What Your ISP Can See About Your Traffic in 2026

Your ISP cannot read the contents of your HTTPS traffic. What they can still see is more than most people realize: which servers you connect to, when, how much data moves in each direction, and, on most connections, which domain you are visiting. Fixing the content leak is automatic in 2026. Fixing the metadata leaks takes deliberate steps.

The Myth: "HTTPS Means My ISP Can't See Where I Go"

HTTPS encrypts the content of your connection, not the address. When you load a web page, your browser opens a TLS connection. The ISP sees the destination IP address and port. On most connections they also see the domain name in the TLS handshake's Server Name Indication (SNI) field, which travels in plaintext even over TLS 1.3. And before your browser even opens that TLS connection, your device typically sends a DNS query in plaintext to look up the IP address of the domain.

So a default home broadband session leaks two things reliably: your DNS queries and the SNI field. The content of what you read, write, or watch is encrypted. The map of where you went is not.

What HTTPS Actually Hides

Over 99 percent of Chrome browsing time now happens over HTTPS, according to Google's 2025 security data. On those connections, your ISP genuinely cannot see:

• The specific page or path on a website (the URL after the domain)
• The content of messages, emails, or form submissions
• Search query text on Google, Bing, or DuckDuckGo
• Video titles or watch history on YouTube or Netflix
• The body of files you upload or download

What they can see even on a fully HTTPS session:

• The IP address of the server you connected to
• The domain name via the SNI field (on most connections in 2026)
• The volume of data transferred in each direction
• Connection timing and duration

The difference between "can't see content" and "can't see destination" matters enormously. Knowing you loaded mail.google.com at 7:02 AM and then accessed your company's HR portal for 40 minutes says a lot without reading a single byte of payload.

You can check your current public IP at My IP Address, and verify what your DNS queries reveal at our DNS Leak Test.

DNS: The Clearest View Into Your Browsing

Classic DNS is the biggest privacy hole remaining after HTTPS. When you type any domain into your browser, your device first asks a DNS resolver for the IP address. By default, that query travels in plaintext over UDP port 53. Your ISP either runs the resolver directly or sees the query pass through their network to a third-party resolver like 8.8.8.8 or 1.1.1.1.

The result: even when the page content is fully encrypted, your ISP can log every domain you look up. They may not know which YouTube video you watched, but they know you visited YouTube, your bank, a job listings site, and a competitor's website, in what order, and at what times.

Two protocols close this gap:

• DNS over HTTPS (DoH) wraps DNS queries inside an HTTPS connection on port 443, making them look like ordinary web traffic
• DNS over TLS (DoT) uses a dedicated TLS connection on port 853

Firefox has enabled DoH by default for US users since 2020. Chrome switched on DoH by default in 2020 as well. iOS and Android both support encrypted DNS at the system level. Still, encrypted DNS is not universal: many routers, smart devices, and apps bypass the browser's DoH setting and send plaintext DNS directly.

For a deeper walkthrough on setting this up, see our guide to DNS over HTTPS. Then verify nothing is leaking with our DNS Leak Test.

SNI: The Hostname Leak Inside TLS

Even after DNS is encrypted, the TLS handshake itself exposes your destination on most connections. The SNI field in the ClientHello message tells the server which domain name is being requested, so that servers hosting multiple domains on one IP address can return the right certificate. This field has traveled in plaintext since SNI was introduced.

Encrypted Client Hello (ECH), standardized as RFC 9849 in early 2026, fixes this by encrypting the entire ClientHello including the SNI. Firefox has supported ECH since version 119. Chromium has graduated ECH from a flag to a default feature. Cloudflare enables ECH on free zones by default, and OpenSSL 4.0 (released spring 2026) added native ECH support for server operators.

