The fields a venue can write down
- Device: the hardware address and the name your phone gives itself when it joins.
- Lookup: the site name your phone asks the resolver for, unless the lookup is already inside a tunnel.
- Destination: the address of every server you open a connection to.
- Volume and timing: how long you stayed and how much you moved, which no tunnel hides.
- Login page entries: whatever you type into the venue's own form, such as a phone number or email, which sits outside the tunnel when you type it.
Why filtering also happens on the line
The owner is not the only party on the path. In its 2022 report on Vietnam, OONI and the iMAP project (OONI) found that blocking on the main networks VNPT, FPT and Viettel worked mostly through DNS answers and HTTP block pages. That matters in a café because the venue usually passes your lookups to the same upstream provider as everyone else. A lookup moved into a tunnel no longer asks that provider, so a DNS-based block on the line does not apply to it.
How often selected sites looked unusual in 2026 measurements
| Site | Anomalous measurements | All measurements | Source |
|---|---|---|---|
| bbc.com | 2590 | 4930 | OONI |
| rfa.org | 934 | 3073 | OONI |
| voanews.com | 431 | 1635 | OONI |
| facebook.com | 114 | 22999 | OONI |
| youtube.com | 34 | 23053 | OONI |
Reading the table without over-reading it
These counts come from OONI measurements taken in Vietnam between 1 January and 13 November 2026 (OONI), and an anomaly is a result that differs from the expected one, not proof of a block. Still, 2590 of 4930 for bbc.com is far above 34 of 23053 for youtube.com, so some news sites look filtered on part of the networks while the large social platforms look open. Nobody publishes an official list of blocked sites, and venue Wi-Fi is just one more line where the same upstream filter may apply. We sell this subscription, so check any claim here with a test on your own phone.
Encrypted open Wi-Fi, and what it does not fix
Some venues now run Wi-Fi Enhanced Open, announced by the Wi-Fi Alliance on 5 June 2018 (Wi-Fi Alliance). It gives each device its own encryption key on a network that has no password, which stops a neighbour from passively reading the radio traffic. It does not stop the owner's router from logging lookups and destinations, since the router is the other end of that encrypted link. A tunnel and Enhanced Open therefore cover different ends of the path, and one does not replace the other.
Where the explanation stops
It stops at the venue's rules and at the law: a venue may block tunnels, and what the state allows is decided in Hanoi and revised from time to time, so reading the current local rules, and whatever each app or site wrote into its own terms, stays your job. We have no server in Vietnam, so the tunnel gives no Vietnamese address. The subscription link opens in Happ, with up to 5 devices on one link, and the bot lives in Telegram, so you need a line where Telegram opens before the link exists. Questions that belong to their own pages, such as checking your public address, a proxy site versus a tunnel, Telegram on a tunnel, a DNS leak test, and the hotel login page, come next.