Your internet service provider can see every website you visit, every app you use, and every device on your network. Here's exactly what they collect, what they do with it, and how a VPN and encrypted DNS can help.
Your internet service provider occupies a uniquely privileged position in your digital life. Every piece of data you send or receive passes through their infrastructure. Unlike websites — which see only the traffic you send to them — your ISP sees everything: every website you visit, every app that connects to the internet, every device on your home network, and the timing and volume of all your communications. In the United States, ISPs are legally permitted to collect and sell this data to advertisers without your explicit consent.
What your ISP can see without a VPN: DNS queries (every domain name you look up — even if the connection is encrypted, the DNS lookup is typically unencrypted and reveals the site you're visiting); IP addresses of every server you connect to; the timing and volume of your connections (even without content, metadata reveals a great deal — which streaming service you use, when you're home, what apps you use); and SNI (Server Name Indication) headers, which reveal the specific hostname you're connecting to even on HTTPS connections.
What your ISP cannot see with HTTPS: the content of your communications — the actual pages you view, the text of your messages, your login credentials. HTTPS encrypts the payload of your connections. But HTTPS alone doesn't hide which sites you visit — only the content of those visits. The distinction matters: your ISP knows you visited your bank's website, but not what you did there.
The 2017 Congressional Review Act repeal is the key US policy context. In 2016, the FCC passed broadband privacy rules requiring ISPs to get opt-in consent before selling sensitive browsing data. In 2017, Congress voted to repeal those rules before they took effect, and President Trump signed the repeal. As a result, US ISPs — Comcast, AT&T, Verizon, Charter, and others — are legally permitted to collect and sell your browsing history to advertisers. Major ISPs have confirmed they operate data monetization programs.
How a VPN limits ISP visibility: when you use a VPN, your ISP sees only that you're connected to a VPN server — not the sites you visit or the content of your traffic. The VPN encrypts everything between your device and the VPN server. Your ISP can see the VPN server's IP address, the timing and volume of your encrypted traffic, and that you're using a VPN — but nothing beyond that. This is the primary privacy benefit of a VPN for home internet users.
Encrypted DNS is a complementary protection. Even with a VPN, DNS queries can leak if your VPN client isn't configured correctly. Encrypted DNS protocols — DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) — encrypt your DNS queries so your ISP can't read them. Firefox and Chrome support DoH natively; you can configure it in browser settings. For system-wide encrypted DNS, use a DNS resolver like Cloudflare (1.1.1.1), NextDNS, or Quad9 with DoH or DoT enabled. Combined with a VPN, encrypted DNS closes the most significant remaining visibility gap.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.