Every website you visit, every video you stream and every application you use sends data through your internet service provider. At home yours will most likely be your broadband internet provider. On the move it will be your mobile internet provider. When you are on location such as in a hotel, airport or cafe your data will pass through the operator that controls that local network.
So can your internet provider see your history? The honest answer to whether your internet service provider can see what you do online is actually more complicated than a simple yes or no answer. Due to encryption technology most of the data that passes between your device and secure websites cannot be read by your internet service provider. However, they can see information about your connection such as when you connect to the internet, how much data you send and what servers your device connects to.
A VPN will hide more of this information from your provider but will not make you invisible online. Instead, it will change who sees parts of your connection and introduce another party that you must trust. Here is exactly what your provider can see, what a VPN hides, and what stays visible either way.
How your internet connection normally works
Without a VPN, your device is connecting to the internet through your internet service provider, usually shortened to ISP.
When you type a website address into your device, it usually starts with a Domain Name System request. DNS works like a directory, turning an easy to remember address such as example.com into the numerical address that computers use to communicate with each other. Finally, your device can connect to the website and exchange information with it.
Since the ISP provides the internet connection for your device, they are able to observe some aspects of your device's connection to the internet. How much of your connection they can view depends on whether the site uses HTTPS, whether DNS requests are encrypted, and which newer privacy technologies are supported at both ends.
What your provider can usually see without a VPN
Who you are, and the address you were given
Your provider normally knows who holds the account. Your provider may have your name, billing details, registered address and service history for the account. Additionally, they will assign your connection a public IP address, which may change periodically or may be fixed.
Since your provider can link an address to the subscriber of the account during a given period, the length of time that their records are kept and how they can be shared will depend on the laws of the country you are in.
When you connect, and for how long
Your provider can view when your connection becomes active, how long it stays active, and when data from your connection moves. While the information can be encrypted for security, that does not conceal that a connection exists, when it happened or how big it was.
How much data you use
Your provider will be able to keep records of how much data went up and down. They will be able to detect if your device moved several gigabytes of data without seeing the content that was moving. However, they will not be able to see the specific content being shared, only the volume of that content.
The addresses you connect to
Without using a VPN, the provider can generally see the destination addresses your device contacts. An address does not necessarily reveal the identity of the website that is being accessed, as hosting companies, content delivery networks and cloud platforms put many sites behind shared infrastructure. However, the address can reveal the identity of the service and hosting company that is being contacted.
Your DNS lookups, in some situations
Traditional DNS requests are not encrypted. When the requests are made to the DNS resolver that is provided by the internet service provider, the provider can see the domain names that your device is accessing.
Using encrypted DNS services, such as DNS over HTTPS, DNS over TLS or DNS over QUIC, reduces that ability of the provider to view your device's activity. These protocols all encapsulate the DNS request in another type of connection that the provider cannot view. However, none of these services hide the destination address of the server that your device is contacting: the provider can still see that address.
What HTTPS already hides
HTTPS ensures that the connection between your browser or app and the website's server is encrypted. The transport layer security protocol (TLS) 1.3, one of the main protocols behind modern HTTPS, ensures that the application data is protected with authenticated encryption, meaning that a provider of the connection should not be able to read the information within the connection.
When HTTPS is working properly, your provider generally cannot read:
- The messages you send through a secure service
- Passwords you type into a website
- Payment details submitted on an encrypted page
- The full text of articles you read
- The exact terms you type into a secure search engine
- The specific page path after the domain
- Files uploaded or downloaded inside the encrypted session
For example, they might be able to work out that your device has connected to an online shop. However, they should not be able to see the item in your basket, your card number or the exact page you looked at.
Can your provider see which websites you visit?
Sometimes your provider can work out the exact domain. Sometimes they can only make an informed guess.
There are two ways the domain can leak. One is through an unencrypted DNS request for the site you are trying to visit. The other is through Server Name Indication, which is part of the TLS handshake. For years the field contained the name of the server you were requesting in cleartext.
