The direct answer and the key limitation

You generally can’t tell for sure whether a specific person is using a VPN just by looking at their device or browsing activity. Many VPN-like signs (different IP address, different apparent location, encrypted traffic) can also come from other tools such as proxies, corporate networks, mobile carrier changes, or privacy-focused browser features. A trustworthy conclusion usually requires either explicit confirmation or access to logs/telemetry that you control.

What a VPN typically changes (simple model)

A VPN creates a connection from the user’s device to a VPN server and then sends traffic through that tunnel. From an outside observer, the most visible changes are usually:

  • The public IP address appears to belong to the VPN provider/server location rather than the user’s usual network.
  • Some network metadata can look different (for example, where traffic appears to originate, and how DNS queries are handled).
  • Traffic contents often remain encrypted between the device and the destination.

This helps you form a hypothesis, but it still doesn’t guarantee the explanation is a VPN.

Practical checks you can do without “guessing from vibes”

If your goal is to assess whether VPN use might be happening (for security troubleshooting, internal IT, or your own understanding), rely on consistency and multiple indicators:

  1. Compare IP changes over time: Check whether the apparent public IP (or geolocation) changes in ways that don’t match the person’s real-world network (e.g., staying “elsewhere” even when they claim to remain on the same Wi‑Fi).
  2. Look for patterns in name resolution: In some setups, DNS behavior can shift (for example, DNS traffic may not look like it’s going to the local resolver you’d expect). Exact methods depend on your environment, so focus on whether behavior consistently differs.
  3. Check whether multiple sites show the same “remote” origin: If several unrelated services appear to agree on the same unusual origin location across time, that’s a stronger sign than a single site showing a mismatch.
  4. Consider simpler alternatives first: A corporate network, a proxy, an endpoint security tool, a browser privacy feature, or even a mobile network handoff can produce confusing results.

Differences and limits (what can change the conclusion)

Even when you see VPN-like behavior, remember the main exceptions:

  • Corporate or managed networks can route traffic through gateways that resemble VPN characteristics.
  • Proxies and privacy tools can alter apparent origin or network metadata.
  • Dynamic IPs and carrier routing can shift location without any VPN.
  • “Encrypted traffic” is not proof: HTTPS encryption is normal; it doesn’t uniquely indicate a VPN.

So the important limitation is confidence: you can often detect that “something is altering network origin,” but you usually can’t uniquely attribute it to a VPN.

When you can be confident (and when you can’t)

You can be most confident only with one of these:

  • Explicit confirmation by the person, with consent.
  • Evidence from a system you control (for example, network logs, endpoint telemetry, or access records) that specifically identify tunneling/VPN connections.

If you don’t have that, treat your findings as an indication or suspicion, not as proof. If this question is for a workplace or safety context, stick to policies and lawful monitoring rather than trying to “test” someone’s privacy settings.