Short answer: A VPN connected on the phone that provides a mobile hotspot does not prove that a laptop or tablet using that hotspot also goes through the VPN. Tethered-device routing depends on the phone platform and VPN setup. Check the VPN on the device whose traffic you want to route, and treat a browser check as evidence about that browser request only.
There may be two devices and two network paths
With a phone hotspot, the phone shares its internet connection with another device. The phone has its own apps and network traffic; the connected laptop or tablet has separate apps and traffic. A VPN app on the phone may cover the phone's routed traffic, but that alone does not establish what happens to traffic forwarded for a tethered device. The UK's National Cyber Security Centre (NCSC) says tethered traffic may go outside the phone's full-device VPN on some platforms, while other phones may not route tethered traffic when that VPN is connected. Its guidance is written for organizations, so use it as a warning about platform variation, not as a compatibility guarantee for a particular consumer phone.
A VPN client running on the laptop or tablet creates a separate configuration to check. Its app selection, split-tunnel rules, connection state, and failure behavior apply to that device. A phone VPN and a client-device VPN are not interchangeable assumptions.
Observer checklist
| Observer | What to consider | What a VPN changes |
|---|---|---|
| Mobile carrier | The carrier provides the phone's mobile connection. It can observe connection information needed to carry that service; what details are available depends on the network and encryption used by apps. | A VPN on the phone can move the phone's covered traffic to a VPN endpoint. Do not assume this also tunnels traffic forwarded to a hotspot client. |
| Phone hotspot | The phone shares connectivity with the tethered device. Its hotspot setting does not itself show whether that device's traffic uses a VPN tunnel. | Check current phone and VPN documentation for tethering behavior. The NCSC documents platform-dependent outcomes, including bypass or no tethered routing. |
| Tethered laptop or tablet | That device runs its own browser, apps, DNS settings, and possibly its own VPN client. Per-app rules or split tunneling can change which requests use a tunnel. | A VPN shown as connected on this device is a useful status signal, but inspect its routing and exceptions and test the relevant app path. |
| VPN provider | A provider operating the endpoint can receive traffic routed through that endpoint. HTTPS remains relevant between the app/browser and the destination. | The VPN changes which network carries the covered connection; it does not make the provider unable to observe connection metadata or make the user anonymous. |
| Website or service | A service can see the public address used for its connection and information you provide or that the app/browser sends. Accounts and existing identifiers can still identify activity. | If a request is routed through a VPN, the service may see the VPN exit address for that request. This does not remove account, cookie, or device signals. |
Check the device that matters
- Write down the path: phone model and OS, hotspot type, tethered device, VPN app and device where it runs, and whether per-app or split-tunnel rules are enabled. On managed work devices, follow your administrator's instructions.
- Look up the current phone and VPN provider documentation for tethering. Confirm whether the documented behavior applies to your exact model, OS version, VPN mode, and client app; do not generalize from another phone.
- On the laptop or tablet, check its own VPN status and routing/exclusion settings. If your goal is to route that device, do not count the phone's VPN icon as evidence about the laptop's traffic.
- For a limited browser check, keep the same tethered device and browser, note whether its VPN is connected, and compare the public IP or DNS result with the VPN disconnected and connected. A result showing a VPN endpoint is evidence about the test request at that time; it does not audit other apps, background traffic, IPv6, or every failure state. See the VPN visibility matrix and IPv6 browser-check guide for additional limits.
- If behavior is unclear, ask the VPN provider or device maker about tethered traffic and the exact configuration. Avoid testing sensitive work or personal activity on a network where you do not understand the route.
What a hotspot VPN check cannot establish
A browser IP or DNS test is a snapshot of requests made by that browser, not a packet-level audit of the phone and every connected device. It cannot prove that all apps are tunneled, that a VPN will block traffic during every disconnect, or that the VPN provider keeps no records. HTTPS, account use, cookies, and app identifiers also remain separate from the routing question. The FTC's VPN-app guidance explains that a VPN shifts trust to the app/provider and does not make a person entirely anonymous. Read the VPN app and browser-extension coverage guide if only some apps or browser traffic are included.
Sources
- UK National Cyber Security Centre: Virtual Private Networks (VPNs) (reviewed 2025-05-13; accessed 2026-11-03) — defines tethering and explains that tethered traffic handling varies across platforms, including bypass and connectivity impacts. The guidance is aimed at organizations.
- Federal Trade Commission: In the market for a VPN app? (published 2018-02-22; accessed 2026-11-03) — describes VPN app routing and privacy limitations, including that a VPN app does not make users entirely anonymous.
Impact — TODO: apply/approval and configure referral URL — referral link not configured.
PartnerStack — TODO: apply/approval and configure referral URL — referral link not configured.
CJ Affiliate — TODO: apply/approval and configure referral URL — referral link not configured.