VPNs and the law · Plain-English answer
Police cannot read VPN-encrypted traffic directly, but they can investigate around it. They can request records from the VPN provider, which only helps if logs exist, and they routinely identify people through accounts, payments, devices, and mistakes rather than by breaking the VPN itself.
The encryption used by reputable VPNs is not practically breakable, so investigators do not decrypt tunnels. Instead they work the endpoints. They can ask your ISP, which shows only that you connected to a VPN server. They can serve legal process on the VPN provider, which can only produce whatever it actually stores. A provider that keeps no activity logs has no browsing records to hand over, which real court cases have demonstrated for several services.
In practice, identification almost never comes from defeating the VPN. It comes from everything around it. Logging in to personal accounts during the same session, payment records, reused usernames, device fingerprints, malware on the suspect's machine, and old-fashioned operational mistakes have solved far more cases than cryptography ever has. Timing correlation across networks is possible for well-resourced agencies but rarely necessary.
Two honest notes to finish. A VPN is legal privacy protection, not a licence for crime, and laws on data disclosure vary by country. ROOT VPN keeps no activity logs, which means there is no record of user browsing for anyone to request.
ROOT VPN is free to start with unlimited data, no card needed, and no activity logs.
Get ROOT VPN, free