How much of what we measure about the global Internet actually reflects the underlying architecture of the network itself, and how much is merely shaped by the specific tools researchers use to collect those measurements? This fundamental question lies at the heart of modern internet research, where Virtual Private Networks (VPNs) are routinely deployed to gather data through connections originating in different economies. For years, a common assumption has underpinned these methodologies: that a VPN connection established within a given country or economy provides a largely uniform, reliable window into that region’s digital ecosystem.
However, new research demonstrates that this foundational assumption may be deeply flawed. A recent study reveals that switching between different commercial VPN providers can dramatically alter which specific servers a browser ultimately connects to, as well as the geographic economies where those servers are physically located—even when the connection originates from the exact same country and city. These provider-dependent variances can easily cause researchers and policymakers to significantly overestimate or underestimate key metrics, including how much web traffic remains strictly domestic, how much crosses international borders, and which economies actually host the critical infrastructure serving users.
The implications of these findings extend far beyond academic curiosity. A study relying on one particular VPN provider might conclude that a nation’s web traffic is overwhelmingly served from within its own borders, while a parallel study using a different provider could make that same economy appear heavily dependent on foreign infrastructure. Consequently, the choice of a measurement tool shapes not just raw data collection, but also major conclusions regarding data localization policies, cross-border data exposure, and the true geographic distribution of the global internet.
How Researchers Tested Whether VPN Choice Alters Internet Measurements
To investigate the extent of this phenomenon, researchers developed a specialized system known as VPN-Scope. This framework was designed to visit identical sets of websites through multiple distinct VPN providers at nearly identical times, utilizing connections routed through the same economies and, wherever feasible, the exact same cities.
The comprehensive study evaluated four major commercial VPN providers—ExpressVPN, NordVPN, ProtonVPN, and Surfshark—across 14 diverse economies spanning Europe and the Americas. To ensure robust and representative data, the research team curated a list of 1,000 websites per economy, blending globally dominant platforms with locally popular regional sites and official government portals. Each website was systematically scheduled for 25 distinct visits through every individual provider over a rigorous three-week testing window conducted in March and April 2025.
During each automated visit, the system recorded every server contacted as the web page loaded, which included third-party infrastructure supplying embedded resources such as scripts, stylesheets, and fonts. Researchers then meticulously examined the geographic locations and hosting organizations associated with each server. Additional experimental phases investigated Domain Name System (DNS) resolution behaviors and identified the physical locations serving content through the various VPN routes. Together, these complementary tests helped bridge the gap between the observed discrepancies and the underlying technical mechanisms producing them.
The Scale of Infrastructure Distortion Across VPN Providers
The empirical data gathered during the study revealed striking divergences in how different VPN services represent a region’s digital landscape. Measurements originating from Chile, for instance, clearly illustrate how VPN selection shifts the perceived share of web requests served domestically versus internationally. Through ExpressVPN, only 9.5% of the analyzed requests from Chile were associated with server addresses geolocated within the country. By contrast, the corresponding domestic share jumped dramatically to 62.7% when using Surfshark, and reached 64.2% when routing through NordVPN.
The distribution across other destination economies shifted just as drastically. Brazil accounted for 57.1% of the observed traffic destinations when measured through ExpressVPN, but plummeted to a mere 2.8% through Surfshark and 2.4% through NordVPN.
These massive variances emerged from identical sets of websites accessed from the exact same source economies, yet they yielded fundamentally conflicting geographic pictures. This stark contrast highlights why the choice of a VPN provider cannot be dismissed as a minor implementation detail. Changing the provider fundamentally alters the geographic conclusions a researcher would naturally draw from otherwise comparable measurement campaigns.
A researcher relying on NordVPN would observe that a strong majority of analyzed requests associate with domestic servers, whereas a colleague using ExpressVPN would observe the exact opposite reality. For policy analysts evaluating data-localization mandates, this discrepancy alters the apparent reliance on domestic versus foreign infrastructure, even though these surface-level network measurements alone cannot definitively establish where user data is ultimately stored at rest.
Similar discrepancies manifested clearly in the project’s DNS experiments. When comparing DNS responses between two different providers operating in the same economy, the returned sets of IP addresses differed in approximately 12% of comparisons for initial website domains. For dependency domains—the auxiliary services supplying scripts, fonts, analytics trackers, and other page components—the rate of disagreement surged to roughly 31%. Relying solely on the primary website address entered into a browser can therefore obscure a substantial portion of the underlying network variation.
Despite these address-level differences, the underlying hosting companies remained remarkably consistent. At the organizational level, the compared DNS answers shared at least one hosting organization in 98% of initial-domain comparisons and 96% of dependency-domain comparisons. This high degree of overlap indicates that while VPN choice heavily influences our perception of where content is served geographically, it exerts a much weaker influence on which specific corporate entities are supplying the hosting infrastructure.
Controlling Variables and Navigating Network Realities
While some sources of variation in internet measurement can be mitigated through meticulous experimental design, others remain stubbornly outside the researcher’s direct control. To enhance reliability, researchers can independently verify VPN server exit locations, ensure connections originate from matching cities where possible, and maintain strict consistency across browser configurations and measurement timings. Furthermore, studies should explicitly document the specific provider, connection protocols, and underlying network types utilized, moving away from vague descriptions such as a measurement originating simply "from Italy." The specific DNS service handling domain name resolution must also be rigorously audited, as selecting a preferred resolver in local settings offers no guarantee that every VPN provider will actually route queries through it.
Other disparities, however, stem from autonomous decisions made by the underlying networks themselves. Content Delivery Networks (CDNs) continuously distribute replicated copies of digital content across numerous global edge locations, frequently selecting distinct servers based on the specific network path a request originates from. Routing dynamics can likewise steer two simultaneous connections toward entirely separate physical facilities, even when both requests share the exact same destination IP address.
During targeted testing, VPN connections initiated from Milan successfully reached content-serving locations situated in either Milan or Frankfurt. Sharing a starting city—and even sharing a precise destination address—proved insufficient to guarantee a shared physical destination. These routing decisions rely on complex peering and transit arrangements that researchers cannot standardize solely through browser adjustments or VPN settings.
Ultimately, these findings suggest that the chosen VPN provider must be treated as an integral component of experimental design rather than a passive utility for obtaining an IP address in a target economy. Researchers are advised to report all provider and connection parameters, independently verify exit node locations, and, where geographic precision is critical, consider replicating measurements across multiple providers.
Even with these rigorous precautions, inherent variables such as DNS infrastructure, CDN steering mechanisms, and dynamic network routing will continue to cause concurrent VPN connections from the same economy—or even the same city—to reach divergent servers and physical locations. Recognizing these limitations is essential for accurate network analysis, ensuring that studies concerning cross-border data flows, data localization, and internet infrastructure distribution are understood as distinct perspectives rather than absolute, provider-independent representations of a nation’s digital economy.
Sachin Kumar Singh is a Postdoctoral Researcher at the University of California, whose research interests lie in the broad areas of security, privacy, and Internet measurement.
