The honest answer to whether your ISP can see what you do online is yes, more than most people expect, and the gap between what HTTPS protects and what the ISP still has access to is the part that is worth understanding. Every connection you make passes through your provider, and that puts them in a position no single website or app can match. Google, Meta, and Amazon all see slices of your activity. Your ISP sees the routing layer underneath all of them.
The common reaction is to point at HTTPS and say the ISP is locked out. That is partly right and partly wrong. The encryption prevents the ISP from reading the contents of your traffic. It does not prevent the ISP from seeing the metadata that surrounds the traffic, and the metadata is more revealing than most people assume. A 2021 report from the US Federal Trade Commission looked at six major ISPs covering about 98% of the US mobile market, and the findings were the kind of thing that makes you want to read the fine print on your next billing email.
What HTTPS actually hides
When a website uses HTTPS, the connection between your browser and the server is encrypted. The ISP sees the domain you are visiting and the timing of the visit, but not the specific page, the form fields, or the contents of the response. If you load your bank’s website, the ISP can see that you connected to your bank’s domain. It cannot see your balance, your transaction history, or the account number you typed into the form.
This is a meaningful protection, and it is the reason HTTPS-everywhere is a baseline expectation in 2026. The trap is the assumption that this is the whole story. The ISP is still on the path. The domain you visited, the time you connected, the duration of the session, the volume of data transferred, the device that initiated the connection, and the approximate physical location tied to the network are all visible to the ISP regardless of whether the contents are encrypted.
The metadata is enough to build a profile. A provider that sees you connect to a fertility clinic’s website at 9 PM on a Tuesday, then to a divorce lawyer’s domain the next morning, does not need to read the page contents to infer what is happening in your life. The shape of the network activity is the story.
The DNS layer is the part most people miss
DNS (the Domain Name System, the internet’s phone book that translates example.com into an IP address) is the request your device makes to look up the IP address for every domain you visit. By default, this request goes to a DNS server run by your ISP. That request is in plaintext, which means the ISP can see every domain you look up, including the ones you never actually visit because you mistyped or because the page failed to load.
This is the part of the story that even people who understand HTTPS often miss. HTTPS protects the content of the connection between your browser and the server. It does nothing to protect the DNS lookup that had to happen first. The ISP sees the lookup as a separate event, and the timing of the lookup tells them which connection you were about to make.
The privacy-respecting fix is to switch your DNS resolver to a provider that does not log your queries. The two best-known options are Quad9 and Cloudflare’s 1.1.1.1, both of which are free and both of which have published policies on what they do with query data. The change is a setting in your router or your device, and it takes a few minutes. The privacy win is real, because the DNS layer is the cleanest signal of which sites you are about to visit.
The metadata the ISP collects even when the contents are encrypted
The categories the FTC report highlighted are the right mental model for what is collected even when the traffic itself is encrypted:
- The full list of domains you connect to, including subdomains and the timing of each connection.
- The volume of data transferred in each session, which is a rough proxy for what kind of activity is happening (a video stream is a different data shape than a text page).
- The duration of each session, which combined with the data volume gives a sharper picture of what kind of activity you were doing.
- The device identifiers on your home network, which means the ISP can tell that the same person was on the laptop, the phone, and the smart TV at specific times.
- The physical address tied to the network, which means the activity is anchored to a household rather than to an anonymous endpoint.
The collection happens at the routing layer. The ISP does not need to break the encryption to gather this. The metadata is the byproduct of operating the network, and most providers consider it fair game to retain and analyze.
The combined-data story is where the real risk lives
A few major ISPs in the US are also mobile carriers, TV providers, email hosts, smart home vendors, and search engine operators. The same parent company may see the browsing on your home connection, the location of your phone, the channels you watch on TV, the emails you send through their mail service, and the queries you make through their search engine.
The FTC report found that several of these providers combined the data across products to build advertising profiles. The profiles were shared with third parties, and the opt-out mechanisms were limited and confusing. The end result is a picture of a household’s digital life that no single service could assemble on its own, and the picture is built from data the user agreed to under separate privacy policies for separate products.
This is the part of the ISP data story that the encryption debate misses. Even if every connection you make is HTTPS, the provider that also operates your email, your phone service, and your smart home platform can combine the streams into a profile that goes well beyond what any single channel reveals.
What actually helps
The list of mitigations is long and the marginal effort of each is small. The pragmatic path is to pick the three or four that match your threat model and ignore the rest.
- Switch the DNS resolver on your router to a privacy-respecting provider. This is the highest-leverage change because it cuts off the cleanest signal of which sites you are about to visit.
- Use a VPN (virtual private network, an encrypted tunnel between your device and a remote server) when you are on a network you do not control. The VPN hides the destination domains from the local network operator, but it moves the trust to the VPN provider. Pick a provider whose logging policy has been independently audited.
- Use HTTPS everywhere. This is already the default in 2026, but make sure your home router’s admin interface and any IoT devices are on HTTPS as well. The IoT devices are the part most people forget.
- Read the privacy policy of your ISP, especially the part about data sharing with affiliates. The opt-out mechanisms are usually buried, but they exist.
- Disable any ISP-provided smart home or email services you do not actively use. Each additional product under the same parent is another stream of data that can be combined with the browsing metadata.
The list is not exhaustive. Browser-level fingerprinting protections, ad blockers, and containerized identities for sensitive browsing are all worth considering. The point is that the most common assumption, that HTTPS is enough, is the assumption that the ISP data story exploits.
Trade-offs
The mitigations are real, and they come with costs. Naming the costs honestly is part of why this is worth doing.
- A VPN moves trust from the ISP to the VPN provider. A misconfigured or dishonest VPN is worse than the ISP it replaced, because the user has fewer ways to verify the policy.
- A privacy-respecting DNS resolver is faster for many users but not for everyone. The resolver’s anycast (a routing technique that directs your request to the nearest data center) reach may be worse than the ISP’s local resolver, and the latency difference is visible on the first hop of every connection.
- Reading the privacy policy and exercising the opt-out mechanisms is a one-time cost that is larger than most people expect. The settings are scattered, the language is dense, and the opt-out is sometimes a checkbox that opts you back in by default after a year.
- Disabling ISP-provided smart home or email services means giving up some convenience, especially the integration between the home router and the TV or the email service.
- The metadata mitigations do not eliminate the metadata. The ISP can still see the volume, the timing, and the device count, even when the destinations are hidden. A determined adversary with access to the network layer can still infer a lot.
Bottom line
Your ISP can see more than HTTPS alone suggests, and the gap between what is encrypted and what is collected is the part that the marketing of “encrypted browsing” leaves out. The DNS layer is the cleanest signal, the metadata is enough to build a profile, and the combined-data story across ISP-owned products is the part that makes the FTC report uncomfortable.
If you only do one thing, switch your DNS resolver. It is a few minutes of setup, it costs nothing, and it cuts the cleanest signal of which sites you are about to visit. The rest of the mitigations stack on top, and the right combination depends on what you actually need to protect.