# What Can Your ISP See About Your Internet Activity? Source: https://urbanx.co.za/knowledge-hub/digital-safety-privacy-account-protection/what-can-isp-see-internet-activity **Answer:** An ISP carries traffic between a customer and internet services, so it can observe operational information such as the subscriber connection, IP addresses, timing and data volume. What it can learn about destinations depends on DNS, encryption and protocol design. Proper HTTPS protects page content, passwords, messages and URL paths in transit. Technical visibility does not automatically mean the ISP records or retains everything it could observe. Part of [Digital Safety, Privacy & Account Protection](https://urbanx.co.za/knowledge-hub/digital-safety-privacy-account-protection) · 10 min read · by UrbanX Knowledge Hub **Last reviewed: 26 August 2026 · 10 min read** ### Three questions that should not be combined #### What is technically visible? The information available to equipment carrying the traffic at that moment. #### What is collected or logged? The information a specific ISP’s systems actually record for operations, security, billing or another stated purpose. #### What is retained or disclosed? How long recorded data is kept and when it may be shared under policy, contract or law. A technically visible packet attribute is not proof of a permanent browsing-history database. Equally, encryption of page content does not mean no operational metadata exists. ### What is normally visible at the connection layer? An access provider ordinarily needs enough information to route and operate a connection. This can include: - the subscriber or circuit associated with an active session; - public and network IP addresses involved; - connection start, end and timing information; - protocol and port information; - data volume; and - faults, authentication or service events generated by its own systems. This information does not necessarily reveal what a person typed, watched, bought or said inside an encrypted session. ### What HTTPS changes HTTPS uses TLS to create an authenticated, encrypted and integrity-protected channel between the browser or app and the service endpoint. For a correctly established HTTPS connection, a network observer should not be able to read: - passwords and form entries; - page text and images carried inside the protected exchange; - chat or email content carried by that service; - the URL path and query after the hostname; - session cookies; or - protected response content. TLS does not hide packet timing or length. The network still carries traffic to a destination IP address. Domain visibility can depend on how DNS is resolved, whether DNS is encrypted, whether Encrypted ClientHello is used, the destination infrastructure and other protocol details. [HTTPS Explained](/knowledge-hub/digital-safety-privacy-account-protection/https-what-it-protects) covers the transport protection without turning this article into a protocol-configuration guide. ### What DNS can reveal DNS translates a name such as `example.co.za` into an address a device can use. Traditional unencrypted DNS queries may be visible to the network and the resolver handling them. Encrypted DNS can prevent ordinary last-mile observers from reading the query, but it moves trust toward the selected resolver and does not hide every aspect of the later connection. This article does not recommend or compare DNS services. DNS performance and provider choice remain with [Competitive Security, Edge Configuration & Continuity](/knowledge-hub/competitive-security-edge-config-continuity). ### An IP address is not a complete browsing record One destination IP can host many websites, and one large service can use many addresses. Content delivery networks, shared hosting and cloud platforms make simple IP-to-site assumptions unreliable. An IP address plus timing and other metadata may still support inferences, particularly when combined with DNS or unencrypted protocol information. The careful conclusion is not “the ISP sees the exact page” or “the ISP sees nothing.” It is that encryption protects content while some routing metadata remains. ### Apps can use different connections Browsers, mobile apps, games, smart TVs and background services do not all behave identically. An app may: - connect to several analytics, advertising and content hosts; - use its own resolver or encrypted transport; - send notification traffic while not open; - identify the signed-in user to the app provider; or - store activity in its cloud account. The app provider may therefore know far more about in-app activity than the access ISP does. Website and app tracking is a separate relationship from network carriage. ### Incognito does not change ISP visibility Private browsing changes what the browser keeps locally after the session. It does not reroute traffic or remove the device’s network connection. If a person signs into a service in Incognito, the service still knows which account is active. Network visibility remains governed by the same protocols and encryption. Read [Incognito Mode: What It Hides and What It Does Not](/knowledge-hub/digital-safety-privacy-account-protection/incognito-mode-what-it-hides). ### What about a VPN? A VPN creates an encrypted tunnel from the device or router to a VPN endpoint. The access ISP can generally see that the customer is connected to the VPN infrastructure and observe timing and volume, but not the ordinary destinations inside a properly functioning tunnel. The VPN operator becomes another party in the trust model. That is not the same as complete anonymity. Accounts, cookies, browser fingerprints, payments and endpoint compromise can still identify activity. This article does not recommend VPN products or make gaming-performance claims. ### Read the provider’s actual privacy information For a specific ISP, check: - its privacy policy; - categories of information collected; - operational and security purposes; - cookie and website analytics practices; - third-party processors and sharing categories; - retention language; - data-subject rights and request process; and - information-officer or privacy contact. South Africa’s POPIA regulates the processing of personal information. It does not support vague promises that an organisation collects “nothing,” nor does it mean every operational data point is stored forever. Apply the provider’s current published policy to the specific question. ### Practical privacy habits - Prefer services that use HTTPS and do not bypass certificate warnings. - Keep browsers, apps and operating systems updated. - Review website, app and account privacy settings. - Limit unnecessary permissions and third-party integrations. - Sign out of shared devices. - Use unique authentication and MFA. - Read the service provider’s privacy policy for actual processing claims. - Treat any promise of “total invisibility” sceptically. ### Sources - [RFC 9846: The Transport Layer Security Protocol Version 1.3](https://www.rfc-editor.org/info/rfc9846/) - [Google Chrome: Browse in Incognito Mode](https://support.google.com/chrome/answer/95464) - [Mozilla: Common Myths About Private Browsing](https://support.mozilla.org/en-US/kb/common-myths-about-private-browsing) - [Cloudflare: Encrypt DNS Traffic](https://developers.cloudflare.com/1.1.1.1/encryption/) - [UrbanX Data Privacy and Security Policy](/legal/data-privacy-and-security-policy) ### Related guides - [All Digital Safety, Privacy & Account Protection guides](/knowledge-hub/digital-safety-privacy-account-protection) - [HTTPS Explained: What It Protects and What It Does Not](/knowledge-hub/digital-safety-privacy-account-protection/https-what-it-protects) - [Incognito Mode: What It Hides and What It Does Not](/knowledge-hub/digital-safety-privacy-account-protection/incognito-mode-what-it-hides) - [Competitive Security, Edge Configuration & Continuity](/knowledge-hub/competitive-security-edge-config-continuity) ## Frequently Asked Questions **Can an ISP see the full URL of an HTTPS page?** The path and query are protected inside HTTPS. Destination-related metadata may still be observable depending on DNS and transport details. **Can an ISP see what I type into a secure website?** Proper HTTPS protects form content in transit. The website itself receives what you submit, and malware or a compromised endpoint changes the risk. **Does encrypted DNS hide all browsing from an ISP?** No. It protects DNS queries from ordinary observers on that path, but later traffic still has IP addresses, timing and volume. It also changes which resolver handles the query. **Does an ISP automatically store everything it can technically see?** No conclusion can be made without the provider’s systems, policy and legal context. Technical visibility, logging and retention are separate questions. **Does a VPN make me anonymous?** No. It changes which network parties can observe destinations, but accounts, cookies, device identifiers, payments and the VPN provider still matter.