Can Your ISP See What You Do When You Use a VPN?

The short answer

Your internet service provider (ISP) carries every packet that leaves your home. That's what makes it such a good observer. Turn on a VPN, and the picture changes. Your device wraps its traffic in an encrypted tunnel and sends it to a VPN server. Your ISP still carries the tunnel, but it can't read inside it.

So your ISP can still tell that you're using a VPN, which VPN server you're connected to, when you connect and roughly how much data you move. It can't see the websites, apps or content inside the tunnel, as long as the VPN is working properly.

That last condition matters. Leaks, misconfigured apps and traffic that skips the tunnel can all put some of your activity back in your ISP's view. And whatever your ISP stops seeing, your VPN provider can now see. Both points are covered below.

What your ISP sees, with and without a VPN

Here's the ISP's view in three situations: a plain unencrypted website, a normal HTTPS website, and anything you do with a VPN on.

Based on how DNS, HTTPS and VPN tunnels work, as described in the Cloudflare reference listed in Sources. Some VPN apps try to disguise VPN traffic; see obfuscated servers explained.

Notice the bottom two rows. A VPN doesn't make you invisible to your ISP. It still knows who you are, because you pay it. It still sees your connection is busy at 2 a.m. It just can't see what you're doing.

HTTPS already hides a lot. Here's what it doesn't

Most websites now use HTTPS. The Federal Trade Commission's public Wi-Fi guidance makes the same point: most sites now encrypt traffic, so a snoop on the network can't read what you send. That includes your ISP. With HTTPS, your ISP can't see the article you're reading, what you typed into a search box or your password.

But HTTPS has two gaps that matter for this question:

• DNS lookups. Before your browser connects to a site, it asks a DNS server to translate the name into an IP address. Cloudflare's explainer notes that standard DNS isn't encrypted, so anyone watching the network can see which domains you look up. By default, that DNS server is often your ISP's.
• The site name in the handshake. When a secure connection starts, your browser names the site it wants. This is called Server Name Indication (SNI). Cloudflare explains that it's sent in the first message of the handshake, so an observer can read the hostname even though everything after it is encrypted. A newer extension, Encrypted Client Hello, is designed to hide that first message, but support depends on the browser and the site.

So the honest version is this. HTTPS already protects what you do on a site. A VPN mainly adds protection for which sites you visit and which IP addresses you talk to, as seen from your ISP or the local network.

DNS leaks: how your ISP gets your lookups back

A VPN is supposed to send your DNS lookups through the tunnel to a resolver the VPN runs or chooses. A DNS leak happens when lookups slip out to your ISP's resolver instead. The sites themselves stay encrypted, but your ISP gets a neat list of every domain you looked up. That's exactly what you were trying to hide.

Leaks tend to come from operating system settings, a second network adapter, IPv6 traffic the VPN doesn't handle, or a moment between disconnect and reconnect. Our guide to DNS leaks, IPv6 leaks and kill switches goes deeper. The quick routine:

1. Note which DNS servers a leak-test site shows with the VPN off. You'll usually see your ISP's name.
2. Connect the VPN and run the same test. You should see the VPN's servers, not your ISP's.
3. Repeat on each device and network you actually use, including your phone on mobile data.
4. Turn on the VPN's kill switch and any "use VPN DNS" or leak-protection setting the app offers.
5. Test again after big operating system updates or VPN app updates.

Your VPN provider now sees what your ISP used to

This is the part VPN ads skip. A VPN doesn't make your traffic disappear. It reroutes it. The VPN server decrypts your tunnel and sends your requests on to the internet. So the VPN company sits where your ISP used to: it can see the IP addresses you connect to and, if it handles your DNS, the domains you look up.

HTTPS still protects page content from the VPN, just as it did from your ISP. But the domain-level view moves to the VPN provider. Whether that's an improvement depends on who you trust more.

That's why the provider's logging policy matters more than its marketing. A "no-logs" promise is only a promise unless someone checks it. Our no-logs explainer covers what an audit can prove and what it can't.

What US ISPs are allowed to collect or sell

This is the context for why many people ask the question in the first place. Two facts are worth knowing.

The FCC's broadband privacy rule was voided. In late 2016 the Federal Communications Commission published a rule called "Protecting the Privacy of Customers of Broadband and Other Telecommunications Services." In April 2017 Congress passed, and the President signed, a resolution under the Congressional Review Act disapproving that rule. The public law says the rule "shall have no force or effect." We found no replacement federal broadband privacy rule when we checked on October 31, 2026, so check the FCC's site for any change.

The FTC has documented what ISPs collect. In October 2021, FTC staff published a report on six large ISPs. According to the FTC's announcement, it found these companies collect more data than many consumers expect, including access to their internet traffic and real-time location data. It found some combined personal, app-usage and browsing data to target ads. The report also found that several ISPs promised not to sell personal data but still let others use, transfer and monetize it. It said the choices ISPs offer are often hard to use.

Shifting trust? Pick an audited provider

If the goal is keeping your browsing away from your ISP, the VPN you choose will see that traffic instead. So start with providers that have let an outside firm check their no-logs claims. Two we cover often have published audit results on their own sites:

Some links on this page are affiliate links; we may earn a commission at no extra cost to you.

• NordVPN says Deloitte Lithuania completed its sixth no-logs assurance engagement under the ISAE 3000 standard, carried out from November 10 to December 12, 2025, and concluded its systems match its no-logs statement. NordVPN says the full report is available to customers who log in. NordVPN — see current pricing
• Surfshark announced in June 2025 that Deloitte had completed an ISAE 3000 assurance engagement and found it doesn't monitor or log users' online activity. Surfshark — see current pricing

Keep the limits in mind. These are point-in-time checks, read here from the providers' own announcements. An audit tells you how systems were set up when the auditor looked, not what happens every day after. Our audited no-logs VPN roundup compares more providers.

What a VPN doesn't hide from anyone

Hiding your browsing from your ISP is a narrow benefit. It's real, but it isn't the same as privacy everywhere. With a VPN on:

• Sites you log in to still know it's you. Google, Facebook and your bank see your account, not your ISP.
• Cookies, browser fingerprinting and ad trackers keep working. See why a VPN doesn't fully hide your location from Google.
• Your ISP still knows your name, address and when you're online.
• Apps or devices that skip the tunnel, through split tunneling or a TV that isn't on the VPN, are still visible to your ISP the normal way.

If your real goal is "my ISP shouldn't build an ad profile from my browsing," a well-configured VPN with no leaks does that job. If your goal is broader, read do you actually need a VPN first, and decide which problem you're actually solving.

VPN Review is independent desk research. We read provider documentation, published audits, government sources and third-party references; we do not run our own lab. Nothing here is legal advice. Features, policies and laws change, so confirm on the original source before you rely on them.