Can Your ISP See Your VPN Traffic?

When you turn on a VPN, your internet service provider (ISP) stops being able to read the sites you visit. That is the headline most people hear, and it is true. But it is not the whole story. Your provider still carries every packet you send, so it still sees some things: that you are connected to a VPN server, when you connect, and roughly how much data you move. Knowing exactly where that line falls helps you set realistic expectations.

This article walks through what an ISP can see without a VPN, what it can see with one, what stays visible no matter what, how a VPN relates to bandwidth throttling, and which mistakes quietly put you back in plain view. If you want the wider picture first, start with what a VPN actually protects.

What your ISP sees without a VPN

To understand what changes, start with the baseline. Every device you use reaches the internet through your ISP's network, whether that is a home fibre line, a mobile carrier or a workplace connection. Without a VPN, the provider can observe several layers of your activity.

• Your public IP address and the addresses you contact. Every packet carries a destination address, and the provider needs it to deliver the packet.
• DNS lookups. Before your browser can load a site, it asks a DNS server to turn the name into an address. If you use the provider's own DNS server, which is the default on many connections, it receives a list of the names you look up. The article on how DNS works explains the process.
• The domain in an encrypted connection. Most sites use HTTPS, so the content of a page is encrypted. But the name of the site is commonly still visible during the connection set-up, so the provider can often tell you visited a given domain even though it cannot read the page.
• Plain, unencrypted traffic. Anything sent over plain HTTP or another unencrypted protocol can be read in full.
• Timing and volume. When you are online, how much data moves, and in which direction.

Notice that HTTPS already hides a lot: page content, form fields, the exact URL path. What HTTPS leaves exposed is mostly the destination. That distinction matters because it shows what a VPN really adds. The comparison in HTTPS vs VPN goes deeper.

What changes when a VPN is working

A VPN creates an encrypted tunnel between your device and a VPN server. Everything you send is wrapped inside it before it leaves your device. From the provider's point of view, all of your traffic now goes to one place.

Inside a working tunnel, the ISP can no longer see:

• The sites and services you contact. It sees one destination, the VPN server, instead of dozens of domains.
• Your DNS lookups, provided the VPN sends them through the tunnel as intended.
• The content of unencrypted traffic. Even plain HTTP is hidden between your device and the VPN server.
• Which app produced which request. Streaming, messaging, a software update and a web page all look like the same encrypted stream.

This is the real value. If you would rather your provider did not hold a list of everything you look up, a working VPN removes that list from its view. A simple example: you read a health forum on your home connection. Without a VPN, your provider can record the forum's domain. With a VPN, it records only that you were talking to the VPN server at that time.

What your ISP can still see

This is the part that surprises people. A VPN does not make you invisible to your own provider. The following stay visible.

What the ISP can still see	Why
That you are connected to a VPN server	The tunnel has to start at your connection, and the server has an address
The address of the VPN server	Packets need a destination
When you connect and disconnect	Traffic starts and stops
Roughly how much data you send and receive	The provider carries every packet
That the traffic is probably a VPN	Tunnel traffic often has a recognisable pattern
Your account and billing identity	That is your contract with the provider, unrelated to the VPN

None of this reveals which sites you visit. But it is not nothing. If someone looks at your connection records, they can see that you used a VPN, at what times, and with what volume. For most people that is acceptable, since using a VPN is an ordinary, legal thing to do in most places. For anyone whose concern is that even the existence of a VPN should be hidden, a VPN alone is not designed to do that.

Patterns and traffic analysis

Even encrypted traffic has a shape. A large steady stream looks different from many short bursts. Security researchers have shown that patterns such as packet sizes and timing can sometimes hint at the kind of activity, for example a video stream versus a chat. This is called traffic analysis. It does not reveal the exact page you read, and it is not something an ordinary ISP routinely does to individual customers, but it is a reminder that "encrypted" does not mean "invisible". The EFF's Surveillance Self-Defense material is a good neutral source for understanding how far these techniques go.

The trust moves, it does not vanish

There is a trade-off you should be honest with yourself about. The VPN server sits at the point where your traffic leaves the tunnel and reaches the destination. That means the VPN operator is technically in a position to see where your traffic goes, in the same way your ISP was before.

So a VPN does not remove observers. It changes who is in the observer's seat. Instead of your ISP, you rely on the VPN provider. That can be a good choice. Many people trust a provider they chose and paid for more than a default network they never picked, and a business that sells VPN passes has reasons to behave properly. But you should read what any provider actually tells you about its practices, and never assume a particular policy that is not stated. This is why articles such as what to check before paying for a VPN are worth reading before you buy.

VPN and bandwidth throttling

Throttling means a provider deliberately slows some traffic. People sometimes search for "VPN bandwidth throttling" hoping for a clear answer. The honest answer is: it depends on why the slowdown happens.

