Fundamentals

What Can Your Internet Provider See?

By Daniel Sardá · Published on October 22, 2026

7 min read1,372 words

Your internet provider cannot see everything, but HTTPS does not make it blind. This guide separates content, destinations, and metadata, and explains what each privacy tool changes.

Your internet provider cannot read everything you do, but it is not unaware of your activity either. Because it carries traffic from your connection to the rest of the internet, it can observe certain basic facts: when you connect, how much traffic you exchange, and which internet address a connection is headed toward. Depending on the protocol and configuration, it may also know or infer the service you visit.

The accurate answer, then, is neither “everything” nor “nothing.” It depends on the kind of data involved, whether the communication is encrypted, and whether you use an intermediary such as a VPN or the Tor network. Understanding those layers helps you make better decisions about your online privacy without mistaking protection for invisibility.

Key idea: Encrypting the content of a communication does not necessarily remove information about when it happened, how long it lasted, or which points it traveled between.

Your provider has a distinct position

An internet access provider, often called an ISP, connects your home or device to the internet. It is not the same as a website, a browser, or the administrator of a shared Wi-Fi network. Each party sees a different part of the picture.

In a direct connection, an ISP can usually associate your line or session with a public IP address for a given period. It also carries packets with a destination IP address, timing information, and traffic volume. That position lets it see connection patterns, though not necessarily the content inside those packets.

Linking activity to a particular person requires care. An account may belong to a household or business, several people may share a public address, and assignments change. Being able to observe a datum does not prove that the provider keeps it or knows who took every action.

An IP address, domain, URL, and content are not the same thing

Imagine that you visit:

`https://example.org/topic?query=privacy`

Several distinct elements are involved:

• The IP address identifies a technical destination on the network, although one IP can host many services.
• The domain is `example.org`.
• The full URL also includes the path `/topic` and the query that follows it.
• The content is the page received, along with data you send, such as a form entry or password.

With HTTPS properly established, the path, query, and content are normally protected from an ISP’s reading. The HTTP standard explains that HTTPS provides confidentiality and integrity for the communication (RFC 9110). But the connection must still reach somewhere: the destination IP remains necessary, and other signals can reveal the domain.

An unencrypted DNS query can reveal the name the device looked up. The server name may also appear while certain connections are being established through SNI. ECH aims to encrypt that signal, though it depends on support and the rest of the configuration. Assigning an IP address to a service is not always conclusive either, because of shared hosting and content-delivery networks. These layers are described in RFC 9849.

HTTPS protects a great deal, but does not erase metadata

HTTPS substantially changed what an intermediary can read. If you view an article or submit a form on a well-configured site, your ISP should not directly see those pages or values.

Information such as IP addresses, timing, duration, and approximate traffic volume remains visible. This is communications metadata, and it can reveal routines even when it does not reveal the message. A long connection to a service does not show what a user did there, but it can still form part of a pattern.

Useful distinction: A domain identifies a service; a full URL can reveal a particular page and search. HTTPS usually protects the latter, even though the domain may still leak or be inferred through other layers.

What each tool changes

Privacy tools do not all do the same thing. The useful question is not merely “does it encrypt?” but what does it hide, from whom, and which new intermediary receives your trust?

Encrypted DNS

DNS translates names such as `example.org` into IP addresses. Protocols such as DNS over HTTPS, defined in RFC 8484, can prevent an ISP from directly reading a DNS query. In return, the encrypted DNS resolver receives that query. The provider still observes the resulting connections and may infer things from their IP addresses and patterns.

Protection depends on the mechanism being active and on the absence of parallel unencrypted queries. Encrypted DNS improves one layer; it does not create anonymity.

VPN

A virtual private network creates an encrypted tunnel between your device and the VPN server. The ISP sees the connection to that server, along with its timing and volume, but no longer directly sees the destinations beyond it. From the provider’s perspective, a visit to one website and a connection to another service are inside the same tunnel.

The VPN takes on a new observing role: it can know the origin and handle the traffic leaving the tunnel. Websites can still identify you through your account, cookies, or browser. Choosing a VPN means choosing where to place trust, not removing the intermediary.

Tor

Tor distributes a connection across several relays so that no single point knows both the origin and the destination. An ISP will usually see a connection to the Tor network, but not the final site. According to the Tor Project, this protection applies to traffic from applications configured to use Tor and does not guarantee perfect anonymity.

Signing in to a personal account, revealing identifying details, or using applications outside Tor can undo some of that separation. Its design differs from a VPN’s, but it does not solve every limit of online anonymity.

Incognito mode or private browsing

Private browsing mainly operates on the device. It reduces the local history, cookies, and other traces left behind when a session is closed. By itself, it does not change the path traffic takes or prevent an ISP from observing the connection. Mozilla states this explicitly in its private browsing documentation.

It can help separate sessions or limit what another person using the same device will see. It does not hide activity from the provider or the network administrator.

Key idea: A VPN changes the immediate destination the ISP sees; Tor distributes knowledge across relays; incognito mode removes local traces. These functions are not interchangeable.

Seeing data is not the same as retaining or disclosing it

Three questions should be kept separate: what can the provider technically observe, what does it actually retain and for how long, and under what conditions can it disclose that information to a third party or public authority?

The answers depend on its architecture, policies, and the applicable jurisdiction. There is no universal retention period or global rule governing government access. Nor should one assume that every technically available datum is stored.

From the perspective of individual liberty, that distinction matters because concentrated information creates power. Protecting privacy calls for transparency, purpose limits, accountability, and legal procedures subject to oversight. Not every collection practice creates the same risk, but it should be capable of justification and governed by known rules.

How to reduce exposure thoughtfully

You do not need to pursue impossible invisibility to improve privacy. The first step is to define who you seek protection from and what the consequences of exposure would be.

HTTPS protects content from intermediaries. Encrypted DNS can hide DNS queries from an ISP. A VPN can keep it from seeing direct destinations, at the cost of trusting the tunnel operator. Tor offers another separation between origin and destination, subject to limits in configuration and conduct. Managing accounts, permissions, and trackers still matters because encryption and anonymity are not the same thing, and neither is privacy the same as security.

The sensible decision is to combine measures in proportion to the risk and to understand what each one does not solve. In relation to your internet provider, privacy is not a switch that turns on: it is a gradual reduction in the information available and, with it, in the power any intermediary can exercise without the user’s knowledge or consent.