Guide
Tracking & ROI
Brands
A VPN genuinely breaks IP-based tracking fallback, because it routes traffic through the VPN provider's own server, so the destination sees the VPN server's IP — often shared among many simultaneous users or rotated between requests — instead of the customer's real one. A private DNS tool like Pi-hole or NextDNS's standard mode doesn't do this: it only changes domain-name lookups, not the IP address a website sees.
As covered in how influencer tracking actually works, an IP address is the third of three mechanisms a tracking system typically combines: a cookie, a click ID, and an IP-based fallback. The IP fallback exists specifically to catch purchases where neither the cookie nor the click ID survives — most commonly because the click happened inside Instagram's or TikTok's own embedded in-app browser, which typically doesn't carry cookies between visits. According to Make Influence's own documentation of its tracking method, a click's IP address is retained for up to 3 months, specifically to match a purchase that happens later, without the cookie ever having been set. See attribution windows in influencer marketing for how that 3-month IP window compares to the cookie windows other platforms and networks publish, and why influencer sales don't show up in Google Analytics for how the same underlying gap looks from the analytics side.
The mechanism is simple, but it rests on one implicit assumption: that the IP address the system records at the click is the same IP address — or at least reliably tied to the same customer — as the one the system sees at the purchase. That's exactly the assumption a VPN undermines.
A VPN opens an encrypted connection between the customer's device and a server the VPN provider itself runs, and routes all traffic through that server before it reaches its destination. That means the website or tracking system the customer ultimately reaches doesn't see the customer's own IP address — it sees the VPN server's. According to ExpressVPN's own description of how the service assigns IP addresses, a user gets "a different IP address — one owned by ExpressVPN and shared by numerous users," selected from a pool of addresses on each server. That's not a quirk unique to this one provider: the general principle — that the destination sees the VPN server's IP instead of the customer's own — is the basic mechanism of any VPN tunnel, regardless of provider.
Two distinct but related problems show up once IP fallback meets an active VPN:
1. The IP address can be shared with many other, unrelated users at the same time. The tracking-mechanics article above already flags that IP fallback's weakness is that "multiple people can share an IP, e.g. on the same wifi" — a household or office with a handful of people. A VPN provider's shared IP pool is the same weakness at a completely different scale: according to ExpressVPN's own description, an IP is drawn from a pool several other users also use — potentially thousands of entirely unrelated people worldwide, not a handful in the same household.
2. The IP address can itself change between the click and the purchase. ExpressVPN also describes its own "ShuffleIP" feature, where "each time you initiate an outgoing connection to a web server or website, the system randomly assigns an IP from this pool" — without the customer needing to switch server locations at all. That contrasts with what ExpressVPN itself calls the "traditional method" for VPNs: assigning a single IP address to all traffic on a device, then switching the IP every few minutes. Whichever model a given VPN provider uses, the consequence for IP fallback is the same: the IP the tracking system recorded at the click isn't necessarily the same IP it sees at the purchase — even if it's the same customer buying.
A VPN sits alongside two other distinct mechanisms that can break tracking for reasons that have nothing to do with IP addresses at all — see do ad blockers break influencer and affiliate tracking links and do link-in-bio tools like Linktree break influencer tracking links for how each one differs from what's described here.
Both mechanisms only hit the IP layer. If the cookie or click ID is already set and survives intact from click to purchase, it makes no difference whether the customer is using a VPN — tracking works normally. The problem only shows up when IP fallback is the last resort, because the cookie or click ID was already lost — typically because the click happened in an in-app browser.
"VPN" and "private DNS" get mentioned together as privacy tools, but technically they do two completely different things. A plain DNS tool like Pi-hole, or NextDNS in its standard DNS mode, only changes which server resolves domain names to IP addresses — it doesn't change the IP address a destination sees once the device actually opens the connection. According to Pi-hole's own documentation, the tool is "a DNS sinkhole that protects your devices from unwanted content" — it operates purely at the DNS level and has no built-in feature to mask or change a device's IP address as seen by the sites it visits. NextDNS's own help center confirms the same distinction in a user discussion on exactly this question: NextDNS's DNS mode can hide a user's IP address from NextDNS itself (as the DNS operator), but it doesn't change what destination websites see — that requires an actual VPN.
