With Layer 3 VPNs, the provider’s routers participate in the customer’s Layer 3 routing.

MPLS VPNs are designed to run over private networks rather than the public Internet.

With Layer 2 VPNs, the provider does not participate in the routing of the customer’s private IP traffic.

MPLS VPN tunnels are always encrypted.