A VPN hides the contents of your internet traffic from your internet provider while that traffic travels between your device and the VPN server—but it does not make the connection invisible. Your provider can generally see that you connected to a VPN, when you connected, and how much data moved. With a functioning, correctly configured tunnel, it generally cannot read the traffic inside it or directly see the websites you visit through it.
What your ISP can see when a VPN is on
Your connection follows this path: device → ISP → VPN server → website or app. Between your device and the VPN server, the VPN encrypts the traffic into a tunnel. Your ISP carries that tunnel but ordinarily cannot decrypt the application traffic inside it. The Federal Trade Commission (FTC) describes a VPN as creating an encrypted connection between a device and a VPN provider: FTC guidance on choosing a VPN.
The tunnel still has an endpoint, so your ISP can generally observe that your connection is communicating with a VPN server. It can also see connection metadata, such as timing and data volume. Encryption hides the contents of the tunnel; it does not erase the fact that data is moving.
What happens to traffic after it leaves the VPN
The VPN server forwards your traffic to its destination. At that point, the VPN provider is an intermediary capable of handling that traffic. A VPN therefore reduces what your ISP can see, but shifts some trust to the VPN operator. The FTC cautions that a VPN app generally does not make a user entirely anonymous and that the app provider’s practices matter: FTC guidance on VPN privacy and security.
Recommended Free Tools
#1 Best Overall
This does not establish that every VPN provider logs the same information—or that a provider necessarily records your browsing. Check the specific provider’s privacy policy and how its practices are substantiated. The FTC also warns that some VPN apps may not encrypt all traffic: FTC staff report on broadband privacy practices.
VPN encryption and HTTPS protect different parts of the connection
HTTPS encrypts the connection between a browser or app and a website. Without a VPN, HTTPS generally protects the content of that exchange, but your ISP may still be able to observe destination information, such as an IP address or, in some circumstances, a domain name. The VPN adds encryption to the separate leg between your device and the VPN server. The FTC’s October 21, 2021 staff report said some of the six major U.S. providers it examined continued to store accessed IP addresses and thereby collect website domain names, even when traffic was encrypted. That study finding is specific to the providers and context examined; it does not mean every ISP can see every domain when a VPN tunnel is working correctly. Read the FTC report.
Rank #2
DNS can reveal sites if queries bypass the tunnel
DNS translates a website name into an address that devices can connect to. DNS queries are typically sent in plaintext unless protected, so parties on the network path may be able to read them. With a properly configured VPN, DNS requests should travel through the VPN tunnel, but DNS leaks, split routing, or an app’s behavior can send requests outside it. In that case, your ISP may see queries that the VPN was intended to conceal. The FTC explains the visibility risk of unencrypted DNS: FTC report on ISP data practices.
Encrypted DNS outside the VPN changes what the ISP can read: it may not be able to read the query, but the DNS resolver still receives it. Encryption of a DNS request and routing that request through the VPN are different protections.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A VPN does not make you anonymous to websites
A VPN can mask your home IP address from the destination by routing traffic through the VPN server, but it does not remove other ways a site or app can identify you. Signing in, providing personal details, or using an account-linked service can identify you regardless of the VPN. The FTC’s consumer guidance puts it plainly: “A VPN app generally isn’t going to make you entirely anonymous.” Federal Trade Commission.
Quick Recap
Rank #4
Privacy boundary at a glance
| Connection or observer | What may be visible | Important qualification |
|---|---|---|
| ISP carrying device-to-VPN traffic | Connection to a VPN endpoint, timing, and data volume | With a working tunnel, the ISP generally cannot read the traffic contents inside it. |
| ISP on an HTTPS connection without a VPN | Destination information, potentially including IP addresses or domain names | HTTPS still encrypts the content exchanged with the website. |
| VPN provider handling traffic after the tunnel | Traffic that exits the VPN server toward its destination | What the provider records depends on its practices; do not assume all providers log alike. |
| ISP seeing DNS traffic | Plaintext DNS queries when they travel outside protection | VPN DNS routing, leaks, split routing, and app behavior affect visibility. |
| Website or app | Account details and information you provide | A masked IP address does not prevent identification through an account. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
