How Your ISP Tracks You — and What a VPN Actually Fixes
Your ISP sits between you and the whole internet, giving it a view no app has - and HTTPS doesn't hide the metadata (which sites, when, how much). What your ISP can actually see, the new Wi-Fi-sensing router angle, and where a VPN genuinely helps (and honestly where it doesn't).
Table of contents
When people worry about being tracked online, they usually picture Google, Meta or the apps on their phone. But there's one company with a vantage point none of those have: your internet service provider. Your ISP sits between you and the entire internet — every site, app and service you reach passes through it. That position gives it a kind of visibility no single website or app can match. Here's what your ISP can actually see, why HTTPS doesn't fully protect you, and where a VPN genuinely helps (and where it doesn't).
What your ISP can see
The common assumption is "everything's HTTPS now, so I'm fine." HTTPS does encrypt the contents of what you send and receive — the actual page text, messages, passwords. But it leaves the metadata exposed, and metadata is remarkably revealing:
- Which domains you visit — your ISP can see you connected to a bank, a health site, a dating app, even if it can't read the pages.
- When and how long you're connected, and how much data you move.
Stitch those together over weeks and you get a detailed map of someone's life — routines, interests, worries — without ever decrypting a single page. And this isn't hypothetical: a 2021 FTC staff report found that several major US ISPs combined data across their services to build detailed customer profiles for advertising. If you want the fuller picture of what encryption does and doesn't cover, our explainer on what a VPN actually hides is a good companion.
The newer angle: your ISP's router may be watching the room
There's a less-discussed development worth knowing about. Some ISP-provided routers now include Wi-Fi sensing — technology that can detect movement inside your home by measuring disturbances in the Wi-Fi signal. Because providers often control the firmware on the router they rent you, they also control which features get switched on over time. It's a reminder that the box in your hallway isn't neutral hardware — it's the provider's device on your network.
Where a VPN genuinely helps
This is the specific layer a VPN is built for. When you connect through a VPN, your traffic is encrypted between your device and the VPN server, so your ISP can no longer see which sites you're visiting — only that you're connected to a VPN. The revealing metadata map goes dark.
The important nuance: a VPN moves your trust from your ISP to your VPN provider. So the provider you pick matters enormously — you want one that's independently audited, genuinely no-logs, and transparent about its jurisdiction (our guide on how to read a VPN privacy policy helps you judge). This is where Proton VPN stands out: it's Swiss-based, open-source, independently audited and operates a strict no-logs policy — and it builds in NetShield, a DNS-level filter that blocks ads, trackers and malware at the network layer, which we covered in our look at Proton VPN and NetShield.
Where a VPN does not help — the honest part
A VPN addresses the ISP and network layer. It does not make you anonymous or stop other kinds of tracking:
- Websites and apps still track you through cookies, browser fingerprinting, and — most of all — your logged-in accounts. Signed into Google or Facebook, a VPN doesn't hide your activity from them.
- Your VPN provider can see what your ISP used to — hence the no-logs, audited requirement above.
For the full list of what a VPN can't do, our VPN myths guide is worth reading before you assume it's a privacy cure-all. The realistic model is layers: a VPN for the ISP/network layer, tracker-blocking (like NetShield) for the DNS layer, and privacy-respecting apps and accounts for everything above that.
Bottom line
Your ISP has a genuinely unique view of your online life — the map of where you go, when, and for how long — and HTTPS doesn't hide it. A trustworthy VPN closes exactly that gap, which is why it's the right tool for the ISP layer specifically. Just go in clear-eyed: it hides you from your provider, not from accounts you're logged into, so choose an audited no-logs provider and pair it with good habits. If you want one that covers the network layer and blocks trackers in the same app, Proton VPN is a strong pick — see our full Proton VPN review for the details, or compare it in our best VPN services in 2026 roundup.
Sources: FTC (2021 staff report on ISP data collection), Proton. A VPN protects the ISP/network layer; it does not stop account-based or in-browser tracking.
