A consumer VPN is an app that encrypts all the internet traffic from a person's phone or laptop and sends it through a server run by the VPN company. VPN stands for virtual private network. Many antivirus and security suites include one, and it is also sold as a separate app.
Why does this matter? On public Wi-Fi, at a café, a hotel or a railway station, strangers share the same network. The person who runs the hotspot can also see where each phone's traffic goes. Most websites today already use HTTPS, which encrypts the page itself. But the network can still see which sites a phone visits, and a fake hotspot can try to send the phone to a fake page. A VPN closes this gap.
It works with encryption. When the app starts, it agrees a secret key with the VPN server. From then on, the phone encrypts every packet, every small piece of data that it sends, with that key. To the café's network, the traffic is just scrambled data going to one address: the VPN server. The server decrypts each packet and sends it on to the real website. Replies come back to the phone the same way, encrypted.
Say a freelance designer is working from a café in Indore. She joins the café's free Wi-Fi and opens her email and her bank's website. Her VPN app connects to the VPN company's server in Mumbai, about 500 km away. The café's network now sees only an encrypted connection to that one server. It cannot see her email or her bank. The longer path adds a few milliseconds to each page, which she does not notice.
A VPN has limits. It does not stop phishing: if she types her password into a fake page, the VPN carries it there safely. The VPN company itself can see the sites she visits, so she must trust that company. In India, CERT-In's directions of April 2022 require VPN providers to keep verified records of their users. The records include each user's name, address, phone number and the IP addresses given to them. The provider must keep them for at least five years after the user cancels the service. Some providers removed their Indian servers after this rule.
A consumer VPN is different from the VPN on a company firewall. A company VPN connects an employee's laptop into the office network. A consumer VPN connects a person out to the open internet, through the VPN company's servers. Companies are now replacing their VPNs with zero trust network access (ZTNA), which checks the user and the device before each app is opened.