Can Your ISP Sell Your Browsing History? The Annoying Legal Answer
The short answer is: in the U.S., your internet provider has more room to use your browsing data than most people assume.
That does not mean a person at the cable company is reading your search history over lunch. It also does not mean every ISP is selling a neat spreadsheet called "everything you did online." Real life is less cartoonish, and more annoying.
Your ISP sits between your device and the internet. Even with HTTPS, it can still learn a lot from the connection itself: which domains you connect to, when you connect, how much data moves, what device is online, and sometimes DNS requests if you are using the provider's default DNS.
That metadata can say plenty. A health site, a job board, a political donation page, a dating app, a crypto exchange, a debt relief service. The page contents may be encrypted, but the pattern still tells a story.
Why the law feels fuzzy
The big turning point was 2017. Congress repealed FCC broadband privacy rules before they fully took effect. Those rules would have required stronger opt-in consent for sensitive ISP data, including web browsing and app usage history.
Without those rules, the privacy picture became a patchwork. The FTC can still go after unfair or deceptive practices. State privacy laws can give some people rights to access, delete, or opt out of certain data sales. California's privacy law is the example most people know.
But there is no simple national rule that says every broadband provider must treat browsing history the same way. That is why the honest answer is not "illegal" or "totally fine." It is: read the privacy policy, check the opt-out settings, and assume your ISP has a business reason to collect more than you expect.
What ISPs actually collect
The FTC looked at major internet providers and found that many collect large pools of customer data. Some used web browsing data for advertising. Some combined personal information, app usage, browsing information, location, and data from related services.
The report also made a point that matters for normal people: even when encryption hides page contents, ISPs may still collect IP addresses and domain names. So HTTPS helps a lot, but it does not make your ISP blind.
Common data categories can include:
- Account data: name, address, payment details, service location, device identifiers.
- Connection data: IP addresses, timestamps, data volume, outages, router information.
- Browsing clues: domains, DNS lookups, app traffic patterns, and categories inferred from that activity.
- Marketing data: demographic segments, interest categories, and data broker matches.
Some of that is needed to run the network. Some of it is used for billing, fraud prevention, support, or security. The part to watch is when network data becomes advertising data.
Where a VPN helps, and where it does not
A VPN changes what your ISP can see. Instead of seeing connections to lots of different sites, your ISP sees an encrypted connection from you to the VPN server. Your DNS requests can go through that encrypted tunnel too, depending on the setup.
That is useful. It makes your ISP a lot less helpful as a browsing-profile machine.
But a VPN is not a magic delete button. Websites you log into still know it is you. Apps can still track you inside their own accounts. Cookies, payment records, email addresses, and browser fingerprints still exist. A VPN protects the connection. It does not erase every other tracking system on the internet.
The practical move is simple: use HTTPS, turn on privacy settings with your ISP, opt out of data sale or sharing where your state gives you that right, and use a VPN when you do not want your access provider building a clean map of your browsing habits.
If you want the boring version that just protects the connection, 99¢ VPN is $11.88/year for a simple WireGuard VPN. No giant bundle. No fake countdown timer. Just a cheaper way to make your ISP see less.
The bottom line: your ISP probably cannot read every page you visit. But it can still see enough metadata to make a profile. If that bothers you, a VPN is one of the easiest ways to shrink the view.
Written by the person who runs 99¢ VPN. Not legal advice. Just the plain-English version of why your ISP's view of your connection is worth thinking about.