On-device VPN explained: why a tracker blocker asks for VPN permission
An on-device VPN, also called a local VPN, uses your phone’s VPN permission to check every connection your apps make against a blocklist stored on the phone. Nothing is sent through an outside server and your IP address does not change. Tracker blockers such as BLOKK and DuckDuckGo’s App Tracking Protection work this way.
Why does a tracker blocker need VPN permission?
Android and iPhone do not let one app see or stop what another app sends. There is one exception: the VPN permission, which was designed so a VPN app could carry all of the phone’s traffic.
A tracker blocker uses that same permission for a different job. It does not carry your traffic anywhere. It stands at the phone’s exit, looks at the address each app is trying to reach, and refuses the ones on its list. That is why you see a key or VPN symbol at the top of the screen even though you have not connected to a VPN server.
On-device VPN and ordinary VPN compared
| On-device VPN | Ordinary VPN | |
|---|---|---|
| Where your traffic goes | Straight to the internet, as normal | Through the VPN company’s server first |
| Your IP address | Unchanged | Replaced by the server’s address |
| Changes your virtual location | No | Yes |
| What it is for | Blocking trackers and scam websites in every app | Hiding your IP address and location |
| Effect on speed | Very small, since nothing is rerouted | Depends on the server |
| In BLOKK | Privacy Shield, free | VPN on the MAX plan, paid |
How BLOKK’s on-device VPN works
When any app on your phone asks for the address of a website or service, BLOKK compares the name with its list of known tracking and scam domains. On Android that list holds more than 7 million domains. If the name is on the list, BLOKK does not let the connection go ahead. Everything else passes as usual.
Because the check happens at the phone’s exit, it covers every app and every browser, not one browser.
Is an on-device VPN safe?
The permission is powerful, so the question is who you give it to. An app with VPN permission can see which addresses your phone contacts. Before trusting one:
- Know who makes it. A named company with an address and a privacy policy.
- Read what it collects. The store page’s data safety section and the privacy policy should say.
- Check that the filtering happens on the phone. A blocker that sends your traffic to its own servers to filter it is an ordinary VPN with a different name.
BLOKK is made by Revoke Limited in Jersey. The Shield filters on your phone and needs no account. What BLOKK collects is set out on our page Is BLOKK safe?.
Can I use an on-device VPN and a normal VPN at the same time?
Android runs one VPN app at a time. If your tracker blocker holds the VPN permission, a separate VPN app cannot run alongside it, and turning one on switches the other off. This is the most common complaint about tracker blockers.
BLOKK avoids the problem by doing both in one app. BLOKK’s VPN runs through its Privacy Shield. Turn the VPN on and the Shield keeps blocking trackers and scam websites while your IP address is hidden. The VPN only works while the Shield is on.
Does an on-device VPN drain the battery?
It adds a small amount of work for each new connection. Blocked trackers also mean fewer connections are made in the first place, and those are connections your phone would otherwise have spent power on.
What if an app stops working?
A few apps do not behave when their trackers are blocked. In BLOKK you can pause the Shield for a short time, and on Android you can switch it off for a single app and leave it on for the rest.
Further reading: What is “On-Device VPN”.
Download BLOKK on Google Play or download BLOKK on the App Store.
