My cursor hovers over the login button for a client's Google Ads account, thumb still on the trackpad, when the guest Wi-Fi list on my laptop blinks awake with a fourth nearly identical network name. Whoever set up "Free Coffee WiFi 2" twenty minutes after "Free Coffee WiFi" didn't do that by accident, and for a consultant about to move real client budgets around, that's the exact moment public Wi-Fi security stops being an abstract worry. This is precisely the situation a VPN for consultants is supposed to solve, and also precisely the situation where most VPN marketing oversells what the tool can actually do.
Quick disclosure before anything else: some of the links below are affiliate links, and if you sign up for a privacy service through one, I get a commission at no extra cost to you. Every tool mentioned here is something I've paid for and actually run for months, since the point of this site is keeping my own information off the internet, not filling column inches. The full disclosure policy sits on the about page if you want the fine print.
How a Bored Google Search Turned Into a Coffee Shop Habit
None of this started with a security audit; it started with a bored Google search of my own name in early 2024, and what came back was my current home address, my partner's maiden name, and a rough family tree running back to my grandparents, spread across three different people-search sites.
Removal became the project after that. I signed up for DeleteMe first, mostly because their family plan covered both of us under one price and their quarterly reports actually named which broker got cleared and which didn't. I ran Incogni alongside it for a stretch, curious whether an automated sweep caught anything DeleteMe's process missed (whether one genuinely covers more broker sites than the other is its own argument, and not one I'll relitigate in an article about VPNs).
One fix went nowhere: I switched my business phone number, hoping a clean number would mean a clean set of search results. It didn't. The old number stayed indexed next to my name on a couple of broker sites for months, stubbornly outliving the number itself.
Proof came from an email instead: a confirmation from Intelius that a listing had actually been pulled, and I forwarded it to my partner without a single comment attached, because a screenshot argued the case better than any update I could've given her.
Twelve weeks in, the searches actually looked different, not clean; nothing about this stays clean for long, but different enough that the blank space where an address used to sit in a name search actually stayed blank instead of refilling within days.
Why Is the Venue Itself the Real Risk?
Back home, my setup looks nothing like a coffee shop table: a swing arm holds two monitors over a sit-stand desk in the spare bedroom I turned into an office, the door has more colored dot stickers than a preschool chore chart tracking which broker sites have gone quiet, and a Yubikey usually sits clipped to a lanyard on the left monitor's bezel until it migrates onto my keychain for the day. Out in the field, none of that travels with me: just the laptop, the key, and whatever network happens to be closest.
Coffee shop Wi-Fi risk rarely comes from hackers in hoodies lurking three tables over; more often it's the venue's own router, or worse, someone running an Evil Twin setup: a fake access point broadcasting the same name as the real one. Connect to the wrong one and everything unencrypted on your screen is visible to whoever built it. Think of it like a credit freeze you forgot you set up (I forget mine constantly) — invisible right up until someone tries to open a card in your name, and then it's the only thing standing between mild annoyance and a genuine mess.
A Proton VPN Review: Worth Consolidating Around?
This Proton VPN review comes with a confession: consolidating around the Proton bundle happened gradually, once four separate logins (mail, VPN, drive, and calendar) started feeling like more overhead than the privacy was actually worth. Proton runs out of Switzerland under the FADP, which is one of the reasons people bring up when explaining why a Swiss-based provider feels different from a U.S. one; I won't pretend to have the legal background to weigh that claim properly, but it was part of what tipped my decision.
Open-source clients mattered too, since I could actually look at what the software claims to do instead of trusting marketing copy, and marketing copy in this space loves the word "complete," as in complete anonymity, which is close to meaningless. No service makes you invisible. What Proton's VPN encryption does is turn your traffic into scrambled noise for anyone watching the wire between your laptop and its server, which is a real and useful thing, just a narrower one than the ads imply.
VPN or Hotspot: Which One Actually Protects Client Data?
Here's my one contrarian opinion in all of this: even running a solid VPN, I still reach for a cellular hotspot over coffee shop Wi-Fi entirely when the work is sensitive enough, such as a dark web check for a client, say, or logging into a database I'd rather not explain to a stranger. A VPN is a good filter on a dirty tap; a hotspot is just not drinking from the tap at all. It sidesteps the Evil Twin problem completely, since there's no shared router to trick you onto in the first place.
Hotspots aren't free of downsides, though; data caps and dead zones mean the cafe's fiber is sometimes the only realistic option, and that's when the VPN earns its keep. Password management rides along the same logic: I keep RoboForm running mainly because its family plan covers both my business and personal logins under one account instead of two, which matters more once client credentials pile up next to your own (how a password manager actually secures that vault is a separate conversation entirely from anything a VPN touches, and worth its own read if you haven't looked into it).
Wiping the machine matters just as much as securing the connection, in a different way. The same instinct applies to how I wipe client data from old laptops before they leave my hands, making sure nothing recoverable is left behind once a device or a session is finished, which is a different job than anything a VPN or a password manager handles.
What a VPN Protects, and What It Doesn't
A VPN's job is narrower than most people assume, and it's worth being precise about it, because vague expectations are exactly what the marketing exploits. What it actually does: encrypt the connection between your device and its own server, so whoever runs the local network (the cafe, an Evil Twin, an ISP watching the line) sees scrambled traffic instead of your actual browsing. That's the whole scope. It's a secured pipe, nothing more.
None of that stops Google from watching you the moment you're logged into Chrome, since that tracking happens at the account level, not the network level. None of that stops a data broker from buying your name and address from a credit card company or a public record, because that's a business relationship the VPN never touches, and none of it un-lists anything a broker already had on file before you turned the subscription on. The mix-up I run into most from other consultants is assuming a VPN retroactively cleans up listings that were already public; it doesn't, and it was never built to.
Old hardware needs the same closing-the-loop treatment. A stack of drives from my previous agency days sat in a drawer for over a year before I ran them through EaseUS BitWiper (a full wipe, not just a delete and an empty recycle bin) because a laptop headed to resale or e-waste is still a device that once held client logins, and no VPN setting fixes that after the fact.
Credit card companies selling your data, a broker relisting an address months after DeleteMe cleared it, a mistaken assumption about what "private browsing" actually hides; that whole back half of the privacy problem lives outside what any VPN was built for. It's why securing your accounts after a data leak is a separate project from picking a VPN, and why the brokers that specialize in re-listing addresses fastest are their own rabbit hole. The full list of which broker sites carry what kind of data, for that matter, is longer than most people expect and deserves its own page rather than a paragraph here.
Building a Digital Privacy Stack You'll Actually Keep Running
Consultants asking me for "the best VPN" usually want a one-line answer, and the honest one is: the best VPN is whichever one you actually leave running. Proton earns that spot for me because it doesn't choke a Zoom call or lag a client screen-share, which is the real test: a VPN you switch off under deadline pressure isn't protecting anything.
Working from a noisy table doesn't feel like a gamble anymore, mostly because the pieces stopped being separate chores and started acting like one stack: the tunnel, the key, the wiped drives, the removal requests running quietly in the background. My partner still rolls her eyes at the Yubikey clip (she's not wrong, honestly, it does look like overkill), and the actual lesson here isn't "buy this VPN"; it's that connection security and data-broker cleanup are two different problems wearing the same "privacy" label, and mixing them up is how people end up covering one while assuming they've handled both. If you're picking a starting point, the Proton bundle is the one I'd point a fellow consultant toward first, not because it does everything, but because it's the piece most likely to actually stay switched on.