The catch is that ECH requires the server to publish an ECH configuration in its DNS records (specifically an HTTPS or SVCB resource record), and it requires the DNS query itself to be encrypted so the ECH config doesn't leak. In practice, most websites outside Cloudflare's network still serve connections with cleartext SNI. Even on an ECH-capable browser, you will see ECH active on a minority of sites in 2026.

In my testing with Firefox and Cloudflare's ECH checker, sites served through Cloudflare's CDN showed ECH working correctly, while the majority of independently hosted sites fell back to cleartext SNI. The technology is real and growing, but "your ISP can no longer see the hostname" is not yet the default reality.

Traffic Metadata: What Patterns Reveal

Even with HTTPS and encrypted DNS working together, your ISP still observes connection metadata: destination IPs, data volume, and timing patterns. This metadata is more revealing than people expect.

A 2 GB transfer from a Netflix CDN at 8:30 PM correlates with a movie. Sustained 1 Mbps to Zoom servers during weekday afternoons correlates with work calls. Bursts of small packets to messaging servers correlate with active conversations. Academic research published at the 2024 ACM Internet Measurement Conference shows that traffic patterns can identify which streaming platform you are using just from encrypted traffic shapes, even without knowing the content.

A VPN addresses this. Once you connect to a VPN, your ISP sees one destination (the VPN server) and one opaque encrypted stream. They cannot distinguish Netflix, Zoom, or anything else inside it. The trade-off is that the VPN provider gains the visibility your ISP lost. That is why provider choice matters: a VPN that logs your traffic simply relocates the observer, not the observation. Verify your tunnel is working correctly with our VPN Leak Test.

The Myth: "VPN Traffic Is Private to My ISP"

Your ISP can tell you are using a VPN, even if they cannot see inside it. Most VPN protocols have recognizable signatures. Research published in the Communications of the ACM shows that OpenVPN connections can be fingerprinted with high accuracy within 30 seconds. WireGuard uses a fixed UDP header structure that deep-packet inspection systems can identify. In 2026, ISPs and content networks that want to detect VPNs can do so reliably for common protocols.

Obfuscated VPN modes address this by wrapping traffic in HTTPS-like transports. This works but adds overhead and reduces speed. For most home users on a liberal ISP, VPN fingerprinting results in throttling or targeted surveillance, not blocking. In restrictive network environments, obfuscation becomes more important. See VPN Protocols: WireGuard, OpenVPN, and IKEv2 for a comparison.

WebRTC can also leak your real IP address to websites even when a VPN is active. Learn how that works at WebRTC Leak Explained.

What ISPs Log and for How Long

Retention requirements vary by jurisdiction:

What is typically logged includes: subscriber identity, IP address assignments and timestamps, connection metadata (source, destination, port, bytes transferred), and DNS queries when the ISP runs the resolver. Full packet captures are generally not kept for consumer traffic, because the storage cost is prohibitive at scale. Encrypted payload contents are not logged because the ISP cannot read them.

"Not logged by default" is not the same as "cannot be logged." A court order or lawful interception requirement can compel deeper collection on specific accounts.

Can ISPs Use Your Data for Advertising?

This depends entirely on where you live, and the answer in the US is more permissive than most people know. In 2017, the US Congress voted to repeal FCC broadband privacy rules that would have required ISPs to obtain explicit consent before using subscriber data for ad targeting. Major carriers deny selling individual browsing history as a product, but they can and do use behavioral data for their own advertising programs, and they can share data with affiliates.

In the European Union, GDPR makes monetizing subscriber browsing history without explicit consent effectively impossible. EU ISPs do not generally run ad-targeting businesses against traffic data.

To understand what data your ISP may have about you, check their privacy settings page and search for terms like "Cross-Context Behavioral Advertising" or "Customer Proprietary Network Information."

The Exception: Managed Devices and Corporate Networks

If your employer or school issues your device or installs a trusted root certificate, HTTPS no longer guarantees content privacy on that network. Organizations can deploy TLS-inspecting proxies that decrypt your HTTPS traffic, inspect it, then re-encrypt and forward it. Browsers usually display a non-public certificate authority in the connection details when this is happening.