| Tool | What it changes | Does it change the IP the destination sees? | Effect on IP-fallback tracking |
|---|---|---|---|
| VPN | Routes all traffic through a remote server the VPN provider runs | Yes — the destination sees the VPN server's IP, often shared or rotating | Breaks IP fallback: the click IP doesn't necessarily match the purchase IP, or is shared with other customers |
| Pi-hole (plain DNS sinkhole) | Which server resolves domain names, and blocks known ad/tracking domains | No — the destination still sees the device's own IP | No effect on IP fallback |
| NextDNS in DNS mode (default) | Same as Pi-hole, plus hides the user's IP from NextDNS itself as the DNS operator | No — only hidden from NextDNS's own logs, not from destination websites | No effect on IP fallback |
| A DNS tool paired with a separate VPN | Both at once — DNS filtering plus full traffic routing | Yes, because of the VPN component — not the DNS component | Same effect as the VPN row above |
The numbers below are illustrative only, built to demonstrate the mechanism — not a real Make Influence customer case, and not an actual measurement of how much traffic uses a VPN.
Assume a campaign generates 1,000 tracking-link clicks in a month, converting at an average rate of 8% — that is, 80 purchased orders in total. Assume further — purely for illustration — that the cookie or click ID is already lost for 200 of the 1,000 clicks, typically because they happened in an in-app browser, making IP fallback the only remaining tracking option for that subset. Applying the same 8% conversion rate to those 200 clicks gives 16 purchases that depend on IP fallback alone. Assume finally — again purely for illustration — that 15% of those 200 clicks (30 clicks) come from a customer using a VPN with a shared or rotating IP at the time of either the click or the purchase. Of those 30 clicks, 8% (roughly 2-3 purchases) results in a purchase that falls into the IP-fallback scenario — and for those purchases, the IP match isn't reliable, because the click IP and the purchase IP could be two different VPN-assigned addresses, or the IP could be shared with other VPN users. Those 2-3 orders are real orders in the store's own system, just without a reliable creator attribution — a loss that stacks on top of, not instead of, the loss already documented elsewhere in the Academy from in-app browsers and ad blockers.
As described in how influencer tracking actually works, Make Influence's own tracking method combines a 30-day cookie with up to 3 months of IP fallback. We currently have no separate handling for or correction of VPN traffic — if a customer clicks or buys through a VPN while the cookie or click ID is already lost, the IP fallback simply can't match reliably, exactly as described in this article. In our experience, the practical answer is the same as for the other tracking gaps covered elsewhere in the Academy: the more the cookie and click ID carry the tracking on their own, the less the result depends on whether any one customer happens to be using a VPN that day.
No. A VPN only hits the IP-fallback layer of tracking. If the cookie or click ID is already set and stays intact from click to purchase, tracking works normally regardless of whether the customer is using a VPN.
No. Pi-hole and NextDNS in plain DNS mode only change how domain names are resolved to IP addresses — they don't change the IP address a destination sees once the device opens the actual connection. Only an actual VPN does that.
Only from NextDNS itself, as the DNS operator — not from the destination websites the customer subsequently visits. NextDNS's own help center confirms this in a user discussion on exactly this question. Hiding the IP from the destination too requires a separate, actual VPN.
Not necessarily. The shared model is documented for at least one major provider, ExpressVPN, which describes assigning IP addresses from a pool many users share at once, and can even rotate the IP per connection with its own "ShuffleIP" feature. Other providers may offer dedicated or static IP addresses as an add-on — check the specific provider's own documentation if this matters for your case.
No. A VPN only changes the network layer — which IP address the destination sees. Cookies are stored and read by the browser independently of whether traffic is routed through a VPN, so an intact cookie or click ID works as normal.
No. Make Influence's tracking method currently has no separate handling for VPN traffic — IP fallback works exactly as described in this article, with no correction for a shared or rotating VPN IP.
No. A shared household device usually keeps the cookie or click ID intact, so tracking and commission both work correctly — only the buyer's identity within the household is uncertain. See shared devices and household accounts for that distinct scenario.
Make Influence
Find creators with real audience data, run collaborations in one place, and see clicks and sales per creator while the campaign is live.
Book a demoCreate accountMake Influence
Apply to campaigns from brands that are actively looking, follow your own clicks and sales, and get paid without chasing invoices.
Create creator profileMore creator guidesMake Influence
Briefs, agreed terms, tracking links and results sit together — so brands and creators see the same numbers.
See how it worksBrowse the Academy
