What your internet provider can see, and how to stop it

The short answer

Your provider can usually see which sites you visit, when, and how much data you use, even when the sites use HTTPS. It can't normally read the pages themselves. A VPN hides the sites too, leaving your provider with one encrypted connection.

The lookups

Before your phone can open a site, it asks a DNS server for the site's address. By default, that server is often run by your provider, and the question is sent unencrypted. Together, those questions amount to a list of every site you open, with times.

The connections

Even if you use a different DNS service, your provider still sees the addresses your phone connects to. Many sites share addresses, but others are easy to identify. And when a secure connection starts, the site's name is often sent in plain text as part of the setup.

What HTTPS hides, and what it doesn't

What providers do with it

Depending on the country, providers may be required to keep some connection records for a period of time, may use browsing data for advertising where the law allows, or may block sites when asked to. The rules vary widely, and they change.

How a VPN changes it

With a VPN, your phone sends everything, lookups included, through an encrypted tunnel to the VPN server. Your provider sees that you're connected to a VPN, when, and how much data passes. It no longer sees the sites.

Other things that help

• Encrypted DNS (DNS over HTTPS or over TLS) hides your lookups, though not the addresses you connect to.
• HTTPS protects the content of what you read and send.
• A privacy-focused browser reduces fingerprinting and tracking by the sites themselves.