To check: click the padlock in your browser's address bar and inspect the certificate chain. If the issuer is your employer's name rather than a public CA like Let's Encrypt or DigiCert, your traffic is being inspected at the network level.

This does not apply to standard home ISP connections. Your ISP cannot install a trusted root certificate on your personal device without your cooperation, so they have no path to decrypt your HTTPS traffic.

Practical Steps to Close the Gaps

1. Enable encrypted DNS. DoH or DoT in your browser or operating system closes the largest metadata leak remaining after HTTPS. Check your work with our DNS Leak Test.
2. Verify ECH is active on sites you care about. Cloudflare's ECH checker at cloudflare.com/ssl/encrypted-sni shows whether ECH, DoH, and TLS 1.3 are all working together. For sites not on a CDN that supports ECH, your ISP still sees the hostname via SNI.
3. Use a reputable no-logs VPN for sensitive sessions. This collapses what your ISP observes into a single encrypted stream to one server. See how to hide your IP address for options.
4. Audit for DNS leaks after any configuration change. Our DNS Leak Test shows which resolver your queries actually reach.
5. On managed devices, assume HTTPS inspection. Check the certificate chain before submitting anything sensitive on an employer or school network.

FAQ

Can my ISP see which websites I visit if I use HTTPS?

Your ISP cannot read the content of HTTPS pages, but on most connections they can still see the domain name through the SNI field in the TLS handshake. DNS queries also expose every domain you look up unless you enable DNS over HTTPS or DNS over TLS. So yes, they typically see destinations, even without seeing content.

Does incognito mode hide my browsing from my ISP?

No. Incognito (or private browsing) prevents your browser from storing local history. It does nothing to encrypt your traffic or hide destinations from your ISP. Your DNS queries, SNI field, and connection metadata are all visible to your provider whether or not incognito is active. See also does incognito hide your location.

What is the SNI field and why does it leak my browsing?

SNI stands for Server Name Indication. It is a field in the TLS ClientHello message that tells the server which domain name the browser is connecting to. Without it, servers hosting multiple domains on one IP address would not know which certificate to present. The field travels in plaintext in standard TLS, so network observers including your ISP can read it. Encrypted Client Hello (ECH) encrypts this field, but is only active when both the server and browser support it.

Does a VPN completely hide my traffic from my ISP?

A VPN hides the content and destinations of your traffic. Your ISP sees only one destination, the VPN server, and an opaque encrypted stream. However, your ISP can usually detect that you are using a VPN based on traffic patterns and protocol signatures, even if they cannot see inside the tunnel. They also continue to see how much data you transfer and when.

How long does my ISP keep records of my internet activity?

Retention rules vary by country. Australia mandates two years for metadata. The UK requires approximately twelve months under the Investigatory Powers Act. The US has no federal mandate, and practices vary by provider. The EU has no harmonized rule since the CJEU struck down the Data Retention Directive in 2014. In all cases, records typically include connection metadata, not encrypted content.

What is DNS over HTTPS and does my browser use it automatically?

DNS over HTTPS (DoH) wraps DNS queries inside HTTPS so your ISP cannot see them in plaintext. Firefox has enabled DoH by default for US users since 2020, and Chrome turned it on by default around the same time. However, many apps and devices bypass the browser's DoH setting. Our DNS Leak Test shows whether your DNS queries are actually encrypted, and our DNS over HTTPS guide walks through setup for browsers and operating systems.

Sources

• https://transparencyreport.google.com/https/overview
• https://datatracker.ietf.org/doc/rfc9849/
• https://developers.cloudflare.com/ssl/edge-certificates/ech/
• https://support.mozilla.org/en-US/kb/understand-encrypted-client-hello
• https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/data-retention-obligations
• https://openssl-library.org/post/2026-03-11-ech/