What Your ISP Can Sell About Your Browsing
Your internet provider sits in a weird spot. It is not the website you visit, and it is not the app you open. It is the road between you and everything else.
That means your ISP can see more than most people think. Not always the exact article you read or the password you typed, because HTTPS protects a lot of page content now. But the broader picture can still be pretty revealing.
If you visit a diabetes forum, a bankruptcy lawyer, a pregnancy site, a political campaign page, and then a job board, your ISP may not need the full page text to understand the pattern. The domains, timing, device, location, and volume already tell a story.
What your ISP can usually see
On a normal connection, your internet provider can often see the IP addresses you connect to, the domains your device asks for through DNS, when you connect, how long you stay connected, and how much data moves back and forth.
HTTPS makes a big difference. It helps hide the actual content inside the connection, like the words on a page or the details you submit in a secure form. That is good. It is one of the reasons the modern web is safer than it used to be.
But HTTPS does not make your ISP blind. It may still see that you connected to a particular website, even if it cannot see the exact page. Apps also talk in the background. Smart TVs, phones, laptops, game consoles, and tablets all leave little trails.
Can they legally sell it?
In the United States, the answer is basically: sometimes, depending on the data, the state, the company policy, and how the data is packaged.
The simple federal rule people expected never really stuck. The FCC broadband privacy rules that would have required stronger opt-in permission for sensitive ISP data were repealed in 2017 before they took effect. Since then, privacy protection has been a patchwork of FTC oversight, state privacy laws, sector-specific rules, and company promises.
The FTC has also warned that major ISPs can combine browsing-related data with location, TV viewing, app usage, and information from other parts of their business. That does not always mean your raw browser history is being sold as a neat spreadsheet with your name on it. More often it means data is used for ad targeting, audience segments, measurement, or shared in ways that are described as aggregated or de-identified.
That wording matters. "We do not sell your browsing history" sounds comforting. But a privacy policy may still allow targeted advertising, data sharing with affiliates, or use of inferred interests. The details are in the boring paragraphs nobody reads.
What a VPN changes
A VPN does not erase you from the internet. It does not make every website forget you. If you log into Google, Instagram, Amazon, or your bank, those services still know it is you.
What a VPN changes is the first hop. Instead of your ISP seeing a long list of sites and patterns, it sees an encrypted connection from you to the VPN server. The websites you visit see the VPN server's IP address instead of your home IP address.
That is useful if your main concern is your ISP building a browsing profile from your home connection, your mobile carrier watching your traffic, or a public WiFi network logging what you do.
It also shifts trust. Without a VPN, your ISP is the network you trust. With a VPN, your VPN provider becomes part of that trust chain. That is why a simple privacy policy matters. You want a provider that is clear about logs, retention, and what it does not track.
If you want a basic WireGuard VPN without the bloated price tag, 99¢ VPN is $11.88 per year for one device. It is not magic. It just keeps your ISP from being the easiest place to watch your browsing patterns.
The bottom line: your ISP probably cannot read everything you do, but it can still learn a lot from the shape of your traffic. A VPN narrows that view. For most people, that is the practical privacy win.
Written by the person who runs 99¢ VPN. Not legal advice. Just the plain-English version of what your ISP can see and why the first hop matters.