romania and Finland - useful baseline for self-hosted privacy infrastructure.