Case 1: the provider slows a specific type of traffic. Some networks treat categories of traffic differently, for example slowing large video streams or file transfers at busy times. To do that, the provider has to recognise the category, usually from the destination address or the domain. If a VPN hides the destination, the provider can no longer single out that category. In this narrow case, you may see a difference.

Case 2: the provider slows everything after a data cap. Many mobile and some home plans reduce speed after a monthly allowance. That slowdown applies to all traffic on your account, so a VPN does not change it.

Case 3: congestion. At peak hours a shared network simply gets crowded. Neither you nor the provider is picking on your traffic, and a VPN cannot add capacity that the network does not have.

Case 4: the provider slows VPN traffic itself. Some providers may deprioritise traffic that looks like a tunnel. If that happens, a VPN can make things worse, not better.

On top of that, a VPN has its own cost. The extra encryption and the longer route can reduce speed, and the effect depends on the distance to the VPN server and its load. The article on why internet speed changes with a VPN covers this. The practical advice is to measure rather than assume: run a speed test with the VPN off, then on, at the same time of day, and compare. Do not buy a VPN purely to defeat throttling, because no VPN can promise that outcome. Also note that your contract with your provider may include terms about network management, and a VPN does not change those terms.

How a VPN can fail to hide things

A VPN only protects what actually goes through the tunnel. These are the common ways traffic ends up visible again.

DNS leaks

If your device sends DNS lookups to the provider's DNS server instead of through the tunnel, the provider sees every name you look up even though the page content is hidden. This is called a DNS leak. It can happen because of operating system settings, IPv6, or a misconfigured app.

Dropped tunnels

If the VPN connection drops and your device keeps going, traffic flows straight to your provider without protection until you notice. A kill switch, or an always-on VPN setting where your platform supports it, blocks traffic when the tunnel is down. The explanation of what a kill switch is shows how this works.

Split tunnelling

Some apps let you send only selected traffic through the VPN. That is useful, but anything you exclude goes directly through your provider and is visible as usual. Check your settings so that you know which apps are in or out.

Forgetting to connect

It sounds obvious, but a common reason a provider can see your activity is that the VPN was not turned on, or reconnected after the device woke up. Look at your app before you start a sensitive session.

A short checklist to confirm your ISP cannot see inside

Use this routine whenever you want to be sure.

1. Connect the VPN and wait until the app shows a connected status.
2. Check your visible IP address on any IP lookup page. It should be the VPN server's address, not your home or mobile address.
3. Run a DNS leak test. The resolver shown should not belong to your regular provider.
4. Test the dropped-tunnel case. If your app has a kill switch, confirm it is on.
5. Review split-tunnelling settings so nothing important is excluded.
6. Repeat after changing network, for example from home Wi-Fi to a mobile hotspot.

The Help Center has a step-by-step guide on how to check that your VPN is working that covers the first three steps in detail.

Real-life scenarios

A student on a shared apartment connection. The landlord or building manager runs the Wi-Fi and can see domain names. With a VPN, they see only a connection to the VPN server. The student still has to remember that the VPN provider can now see the destinations.

A traveller on a mobile carrier abroad. The carrier's network sees where data goes. A VPN reduces that to one encrypted stream, which also helps on cafe or hotel Wi-Fi, where yet another party sits on the path. See VPN for travel for related habits.

A remote worker on a home line. The employer's own VPN, if there is one, is a separate matter, and company policy comes first. For personal browsing, a personal VPN stops the home ISP from keeping a domain-level record.

Someone worried about a slow video evening. They run a speed test with and without a VPN. If the VPN version is faster for a particular service, that suggests type-based slowing. If it is slower or the same, the cause is likely congestion or the plan, and the VPN is not the fix.

Common mistakes

• Assuming "VPN on" means "nothing visible." The provider still sees the connection itself.
• Skipping the leak test. A VPN that looks connected can still leak DNS.
• Believing a VPN cures slow internet. It might, in a narrow case, but it often slows things slightly.
• Forgetting the VPN provider is now the observer. Trust shifts, it does not disappear.
• Treating a VPN as legal cover. A VPN does not change laws, contracts or website terms.

Summary

With a working VPN, your ISP can no longer read the sites you visit, your DNS lookups or the content of your traffic. It can still see that you connect to a VPN server, when you do so and roughly how much data you send. A VPN helps with throttling only when the provider slows traffic by recognising its type, and it cannot solve congestion or data caps. Leaks, dropped tunnels and forgotten connections are what usually put you back in view, and the VPN provider takes over the view that your ISP lost.

If you want a VPN you can run for a fixed period without automatic renewal, the pricing page shows the available passes, and the Help Center walks you through setup on each device.