Firefox includes a free VPN: what it actually protects

Firefox is rolling out a free VPN directly inside the browser. The feature masks the user's IP address from visited sites and sends Firefox traffic through an intermediary server. It is gradually becoming available in France and several other countries without a paid subscription, although a Mozilla account is required.

For summer 2026, Mozilla has temporarily replaced the usual 50 GB allowance with unlimited data through August 31 and opened 28 connection locations. That is an attractive offer, but the word “VPN” may suggest that the entire computer is protected. It is not: only connections originating in Firefox use this service.

The short answer

For reading news, opening a bank account page or shopping from hotel Wi-Fi, the built-in protection may be both sufficient and easier than installing another application. It does not cover a standalone mail client, game, file-sharing tool or professional application outside the browser.

A browser-scoped VPN

Once enabled, Firefox sends its web connections through a secure proxy. A destination website receives the intermediary server's IP address instead of the one assigned by a home router, phone hotspot or public access point. An observer on the local network sees a connection to the service but should have a harder time mapping the servers being visited.

The same architecture explains the product's simplicity and its boundary. There is no system network driver or global tunnel to manage. In return, an application running alongside the browser continues to use its normal route. A link opened in Firefox is covered; synchronization by a desktop mail client or a game launcher is not.

Mozilla uses VPN in the interface while technically describing a proxy service for Firefox traffic. The useful distinction for users is not the label, but the scope: browser only versus whole device.

What it hides and what it does not

An IP address exposes approximate location and can help correlate separate visits. Replacing it reduces that signal, particularly on a network the user does not control. Choosing another location can also reduce the geographic precision shared with a site.

Other identifiers remain. Signing in to Google, Facebook, Amazon or a publication immediately tells that service which account is browsing. Cookies, local storage, browser settings and fingerprinting techniques may connect sessions. The VPN does not erase local history and does not automatically block every tracker.

Nor does encryption make a fraudulent page legitimate. A phishing site is still dangerous through an encrypted tunnel, and so is a malicious Firefox extension. Protecting the network path does not guarantee the identity of a website or the safety of a download.

Reducing tracking requires a combination of Enhanced Tracking Protection, limited extension permissions, prompt browser updates and sensible separation between accounts. The VPN is another layer, not the entire security model.

A practical layer on public Wi-Fi

Modern websites mostly use HTTPS, which already encrypts content between Firefox and the server. On public Wi-Fi, this prevents direct reading of passwords, messages and pages. A VPN remains useful because it obscures network destinations and avoids exposing the access point's assigned IP to each site.

Users should still avoid connecting to any network carrying a hotel or station name. A fake hotspot can present a deceptive captive portal, request credentials or encourage installation of a profile. Verify the network name, reject unexpected software or certificates, and prefer a phone hotspot for especially sensitive work.

The integrated tunnel is well suited to occasional situations: a few hours on a train, in an airport or at a shared workplace. It requires less preparation than a separate client, provided that the status indicator is checked rather than assumed.

Availability remains progressive

Mozilla began rollout with Firefox 149. Supported regions have expanded, but activation remains staged. Two computers running the same version may therefore receive the feature at different times.

A signed-in Mozilla account is required. Eligible profiles see a VPN icon in the toolbar or among the controls available through toolbar customization. A missing button is not a reason to download an imitation extension from a third-party website. Update Firefox through its official mechanism, check the documented settings and wait for account eligibility.

Managed enterprise environments are not targeted by the rollout. Administrators can block activation with the IPProtectionAvailable policy. This is reasonable: a browser tunnel may bypass network controls, change the location perceived by business services or complicate incident investigation.

The 50 GB allowance returns after summer

Normal service includes 50 GB per calendar month. Firefox warns as the threshold approaches and pauses protection once it is reached. It asks for confirmation before continuing without the tunnel, reducing the chance of silently returning to a direct connection.

For reading, administration and online shopping, 50 GB is a generous allowance. High-definition video can consume several gigabytes in a few hours, so routing every streaming service through it can exhaust the quota quickly.

Unlimited summer data is temporary. On September 1, users should expect the regular cap and standard location set to return. Switching browsers solely for this promotion would make little sense; the lasting benefit is convenient everyday protection.

What Mozilla processes

The Firefox Privacy Notice says the proxy server is operated on Mozilla's behalf. Mozilla states that it cannot access webpage content, messages or passwords and does not collect the websites visited or their contents. It still processes limited technical information, such as client version, connection status, device type and operating system, along with interaction data used to operate and improve the feature.

That description is more informative than a general “we do not sell data” promise. It shows the trade-off: an internet provider and destination sites see less of the original network identity, while the user entrusts web routing to the proxy operator. A VPN never removes trust; it moves it.

Anyone with strict requirements should read the notice applicable to their region, monitor changes and distinguish the built-in feature from the Mozilla VPN subscription. The products differ in scope and may differ in operational data.

Built-in Firefox protection or a full VPN?

The approaches can coexist on a personal computer, but stacking tunnels without understanding their order is unhelpful. An active corporate or system VPN may conflict with Firefox protection, reduce throughput or send traffic along an unexpected route. Organizational policy should take precedence on managed devices.

Checklist before enabling it

1. Update Firefox using the official update mechanism.
2. Confirm that the icon belongs to Firefox rather than an unknown extension.
3. Sign in to the correct Mozilla account and secure it with strong authentication.
4. Enable the service and verify the selected location.
5. Test essential banking, streaming and professional services.
6. Identify which applications remain outside the tunnel.
7. Keep HTTPS, tracking protection and browser updates enabled.
8. On public Wi-Fi, verify the network name and reject unexpected profiles or certificates.
9. After August 31, watch for the return of the 50 GB limit.
10. Add per-site exceptions only when necessary and review them periodically.

Firefox's built-in VPN is a useful local protection: accessible, free and understandable for common web use. Its value comes precisely from browser integration. That convenience should not become an exaggerated promise. It masks an IP address and improves the privacy of Firefox traffic; it does not protect the whole device or eliminate every form of tracking and attack.