Can My ISP See What I Do When I Use a VPN?

The short answer

With a correctly working VPN, your internet provider can still see that you are connected to a VPN server, when you are connected and roughly how much data you send and receive. It should not be able to see which websites you visit or what you do on them, because that traffic travels inside an encrypted tunnel to the VPN server. The catch is that the VPN provider now sits where your ISP used to, so the question of who can see your browsing moves rather than disappears.

What your ISP sees with and without a VPN

HTTPS already hides the content of most web traffic from your ISP. What a VPN adds is hiding the destinations: which sites and services you connect to, and the DNS lookups that reveal them.

Where the gaps usually are

When an ISP can still see more than expected, the cause is almost always traffic that is not actually going through the tunnel:

• DNS outside the tunnel. If name lookups still go to your ISP's resolver, the ISP can see the domains you visit even though the page traffic is tunnelled. A DNS leak test shows which resolver answers.
• IPv6 outside the tunnel. Some VPN apps only route IPv4. If your connection also has IPv6, some traffic can bypass the VPN. See the IPv6 check.
• Split tunnelling. Apps or sites you have excluded use your normal connection by design.
• Reconnect gaps. When the VPN drops after sleep or a network change, traffic may flow normally until it reconnects. A kill switch is designed to block traffic during that gap.

You are moving trust, not removing it

Everything your ISP could previously observe about your destinations can, in principle, be observed by the VPN provider instead. That is why the provider's logging policy, ownership, the scope and date of any independent audit, and its track record matter as much as speed or server count. No browser test, including ours, can inspect a provider's logs or confirm a no-logs promise. You can only check the routing you can see and judge the policies separately.

Can an ISP block or slow VPN traffic?

An ISP or network operator can sometimes recognize VPN protocols and block or deprioritize them, and some workplace, school and public networks restrict VPN use. If a VPN will not connect on a particular network, check that network's rules first. On a network you do not control, follow its acceptable-use terms. On your own home connection, a different protocol offered by your VPN app or a provider support article for your router is the usual next step.

Common misconceptions

• "Incognito mode hides my browsing from my ISP." It does not. Private browsing only avoids saving history and cookies on your own device.
• "HTTPS means my ISP sees nothing." HTTPS protects page content, but domain names often remain visible without a VPN or encrypted DNS.
• "With a VPN, websites cannot know who I am." Signing in, cookies and the details you type identify you to a site regardless of your IP address.

How to check your own setup

1. With the VPN off, run the privacy scan and note your public IP and network operator.
2. Connect the VPN and scan again. The IP and operator should change to the VPN's.
3. Run the DNS leak test. Your ISP's resolver should not appear while the VPN is connected, unless you deliberately configured it.
4. Run the IPv6 check and compare the result with your VPN's stated IPv6 support.

Passing these checks shows that this browser's traffic is following the VPN route at that moment. It does not show what other apps on your device are doing, so repeat the checks in any app that lets you see its connection details.