The basic answer: your internet activity leaves traces everywhere
When you use the internet, you are not just sending a message into a void. Every time you load a webpage, send an email, or watch a video, information about you and what you are doing travels across multiple computers and networks. Some of that information is necessary for the internet to work at all. Some of it is collected by companies you have never heard of. Understanding what information moves where — and who can see it — is the foundation of making choices about your own digital safety.
Internet information falls into two broad categories: the technical data that has to exist for your request to reach its destination, and the behavioral data that companies collect about what you do. Both matter. Both can be intercepted, stored, or sold. Neither is invisible just because you cannot see it happening.
Key Takeaways
- Your internet service provider can see which websites you visit, even if the connection is encrypted, because they route all your traffic.
- Websites collect information about what you click, how long you stay, and what you search for, often through tracking pixels and cookies that follow you across the internet.
- Your IP address is visible to every website you visit and can be used to identify your approximate location and sometimes your identity.
- Encrypted connections (HTTPS) protect the content of what you send, but not the fact that you sent it or where you sent it.
- Information collected about you can be bought, sold, combined with other data, and used in ways you never consented to.
The technical information that has to exist for the internet to work
Your IP address is a number that identifies your device on the internet, similar to a mailing address. Every time you visit a website, that website's server logs your IP address. Your internet service provider — Comcast, Verizon, AT&T, or whoever you pay for internet — assigns you an IP address and can see all the traffic flowing to and from it. They know which websites you visit, when you visit them, and roughly how much data you are sending and receiving, even if the content is encrypted.
Your domain name system (DNS) requests are the lookups that translate website names into IP addresses. When you type "example.com" into your browser, your device sends a DNS request asking "what is the IP address for example.com?" Your internet service provider can see these requests, and so can your DNS provider — the service that handles the translation. Some people use their ISP's default DNS server; others use Google's (8.8.8.8), Cloudflare's (1.1.1.1), or another provider. Whoever handles your DNS requests knows which websites you are trying to reach.
Your device information — the type of phone or computer you use, your operating system, your browser type — is sent to websites automatically. Websites use this to decide how to display their pages. It is also used to build a profile of who you are, because certain device combinations are rare enough to identify you individually.
The behavioral information websites and advertisers collect about you
Cookies are small files that websites store on your device. First-party cookies come from the website you are visiting and remember things like your login information or items in your shopping cart. Third-party cookies come from advertisers and data brokers embedded in the website, and they track you across the internet. If you visit a shoe website and then see shoe ads on a news site, a third-party cookie followed you there.
Tracking pixels are invisible images embedded in websites and emails. When your browser loads the pixel, it sends information back to the company that placed it — your IP address, the time you viewed the page, what device you used. Pixels are often used to track whether you opened an email, how long you spent on a page, or whether you completed a purchase after clicking an ad.
Browsing history and search queries are collected by the websites you visit and by your search engine. Google, Bing, and other search engines know what you search for. Facebook, Amazon, and other large platforms know what you click on, what you look at without clicking, and how long you spend looking. This information is stored in your account profile and used to target ads to you.
Location data can come from your IP address (which reveals your city or region), from GPS in your phone, from your WiFi network, or from Bluetooth signals. Apps often request permission to access your location. Websites can request it too. Even if you deny permission, your approximate location is still visible through your IP address.
How information moves from one place to another
When you visit a website, your browser makes a request to that website's server. That request travels through your internet service provider's network, then through the internet backbone (the major cables and routers that connect networks), then to the website's server. The response travels back the same way. At each step, the computers handling your traffic can see your IP address and the destination address.
If the connection is encrypted (HTTPS, indicated by a padlock icon in your browser), the content of what you send is scrambled so that only the destination server can read it. But the fact that you sent it, when you sent it, how much data you sent, and where you sent it are still visible to your internet service provider and to anyone else monitoring the network.
Information about you is also shared intentionally. Websites sell data to data brokers, who combine it with information from other sources and sell it again. Advertisers buy lists of people matching certain profiles. Apps share data with parent companies and partners. This happens through APIs (automated connections between systems) and through direct sales of databases. You usually do not see it happen, and you often do not know it is happening.
