How Can Your ISPs Track Your Online Activity?

Table of Contents (click to expand)

Your ISP can track your online activity by looking at which websites you log on to. It doesn’t matter whether you use the Incognito mode and only visit HTTPS-encrypted websites… your ISP can still see what websites you log on to.

When you open an Incognito tab in Chrome or a Private window in Firefox, the first screen lets you know that while your browsing history and cookies will not be stored in this mode of browsing, you will still be visible to your government or internet service provider (ISP), i.e., they can see what pages you visit.

Firefox private browsing with tracking protection ISP & Crome incognito ISP
See what I am talking about?

While reading that disclaimer on the blank page of such incognito tabs, have you ever wondered how your ISP can track your online activity?

Also, you might have heard that HTTPS-encrypted web pages cannot be read by a third party, i.e., no one else, except you and the website you’re on, can determine what you’re doing on that website (what pages you visit, what content you see etc.). So, can your ISP know what web pages you’re visiting if all the pages you visit are HTTPS-encrypted (in simple words, their URL stars with “https://”)?

Let’s start with what an HTTPS encryption really is.


What Is The HTTPS Protocol?

HTTPS is just good old HTTP, with an extra ‘S’ at the end. While HTTP stands for Hypertext Transfer Protocol, the extra “S” in HTTPS stands for ‘Secure’.

HTTPS is a kind of protocol where encrypted HTTP data is transferred over a secure connection. While HTTP pages are more vulnerable to snooping by third parties, HTTPS pages are not, as they encrypt your communication with the website you’re on.

HTTP & HTTPS

When you open an HTTPS website on your browser, the website sends its SSL certificate to the latter. SSL (Security Sockets Layer) certificates provide secure and encrypted communication between an internet browser and a website. The SSL certificate contains the ‘public key’ (basically a long digital code) that is required to begin the secure session (between the website and your browser).

Based on this exchange, your browser and the target website do an ‘SSL’ handshake, which involves producing shared ‘secrets’ that help establish a uniquely secure connection between your browser and the website. Once this secure connection is established, the connection between your browser and the website becomes encrypted, meaning that no third party can access the information you share with that website. This is the biggest advantage of HTTPS over HTTP, at least in theory.

In modern browsers, such as Chrome and Firefox, you will see a padlock icon in the browser address bar whenever you visit an HTTPS-encrypted website.

Https padlock address bar.
The padlock icon in the address bar of an internet browser. (Photo Credit : Santeri Viinamäki / Wikimedia Commons)

Also Read: How Are Hackers Able To Figure Out Passwords When There Is A Maximum Limit Of Entering Incorrect Passwords?

How Can Your ISP See Your Online Activity?

If you have an internet connection, it means that you have an ISP, i.e., an Internet Service Provider. Not only does an ISP provide an internet connection to its customers, but it also controls it… in a major way!

An ISP controls all the equipment that your internet data flows through once it reaches your computer. As such, it can absolutely ‘look’ at which websites you visit online.What if i told you that your isp knows all about the websited you visits meme

It doesn’t matter whether you use the Incognito mode and only visit HTTPS-protected websites… your ISP can still see what websites you log on to.

You see, when you visit a website, your computer asks your DNS server (most likely controlled by your ISP) to translate the domain name (e.g. “scienceabc.com”) into an IP address. Subsequently, your computer connects to the server at the given ‘target’ IP address, and then they start ‘talking’ with the help of URLs (i.e., downloading and uploading information).

Notice that you never asked your ISP to take you to those URLs; all you did was ask your DNS server (likely controlled by your ISP) to convert a domain name into an IP address. Once your ISP did that, the rest of the communication was between your browser and the server of the target website, with your ISP acting as a mailman or messenger, i.e., delivering your messages to the website, collecting its reply and then delivering it to you.

Can My ISP Still Track My Online Activity If I Only Use HTTPS-encrypted Websites?

It sure can. And in many cases, they actually do.

Not sure if invading privacy or just really interested in me meme

As mentioned earlier, your ISP acts as a messenger or mailman. It takes your letters and packages where they need to go. Now, HTTPS encryption certainly protects the contents of your letters, but the mailman still has to take those letters from you to the addressee. As such, it has to know where exactly you want to send your letters, right? In other words, it needs to know the address of your addressee.

In a nutshell, your ISP might not be able to see what exactly you’re looking at on a website (say, Youtube) if it’s HTTPS-encrypted, but it can certainly see that you logged on to Youtube. Just as you cannot hide the recipient’s address from the mailman, you also cannot hide which websites you’re accessing from your ISP.

However, there are certain alternatives to block ISP from tracking, like using a VPN (Virtual Private Network), which can protect your online privacy. Unfortunately, these often come at a premium price, and their effectiveness and reliability are often a cause of concern for users.

Also Read: What Exactly Happens When You Visit A Website?

How well do you understand the article above!

Can you answer a few questions based on the article you just read?

References (click to expand)
  1. How Does the Internet Work?. Stanford University
  2. When does your browser send a "Referer" header (or not)?. The SANS Institute
  3. M Marlinspike. New Tricks For Defeating SSL In Practice - Black Hat. msstate.edu
  4. Ivanti Secure Access Campus VPN | UC Santa Barbara .... The University of California, Santa Barbara
Help us make this article better
About the Author

Ashish is a Science graduate (Bachelor of Science) from Punjabi University (India). He spearheads the content and editorial wing of ScienceABC and manages its official Youtube channel. He’s a Harry Potter fan and tries, in vain, to use spells and charms (Accio! [insert object name]) in real life to get things done. He totally gets why JRR Tolkien would create, from scratch, a language spoken by elves, and tries to bring the same passion in everything he does. A big admirer of Richard Feynman and Nikola Tesla, he obsesses over how thoroughly science dictates every aspect of life… in this universe, at least.

.