Your Internet Provider Sees Everything You Do Online — Here's What They Collect

Bottom line: Since 2017, US law allows internet providers to collect your browsing data and sell it without your consent. A VPN is the only tool that prevents this at the network level — encrypting your traffic before it reaches your ISP. ZoogVPN costs under $5/month and covers 150+ countries.

---

In March 2017, the US Congress voted 215–205 to repeal FCC privacy rules that would have required your internet provider to get your permission before selling your browsing history. The vote broke almost entirely along party lines. President Trump signed the repeal weeks later.

That decision has been law for nearly a decade. This is not a hypothetical risk. It is the operating environment your internet traffic travels through every day.

What Your ISP Can Actually See

People often assume HTTPS protects them. It protects the contents of pages — your passwords, form submissions, and page text are encrypted. But HTTPS does not hide:

• Every domain you visit — webmd.com, aa.org, reddit.com/r/anything — visible in DNS queries and connection metadata
• The timing and frequency of your visits — how often you visit a site and when
• The volume of data transferred — enough to infer what kind of content you accessed
• Your IP address — which can be correlated with your physical location
• Server Name Indication (SNI) — a component of the HTTPS handshake that reveals the specific domain even on encrypted connections

This means your ISP sees not just that you went online — it sees a detailed map of your health concerns, financial questions, relationship struggles, political interests, and personal vulnerabilities. All of it, timestamped and linked to your name and address.

What ISPs Do With That Data

AT&T ran a program called “Internet Preferences” that offered customers a $29/month discount on their internet bill in exchange for consent to use browsing data for targeted advertising. (The program has since been discontinued, but the precedent stands.)

Verizon was fined $1.35 million by the FCC in 2016 for inserting undisclosed “supercookies” into its customers’ mobile traffic — tracking codes that couldn’t be cleared like regular cookies, enabling advertisers to track users across browsers and apps. Verizon discontinued the practice but paid no admission of wrongdoing.

Major ISPs including Comcast, AT&T, Verizon, and T-Mobile have acknowledged in earnings calls and investor documents that data monetization is a component of their business model.

What Doesn’t Protect You (And What Does)

Browser privacy mode: Incognito does not hide traffic from your ISP. It only prevents your browser from storing local history. Your ISP sees incognito traffic identically to regular traffic.

HTTPS: As explained above, encrypts content, not metadata. Your ISP still sees every domain you connect to.

Your router’s firewall: Protects against inbound attacks, irrelevant to ISP data collection.

A VPN: The only tool that encrypts your traffic before it reaches your ISP. When you connect through a VPN, your ISP sees one thing: an encrypted connection to a VPN server. They cannot see what you do after that.

Can my internet provider see what I do online?

Yes. Without a VPN, your ISP sees every domain you visit, the timing and volume of your traffic, and your IP address. Since 2017, US law allows ISPs to sell this data without your consent. HTTPS protects content, not domain-level metadata — your ISP still sees which sites you visit.

The One-Sentence Case for a VPN

Your ISP is a for-profit company with legal access to your complete browsing history, no opt-out requirement, and financial incentive to monetize that data. A VPN costs $4–5/month and closes that window entirely.

Our best VPN roundup covers the five VPNs that passed 30 days of testing for speed, no-logs verification, and kill switch reliability. ZoogVPN ($4.99/month, 150+ countries) is the best-value pick for most users. For a plain-English explanation of what a VPN actually does at the technical level — how the encryption, IP masking, and ISP blocking work — see how a VPN works.