I see.
Yeah it is true a VPN alone isnt a magic bullt for privacy. It just solves enough problems to bypass state restrictions.
I see what you mean by ip whitelisting now. I was confused because I thought you meant the customer IP would be whitelisted.