How much of my browsing activity is visible to my internet service provider? Can they see the exact pages or communities I visit, or only the general website? I'm also wondering whether using the website versus a mobile app changes anything, and how DNS or HTTPS encryption affects what they can learn.
3 Answers
DNS can reveal the domain you look up if you use your provider’s DNS service, though it still usually won’t reveal the full URL. Encrypted DNS can hide those lookups from the provider, but it doesn’t make you invisible: they may still infer the service from the destination IP address and other connection details. Some connection metadata, such as the hostname during TLS setup, can also be exposed depending on the technologies in use.
An ISP could theoretically collect or analyze a lot of traffic metadata, but HTTPS prevents routine inspection of the page contents. They generally aren’t decrypting everyone’s connections; without access to the encryption keys or the device itself, seeing the exact pages would be difficult. A VPN can hide your destinations from the ISP, but then the VPN provider becomes the party you have to trust.
With a normal HTTPS connection, your provider can usually see that you connected to a particular website, along with metadata such as timing and data volume, but not the exact page, search terms, or content you viewed. The same general principle applies to most apps that properly use encryption.
App traffic is normally encrypted too, but that depends on the app being configured correctly. Encryption isn’t an absolute guarantee for every connection.