The app says connected, but an IP test shows the address your internet provider gave you. That is a real leak, or a misread. This guide helps you tell which, then fix it. Work through the causes in order, because the first few are the most common.
First, make sure you are reading the right result
Run the VPN check and the IP lookup in the same browser. Look at both the IPv4 and the IPv6 line. A VPN that tunnels only IPv4 can leave your IPv6 address showing your real provider. Also confirm the test did not load from a cached page: reload it after you connect.
Cause 1: IPv6 is not covered
Some VPNs route only IPv4 traffic. If your network has IPv6, sites that support it will see your real IPv6 address. Look for a setting called "IPv6 leak protection" or "block IPv6" in your VPN app. If there is none, you can turn IPv6 off on your network adapter as a workaround. Read what an IPv6 leak is for the details.
Cause 2: WebRTC reveals your address in the browser
WebRTC is a browser feature for calls that can reveal a local or public address even when the rest of your traffic is tunnelled. Run the WebRTC leak test. If it shows your real public address, follow how to stop WebRTC leaks, or use the VPN's browser extension, which usually handles it.
Cause 3: Split tunnelling or an app outside the tunnel
Many VPN apps let some apps or sites bypass the tunnel. If your browser is on that list, or the VPN excludes local network and certain ports, you will see your real address. Open the VPN's split tunnelling settings and make sure the browser goes through the VPN.
Cause 4: The tunnel dropped or never fully started
A status light can say connected while the connection is reconnecting. Disconnect and reconnect, try another server or protocol (WireGuard or OpenVPN), and test again. Turn on the kill switch so traffic stops when the tunnel drops. Testing a kill switch shows how to confirm it works.
Cause 5: Your DNS requests bypass the VPN
Your visible IP can be correct while your DNS queries still go to your provider. That is a different leak and does not show on a normal IP test. See DNS requests bypassing your VPN and run the DNS leak test.
Cause 6: Another layer is in the way
A second VPN, a proxy setting in the browser, a corporate profile or a router-level VPN can conflict. Disable extra proxies and test with one VPN only.
When it might not be a leak
If the test shows a VPN server's address but a location you did not choose, that is usually a geolocation database error, not a leak. If the address belongs to your VPN provider, you are connected.
Confirm the fix
After each change, rerun the full privacy scan. A good result here means these tests found no exposure; browser fingerprinting and logins can still identify you.