What your ISP can actually see, and how to limit it

Every device you connect to the internet, whether it’s a laptop on home fibre or a phone on a mobile plan, routes its traffic through your internet service provider before it reaches anywhere else. In Singapore that’s Singtel, StarHub, M1, or one of the smaller MVNOs riding their networks; elsewhere it’s Comcast, BT, Deutsche Telekom, whoever sold you the connection. That position in the middle gives your ISP a vantage point almost no other company has. It doesn’t need you to log in or fill out a form. It sees the shape of your online life just by being the pipe everything flows through.

Most people assume HTTPS solves this, that the little padlock in the browser bar means the ISP is locked out entirely. That’s only partly true, and the gap between what people assume and what actually happens is worth understanding, especially if you’re deciding whether a VPN or encrypted DNS is worth the hassle.

what it is

“What your ISP can see” refers to the metadata and, in some cases, content that passes through your provider’s network as you browse, stream, and use apps. This splits into two rough categories: what’s visible even when a connection is encrypted (which domains you visit, when, how much data moved, roughly how long you stayed), and what’s visible only when a connection isn’t encrypted (the actual content of a page, a login form’s fields, a document you download over plain HTTP).

Since most of the modern web runs on HTTPS, the second category has shrunk a lot over the past decade. The first category, the metadata layer, is what most people underestimate. Your ISP doesn’t need to read your email to know you use Gmail, and it doesn’t need to see your search terms to know you spent forty minutes on a telehealth site at 11pm.

how it works

Two mechanics do most of the work here: DNS and TLS.

Before your device can reach any website, it usually has to resolve a domain name to an IP address via DNS. If you’re using your ISP’s default DNS resolver, and most people are without ever changing a setting, every domain lookup passes through their servers in plain text. That’s a running list, in real time, of every site you visit, whether or not the site itself is encrypted.

Then there’s the TLS handshake itself. Even on an HTTPS connection, older TLS setups send the domain name in cleartext as part of a field called Server Name Indication (SNI), so the server knows which certificate to present. Your ISP can read that field even though it can’t read anything after the handshake completes. The IETF’s TLS 1.3 specification defines this handshake process, and newer work on Encrypted Client Hello (ECH), which Cloudflare has been rolling out and written about in detail, closes that specific gap by encrypting the SNI field too. Support is still patchy across browsers and servers as of 2026, so don’t assume it’s protecting you by default.

On top of DNS and SNI, your ISP also sees connection-level metadata regardless of encryption: source and destination IP addresses, packet timing, and data volume. That’s enough to distinguish a video call from a file download from background app syncing, even without decrypting anything. Some ISPs also run deep packet inspection hardware that can classify traffic types (streaming, gaming, torrenting) by pattern-matching packet size and timing, not by reading content.

why it matters

A few concrete reasons this is worth caring about, not just knowing:

data monetization: ISPs in many markets have historically sold or shared aggregated browsing and location data with advertisers and data brokers. The US FTC’s 2021 staff report on major ISPs documented exactly this practice across six large providers, including data used for targeted advertising well beyond what most subscribers realized they’d agreed to.
traffic shaping: an ISP that can classify your traffic type can also throttle it, deliberately slowing streaming or peer-to-peer traffic during peak hours while leaving other traffic untouched. This is legal in some jurisdictions and restricted in others, and policy shifts over time, so check current local rules rather than assuming.
legal exposure: your ISP’s logs are a standard target for subpoenas and law enforcement requests. What gets retained, for how long, and under what legal threshold varies by country. This is not legal advice, just a reason to know your provider’s actual data retention policy rather than guessing.
account and behavior profiling: even without content, a long-term log of which domains you connect to, when, and for how long builds a surprisingly detailed profile: your sleep schedule, your employer’s VPN endpoint, your banking app, your medical provider, your dating app usage. None of that requires reading a single packet’s payload.

common misconceptions

“HTTPS means my ISP can’t see anything.” Wrong. It can’t read page content, but it usually still sees the domain via DNS and, on older TLS setups, via SNI, plus timing and volume for every connection.
“A VPN makes me anonymous.” Not quite. A VPN moves the visibility from your ISP to the VPN provider instead of eliminating it. You’re trusting a different company with the same metadata, so their logging policy and jurisdiction matter as much as your ISP’s did.
“Incognito or private browsing hides my activity from my ISP.” No. Private browsing modes only stop your browser from saving local history and cookies on your device. They do nothing to what leaves your device on the network.
“My ISP needs a warrant to look at my traffic.” This depends entirely on jurisdiction and what “look at” means. Real-time interception typically has a higher legal bar than accessing stored logs, and retention rules differ by country. Don’t assume protections that may not exist where you actually live; if this matters to your situation, check your local telecom regulator’s rules rather than relying on general assumptions, and this isn’t legal advice.

where to go from here

A few natural next steps if you want to actually reduce what your ISP sees, rather than just understand it:

switch your DNS resolver to one that supports DNS-over-HTTPS or DNS-over-TLS, which encrypts your domain lookups in transit. Mozilla has a plain-language explainer on how DNS-over-HTTPS works in Firefox that’s a reasonable starting point even if you use a different browser.
read our piece on what browser fingerprinting is and how to reduce it, since ISP-level visibility and fingerprinting attack two different layers of the same privacy problem, and most people who fix one forget the other.
if you’re evaluating whether a VPN is worth it for your situation, our guide on what a VPN actually does and when you need one walks through the tradeoffs instead of just repeating marketing claims.
account security is a related but separate concern from network visibility. Our explainer on passkeys and whether you should switch covers that side of things.
if you’re deep enough into this to be thinking about how your browser identity looks to sites and networks together, antidetectreview.org covers browser isolation and anti-detect tooling in more technical depth than we go into here.

You can browse everything else we’ve written on this topic on the blog index.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-08-22.