More and more people are taking their online privacy seriously. Facebook, Google, Amazon, and numerous other online platforms are rightfully receiving criticism for the amount of personal data they collect and monetize. However, they are not the only monopolistic corporations you should be concerned about. 

ISPs can monitor which websites you visit and the right to sell this data to advertisers. Worse yet, they are practically inescapable. An ISP handles nearly every one of your Internet connections and, depending on where you live, you have no choice about which ISP you can use. Yet, ISPs face much less public scrutiny. This article will explain what an ISP is, what data they can collect, and how they have treated user privacy in the past. It will also describe what you can do, both individually and collectively, to protect your private data from your ISP. 

What does ISP stand for?

ISP stands for Internet service provider. As their name suggests, they are the companies that provide their customers with access to the Internet. They maintain the broadband and DSL cables, operate DNS servers, and provide you with your IP address so that you can browse the Internet. 

What data can an ISP collect?

An ISP handles all of your online communication, which means it can monitor almost all of your activity. At the very least, your ISP can see which website you are on and how long you stay on it through your DNS requests. Your device makes DNS requests when it translates human-friendly URLs into numerical IP addresses that computers can understand. These requests are not encrypted and can be read by your ISP.  

If you visit a website that does not use HTTPS, then your ISP can see everything you do. It will see your username and password when you log in, what products you are purchasing when you check out, and your credit card number and address when you enter them for payment. (Just another reason to use HTTPS Everywhere(new window).)

Even if you do visit a website with HTTPS, your HTTPS server name indication is not encrypted either, which can also let your ISP know which site you are visiting. Additionally, an ISP can still learn a lot about your activity by closely evaluating your Internet traffic and its metadata — like the size, timing, and destination of your data packets. They could see you are streaming a film or detect that you are torrenting or downloading files, amongst other things. 

This means that ISPs could potentially have more of your data than Facebook or Google. 

What do ISPs do with your data?

The laws that govern ISPs and how they can treat their users vary from country to country, and now in the US, from state to state. In some places, ISPs help repressive governments censor the Internet(new window). In other countries, the ISPs shut the Internet down(new window) completely. 

In the United States, ISPs have had the right to sell your private browsing history(new window) since 2017, as long as they anonymized your personal data. Major American ISPs, like AT&T Comcast, and Verizon, said their customers would be able to opt out of data collection. 

Unfortunately, these ISPs do not have great track records of respecting their users’ privacy rights. Verizon was fined for using “supercookies”(new window) to track their users’ activity on the Internet. These cookies would remain, even if you cleared cookies from your browser. Meanwhile, AT&T tried to argue that privacy was a premium service(new window). It charged its users 50% more for its monthly service if they opted out of letting AT&T sell their data to third parties.

These abuses have finally gotten the government’s attention. The FTC is investigating how ISPs handle personal data(new window), specifically how they aggregate and anonymize it, how long they retain it, and whether they share it with any third parties. The state of Maine went even further when they passed a law forbidding ISPs from selling personal data(new window) without an individual’s express permission. And the California Consumer Privacy Act(new window) took effect on Jan. 1, 2020, which gives California residents the right to opt out of having their data sold. This has inspired a flurry of other states to consider similar privacy protection legislation(new window).

How to protect your IP address

There are also measures you can take to protect your data from being collected and sold by your ISP. 

HTTPS

As mentioned above, visiting websites that use HTTPS encryption will limit how much of your activity your ISP can see on a given page. However, HTTPS does not encrypt its server name indication or DNS queries, so your ISP will still be able to see what websites you are visiting.

Tor

The Tor network(new window) is the most private and secure way of browsing the Internet. Your Internet traffic is encrypted and routed through multiple Tor servers. Tor encrypts your traffic in such a way that no one server can access both your IP address and the site you are visiting. This makes it very difficult to link your activity to your device. However, using Tor requires you to use a specialized browser, and its connections can be slow. Finally, Tor has many limitations, such as not being able to torrent files or stream video, to name a couple. 

VPN

A VPN is probably the most user-friendly way of preventing your ISP from collecting your data. It works with any browser, and its fast speeds allow you to use it to watch your favorite shows or share files with your friends. A VPN encrypts your Internet traffic between your device and a VPN server before it goes on to connect to your website. Your ISP will see you are connected to a VPN, but it will not be able to see what websites you are visiting. Make sure your VPN also prevents DNS leaks(new window), which could let your ISP determine which sites you visited from your DNS queries.

It is important to note that when you are connected to a VPN server, your VPN service provider replaces your ISP. It will be able to see all of your online activity. That is why it is essential that you only use a trustworthy VPN(new window) service that has an explicit no logs policy and doesn’t sell your data to third parties. 

Proton VPN’s mission is to make a private and secure Internet available to everyone. We believe everyone has the right to use the Internet without forfeiting their browsing data to a corporation. To prevent your ISP from collecting and sharing your online activity, sign up for a free Proton VPN(new window) account today. 

Finally, if you are a US citizen and you feel that your online data should not be for sale, contact your representative or senator. Encourage them to pressure the FTC to continue their investigations or to pass new legislation to protect your online privacy. The only way to stem the tide of corporate surveillance is to unite against it. 

Best Regards,
The Proton VPN Team

UPDATE Jan. 24, 2019: This blog post was modified to mention the recently enacted California Consumer Protection Act and the proposed legislation it has inspired in other states.

You can follow us on social media to stay up to date on the latest Proton VPN releases:

Twitter (new window)Facebook(new window) | Reddit(new window) | Instagram(new window)

Get a free Proton Mail encrypted email account(new window)

Protect your privacy and security online
Get Proton VPN free

Related articles

Paris Olympics
The 2024 Summer Olympics in Paris begins this July. While you’ve likely already missed your chance to get a ticket and witness the best athletes from around the world in person, there are plenty of ways to enjoy the games from the comfort of your hom
Where to watch euros
Every four years, the entire continent of Europe turns its eyes to see who will be crowned as the continent’s champion of football (or soccer for the Americans).  This is the 17th edition of the UEFA European Football Championship, in which 24 natio
How to enable location services
Location services refer to a combination of technologies used in devices like smartphones and computers that use data from your device’s GPS, WiFi, mobile (cellular networks), and sometimes even Bluetooth connections to determine and track your geogr
What is AirTag stalking?
In an era of “smart devices” that often double as spy devices, AirTags are tracking tools that are open about their function and can be vital in helping locate lost items (as anyone who has lost their car keys can attest to). However, as a recent cla
How to fix a "Your connection is not safe" error
As you surf the web using your browser, you’ll no doubt encounter websites that your browser will refuse to load, instead showing some variation of an error message, such as Your connection is not private or Warning: Potential Security Risk Ahead. 
Your search history is a window into your inner life. Anyone with access to it knows what your hobbies and interests are, your sexual orientation and preferences, the things that worry you (for example your medical concerns), your political affiliati