For the security minded, one of the scariest revelations from the now three-year-old Snowden leaks had nothing to do with accommodating ISPs (shocking) or overreaching and often vague anti-terrorism practices and policy (an even bigger shock, right?). Instead, when news trickled out about matters like the National Security Agency’s Vulcan data repository or its Diffie-Hellman strategy, online privacy advocates found themselves quaking. Suddenly, seemingly everyone had to re-evaluate one of the most often used tools for maintaining a shred of anonymity online—the VPN.

VPNs, or virtual private networks, are typically used to obfuscate users’ IP addresses and to add a layer of security to Web browsing. They work by routing traffic through a secure, encrypted connection to the VPN’s server. The reasons for using VPNs vary. Some people use VPNs to change their IP address so they can access location-specific media content in a different geographic location or download things on torrent that are less likely to be traced back to them. Others hope to minimize online tracking from advertisers, prevent the negative effects of rogue access to Wi-Fi networks, or even just obfuscate their IP address to specific sites they visit.

Not all VPNs are alike, however. In fact, poorly configured VPNs can make users more vulnerable in various ways. Some ban torrenting altogether. Others log information, either for maintenance reasons, to track abuse, or in accordance with their local data retention laws.

Last year, I set out to put together a list of the best current VPNs for Ars. Although there are multiple “top VPN” lists available online, they are often riddled with affiliate links, making it hard to ascertain their accuracy. An independent online VPN comparison chart outlines VPN business practices, logging, service configuration, and other features, pinpointing contradictory policies and misleading claims that various services are 100 percent effective. But much of the information is still likely compiled from the actual VPN websites, meaning some misleading marketing claims could sneak in.

Several months of research later, I have failed. Today, I still can’t make good faith recommendations for VPNs that guarantee the safety and security of interested users. Instead, the reporting process has only complicated my view of modern VPNs. Evaluating what works and what doesn’t isn’t always straightforward, and verifying the accuracy of this stuff isn’t easy either (especially when it comes to logging). So rather than a simple list of services to use, all I can offer are a handful of guidelines to keep in mind when determining if a VPN can be effective for you in 2016.

VPNs are not for anonymity

One common misconception about VPNs is that they provide user anonymity—even in the face of nation-state actors. “If the objective is to limit exposure to mass surveillance from governments, a VPN is likely not adequate,” said security researcher Kenneth White. In fact, VPNs claiming to offer users anonymity are “inept, irresponsible, or both,” Jeremy Campbell, creator of DNSleaktest.com, told Ars in an e-mail. “Using public VPNs for anonymity is foolish and potentially dangerous, no matter how securely it’s configured, simply because the technology was not designed at all for anonymity. VPN services require that you trust them, which is a property that anonymity systems do not have.”

White didn’t insist on abandoning VPNs altogether at this point, but he cautioned that they should be thought of as a single, supplemental tool and not as a privacy solution. “Instead, the use of strong privacy tools such as the Tor Browser (possibly coupled with a reputable VPN) is a must,” he said. “Not only because of the anonymizing properties, but because the bundled browser has been heavily modified to maximize Web privacy (via cookies, Flash, and Java plugins).”

Tor has a distributed network that attempts to preserve anonymity by running traffic through multiple relays. But this is also hard to verify, and nobody knows for certain whether or not Tor can be reliably successful. The browser’s recent high-profile encounter with the US Department of Defense only heightens such caution. And some critics in fact argue that Tor makes people more susceptible due to its reliance on an outdated version of Firefox. The takeaway? Tor and even the Tor Browser are not entirely foolproof, either.

“There have been some malicious Tor exit nodes in Russia that have actually been modifying binaries, so if you download a piece of software through Tor and you happen to be unlucky enough to get one of these Tor exit nodes, they’ll actually modify it so it becomes malware,” said Matthew Green, a cryptography professor at Johns Hopkins University.

Although Green has never heard of that happening with a VPN, he pointed out the same attacks are possible. In contrast to most VPNs, however, Tor and the Tor Browser are used in incredibly high-risk situations, meaning engineers work incredibly quickly to patch security vulnerabilities. The same may not be true for all VPNs.

VPNs are not necessarily safe for torrenting

Some VPN providers do not permit peer-to-peer sharing and would even turn over user names to a copyright holder if necessary. Others issue warnings on behalf of the copyright holders and may cancel the accounts of repeat offenders. Anyone wishing to use a VPN for private torrenting and streaming can look for a provider that doesn’t disclose information when served with a DMCA notice (or one that doesn’t retain logs), though the same issue comes up again.

“However, there’s no way for users to verify what VPN providers say,” Campbell said. “They must judge providers by reputation, relying on news reports, discussion in online forums, and so on.”

VPNs do not offer robust protection from ad tracking

Although VPNs mask your IP address, they won’t necessarily protect you from spying ads and invisible trackers. “VPNs alone provide negligible protection against ad network tracking, because an IP address (which the VPN is masking) is a weak identifier,” Campbell said. “Ad networks prefer browser cookies, supercookies, and browser fingerprinting techniques ( https://panopticlick.eff.org) that VPNs cannot protect against.”

To protect against ubiquitous ad tracking, ad blockers (like uBlock or uBlock origin) and tracking blockers (like PrivacyBadger or Disconnect) provide some level of protection. Disabling JavaScript or using tools like NoScript for Firefox can offer some protection from fingerprinting. Advanced users can use virtual machines or multiple browsers isolated in sandboxes. Using the Tor Browser can protect against browser fingerprinting as well.

VPNs could put you at risk

The best use case for consumer VPNs is local network security, especially on public Wi-Fi networks in airports, hotels, cafes, and even on airplanes (especially since GoGo has been caught issuing fake HTTP certificates for YouTube, which could expose all user traffic—including users’ YouTube passwords—to the inflight broadband provider).

Since VPNs create a tunnel between a user and the VPN provider’s server, though, it’s again important to have trust in the VPN provider. That provider can essentially see all of your traffic, log all of your traffic, and even modify your traffic. An improperly configured VPN could potentially give others direct access to your private local LAN, which is likely significantly more dangerous than shady people sniffing your traffic at the coffee shop.

“You’re really putting yourself at their mercy if they’re not honest,” said White. “Your fear may be that you’re going to get hacked by someone on the local network, but [by using a sketchy VPN] you’re basically putting yourself in the hands of your worst possible attacker. All of your traffic is going through the worst coffee shop access point in the world if you pick the wrong VPN service.”