What third parties can infer from the information they collect
Individual pieces of information seem harmless. Your IP address is just a number. A cookie is just a file. But when combined, they reveal a detailed picture of who you are. Companies use browsing history, search queries, purchase history, location data, and device information to infer your age, income, health status, political beliefs, sexual orientation, and whether you are pregnant, in debt, or struggling with addiction.
This inference happens through data brokers — companies that buy information from websites, apps, and other sources and sell it to advertisers, employers, landlords, and insurance companies. You have probably never heard of most of them. Acxiom, Experian, Equifax, and dozens of smaller companies maintain profiles on millions of people. The information in these profiles can affect whether you are hired, whether you are approved for credit, what price you are offered for insurance, and what ads you see.
The information can also be used for fingerprinting — identifying you across the internet even if you use different devices or delete your cookies. Fingerprinting combines your device type, browser version, screen resolution, fonts installed, and other technical details into a unique identifier. Some fingerprinting methods are so effective that they can identify you with 99% accuracy.
The difference between encrypted and unencrypted connections
An encrypted connection (HTTPS) scrambles the content of what you send so that only the destination server can read it. If you log into your email over HTTPS, no one monitoring the network can see your password or your emails. This is essential for security.
But encryption does not hide the fact that you are using the service. Your internet service provider can see that you are connecting to Gmail's servers, even if they cannot see your emails. They can see that you are visiting a banking website, even if they cannot see your account balance. They can see that you are visiting a health website, even if they cannot see which health condition you are researching.
An unencrypted connection (HTTP) sends everything in plain text. Anyone monitoring the network — your ISP, someone on your WiFi network, or someone with access to the network infrastructure — can see everything you send and receive. This includes passwords, emails, and any information you type into forms. Most websites now use HTTPS, but some still do not.
How to understand what information you are sharing
Start by checking what permissions you have given to apps and websites. On most phones, you can see which apps have permission to access your location, camera, microphone, contacts, and photos. On most browsers, you can see which websites have permission to access your location or send you notifications. Removing permissions you do not need reduces the information being collected.
Read privacy policies when they matter to you — not all of them, but the ones for services you use regularly or that handle sensitive information. A privacy policy tells you what information the company collects, how they use it, and who they share it with. It is often written in legal language, but the key sections are usually: what data they collect, how long they keep it, who they share it with, and what choices you have.
Use browser settings to limit tracking. Most modern browsers have a "Do Not Track" option and settings to block third-party cookies. These do not stop all tracking, but they reduce it. Some browsers, like Firefox and Brave, have stronger privacy settings by default than Chrome or Safari.
Frequently Asked Questions
Can my internet service provider see what I do on encrypted websites?
Your ISP cannot see the content of what you send or receive on encrypted (HTTPS) websites. But they can see that you are visiting those websites, when you visit them, and how much data you are sending. They know you are on Gmail, but not what your emails say. They know you are on a health website, but not which pages you view.
Do I need to worry about my IP address being visible?
Your IP address is visible to every website you visit and can be used to identify your approximate location. It is not a secret in the way a password is. But combined with other information, it can be used to identify you. If privacy matters to you, a VPN (virtual private network) hides your IP address from websites, though your ISP can still see that you are using a VPN.
What is the difference between a cookie and a tracking pixel?
A cookie is a file stored on your device that persists across visits. A tracking pixel is an invisible image that sends information back to a company when you view a page or email. Cookies can be deleted; pixels cannot. Both are used to track your behavior across the internet.
If I delete my browsing history, does that stop companies from tracking me?
Deleting your browsing history removes the record from your device, but it does not stop companies from collecting information about you going forward. Websites, advertisers, and data brokers still see your activity. Deleting history also does not remove information that has already been collected and stored on company servers.
Can I stop my internet service provider from seeing which websites I visit?
A VPN encrypts your traffic so your ISP cannot see which websites you visit. But your ISP can see that you are using a VPN, and the VPN provider can see your traffic instead. You are shifting trust from your ISP to the VPN company. Choose a VPN provider with a clear privacy policy and a no-logging may provide if this matters to you.