Encrypted Client Hello was introduced as a means of closing that gap. It will encrypt the part of the TLS handshake that contained the server name in cleartext. When encrypted DNS, Encrypted Client Hello and shared hosting are all in play, it becomes very difficult for an ISP to determine which exact website you are accessing. The problem is that encryption support is not universal, and timing and message size patterns can still be analysed.
The safe assumption is that your provider may be able to identify at least some of the services you use, even when it cannot read what you do inside them.
What changes when you use a VPN
A VPN creates an encrypted tunnel between your device and a VPN server. When you connect to a VPN server, your device does not have to create separate connections to the websites and services that you would like to access. Instead, your device sends encrypted traffic to the VPN server, which then communicates with the rest of the internet on your behalf.
Standards bodies describe this in similar terms. NIST documents IPsec as a framework for protecting private communications across IP networks, and the UK's National Cyber Security Centre describes VPNs as a way to connect devices in separate locations securely.
From your provider's point of view, most of your activity now looks like one connection to a VPN server.
What a VPN hides from your provider
- The sites and services that you encounter while using the tunnel. Your provider only sees the VPN server as the destination. They do not see the individual sites that you visit.
- Your DNS lookups. These travel through the tunnel with everything else. Your provider never sees them, thus they cannot construct a list of domains that you have asked for. The only thing that would prevent this would be a DNS leak which would send your DNS requests to your provider instead.
- The contents of weakly protected traffic. Sites that are already secured by HTTPS will remain that way, with an additional layer of security provided by the VPN tunnel between your device and the VPN server. This layer of security is useful for applications that do a poor job at protecting their data traffic.
- Your usual public address, from the websites you visit. But instead of your own address, it's the address of the VPN server that the site logs. This makes it harder to associate your activity with your home or mobile address.
What your provider can still see when you use a VPN
So can your internet provider see history with a VPN switched on? Not the individual sites. A VPN does not make the connection disappear, though. Your provider can usually see the following about your connection.
- While they cannot read the content of the communication passing through the tunnel, they can see the general pattern of the connection. High volumes of data travelling through the tunnel are an indication that you are streaming videos or downloading files. This is an inference based upon the characteristics of the connection, not an identification of the activity that you are performing on your devices.
- So can your internet provider see history with a VPN switched on? Not the individual sites. A VPN does not make the connection disappear, though. Your provider can usually see the following about your connection.
- That your device is talking to a particular server
- The VPN server's address
- When the VPN connection starts and ends
- How long it stays connected
- How much data moved
The timing and size of the encrypted packets
What a VPN does not hide at all
This is where privacy claims most often become misleading. A VPN protects the route your traffic takes, but it cannot control the other ways you are identified, which is why many people wonder if a VPN hides your search history from Google or their browser. That is as true of the most used VPN on the market as it is of the smallest one.
Anything you are signed in to
For instance, if you log in to Google, YouTube, Instagram, Amazon or any other site using your account, that service will know which account you are using. While the service may see your connection through a VPN, your login will identify you to those websites. A VPN does not make account activity anonymous.
Cookies and advertising trackers
Websites store cookies in your browser to recognise you as a returning visitor, and advertising systems may recognise you across websites. Changing your address does not affect cookies that have already been stored on your browser, or stop all tracking scripts from running on your device.
Browser and device fingerprinting
Websites can see information about your screen, language, operating system, browser type and version, time zone and device capabilities. This information can be used to recognise the device that you are using. While a VPN will change your address, it will not change the browser underneath it.
Anything you type in yourself
A VPN cannot hide information that you give to a website. Information such as your name, email address, phone number, delivery address and payment details will still go to the service that you provided this information to.
Location permissions on your device
The GPS and device location information can be shared with a website separately from your address. While a VPN will change the country that is displayed to the service, it will not override the precise location that you have granted an application permission to collect.
Malware already on the device
A VPN will not protect your device if it is already compromised. Any spyware or keylogger applications will be able to access your information before it is encrypted by the VPN.
