Can Your ISP See What You Do With a VPN?

What your ISP sees without a VPN

Every destination you reach is a request your provider routes for you, so it sees the domains you look up, the addresses you connect to, and — in a normal HTTPS connection — the hostname sent during the handshake, before the encrypted part starts.

It also sees timing and volume: when you are online, how long a session runs, and roughly what kind of traffic it is. That record is the reason retention and monetization rules vary so much between countries, and the reason a tunnel is more than a technicality.

What it sees once you connect

One destination: your VPN server, for as long as the tunnel is up. The DNS lookups travel inside it, the destinations are inside it, and the content is encrypted before it reaches your provider at all.

So the browsing history it could have kept becomes a single line — connected to this server, at these times, transferring this much — and the sites behind the tunnel are simply not part of its view any more.

What can still be inferred

Volume and timing survive the tunnel. A sustained forty-megabit stream for two hours looks different from fifteen minutes of light browsing, and patterns like that can be matched against what is publicly known about a person's day. This is traffic analysis, not reading, and it is limited.

Your provider can also usually tell that you are using a VPN. The protocol has signatures, the destination belongs to a hosting company, and some networks deliberately recognize and throttle or block VPN endpoints — a practice more common on restricted networks than on ordinary home broadband.

Whether any of this is acted on depends on where you are. Ordinary home broadband providers rarely inspect traffic beyond capacity management; networks that filter content do, and they can often identify a tunnel without reading it. Knowing which kind of network you are on settles how much of this matters.

Does a VPN stop your ISP throttling you?

It stops destination-based throttling, because your provider no longer knows which service you are using — it cannot single out streaming or torrenting it cannot identify.

It does not stop a general speed cap, congestion in your local network, or a plan that limits how much you transfer. Data caps still count with a VPN on: your provider measures bytes at the line, and the tunnel does not make them invisible, only unlabeled.

How this fits the rest of your privacy

Removing your internet provider from the destination picture is half the job; the other half is who the tunnel now belongs to. The VPN provider sees what your ISP no longer does, which is why our privacy component is built around what that provider has committed to and what an auditor has verified: How we test.

If you are weighing which provider to trust with that role, the comparison scores all eleven on exactly those terms: Compare. The wider question of what a VPN buys you overall is covered separately: what a VPN actually protects you from.

DNS with and without a tunnel

Encrypted DNS is the other half of the story. Without it, every name you look up goes to a resolver — usually your provider's — in a form it can read and keep, even when the connection to the site itself is encrypted.

Sending DNS over HTTPS or TLS to someone else's resolver hides the names from your provider, and it is a real improvement. It does not hide the addresses your device then connects to, and the resolver you chose keeps the log instead. A VPN carries both halves inside the tunnel, which is why it closes the record rather than moving it.

How long any of it is kept

Retention rules differ by country: some require internet providers to keep connection records for a fixed period, some allow them to keep what they collect for as long as they like, and some limit collection in the first place. The rules that apply to you are the ones in the country your traffic physically crosses.

This is also where the choice of tunnel matters again. What never gets recorded cannot be retained, produced or leaked — and that is the reasoning behind the privacy weighting in our comparison, thirty percent of every score we publish: How we test.