A research finding on mobile VPNs is a reminder that encryption alone does not guarantee privacy if the provider can still observe, collect, or retain other data.