Does incognito mode hide anything from your provider?
No. Private browsing mainly controls what your own browser keeps after the session. It can stop history, cookies and some site data being retained once the private tabs close.
It will not create an encrypted tunnel between your device and the website and it will not hide your browsing from your provider, your employer, your school or the websites themselves. Mozilla states plainly that private browsing does not make you anonymous and that a provider may still gather information about the pages visited.
It is useful if you do not want the next person using the device to find your browsing session. However, it is not a substitute for a VPN.
Does the VPN provider see it instead?
A VPN changes the path of trust rather than removing the need for it. Without one, your provider carries the direct connections. With one, your provider mostly sees an encrypted tunnel, while the VPN company runs the server where your traffic exits.
That company will normally know your original address while you are connected to their network. Depending on how they have built the network and what logs they keep, they may be able to observe connection details. HTTPS does protect the contents of your connection from them. This is why the provider's policy, ownership, jurisdiction and track record matter. We publish ours on the no logs policy page, including the operational data any service inevitably holds. A reliable VPN provider will put all of that in writing rather than in a slogan.
Questions worth asking of any provider, including us:
- 1Does it record browsing activity?
- 2Does it keep connection timestamps?
- 3Does it store your original address?
- 4Are its apps independently audited?
- 5Does it run its own DNS?
- 6Does it protect against DNS and IPv6 leaks?
- 7Does it include a kill switch?
Anyone searching for the best VPN for anonymous surfing will find plenty of products willing to promise exactly that. A vague promise of complete anonymity should be treated as a warning sign, not a feature.
How leaks undo the protection
A VPN will only protect the traffic that goes through the VPN tunnel. There are, however, four common ways that traffic can escape the protection of a VPN.
- DNS leaks. Your lookups go to your provider instead of through the VPN, which hands it the list of domains you asked for.
- Split tunnelling. You can choose which applications to send outside the VPN. This is useful for maximising your connection speed and for reaching other devices on your local network. Your provider will see this traffic in the clear. Ours is explained on the Bypasser page.
- Connection drops. If your VPN disconnects, your device may revert to your normal connection without warning you first. The kill switch will prevent your device from sending data until the VPN connection is restored.
- Browser-only extensions. Some of them will protect your browser's traffic, but not anything else on your device. Email clients, cloud sync and background services will continue to use the normal connection.
It is worth knowing whether you installed a full device VPN or only a browser extension, because the answer changes what is covered.
A realistic privacy setup
No single tool will give you complete privacy. A combination of a few different tools will give you more protection than any single product could provide on its own.
- 1A VPN whose logging policy is written plainly
- 2HTTPS sites and up to date apps
- 3Encrypted DNS routed through the tunnel
- 4A kill switch, so a dropout does not quietly expose you
- 5Tracker protection and sensible browser settings
- 6Deliberate control of cookies and account logins
- 7Tight permissions for location, contacts and device data
- 8Updated operating systems and security software
- 9Multi-factor authentication on accounts that matter
- 10Awareness of local law and any workplace network policy
The goal is not to become invisible online. It is to reduce unnecessary exposure and to decide deliberately which organisations get access to which information.
The bottom line
Your internet provider does not necessarily see every message, password, page or payment. HTTPS will encrypt most of what you send to modern websites.
They can see some valuable information, however: your assigned address, times connected, how much data you use, the addresses to which you connect, and in some cases the domains or services you reach.
So does a VPN hide activity from your internet provider? It hides much of that destination information inside an encrypted tunnel. Your internet provider can see that you are using a VPN, but they should not be able to inspect the sites and DNS requests carried through it.
What a VPN does not do matters just as much. It cannot hide who you are once you sign in, remove tracking cookies, stop fingerprinting, override GPS permissions or clean up a device with spyware on it. The right way to think about it is not an invisibility switch, but a layer that limits what the local network and your provider can observe, while masking your usual address from the services you use.
