Can your Wi-Fi provider see which adult sites you visit?
The broadband bill, the router and the browser each tell a different story. Here’s what can be visible on a UK home connection, including when you use HTTPS or a VPN.
If you visit an adult website over a normal HTTPS connection, your broadband provider can often work out which service you contacted. It ordinarily cannot read the exact page, video title or search you entered there from that encrypted connection. The monthly broadband bill is another matter. A UK home broadband bill normally lists the plan, usage charges and purchases. It does not usually itemise the websites individual household members opened.
A rented film charged to a provider's TV account is a purchase and may appear on a bill. Opening a video in an ordinary web browser is different. BT's explanation of its bill illustrates the distinction between products, call or data usage and separately bought films. BT's guide to what appears on a bill
What someone could see from the connection
| Who has access? | What may be visible | Where the detail stops |
|---|---|---|
| Someone who pays for the broadband | Package, spending and any provider-billed extras | Reading the monthly bill alone is unlikely to reveal which pages you viewed. |
| Someone who manages the router or network | Connected devices, connection times, data use and sometimes domain or filter logs | The router's features and settings determine whether any browsing-related log exists. |
| The broadband provider | Destination IP addresses, timing, data volumes and sometimes hostnames or DNS lookups | HTTPS normally protects the page path, search text and content in transit. |
| Someone who can unlock the device | Tabs, browser history, downloads, account activity or notification previews | Access here happens on the device, outside the protection a VPN tunnel gives the network connection. |
Seeing a domain in a log is a weak basis for deciding who watched what. A webpage can contact several domains for scripts, adverts or images without anyone deliberately visiting those sites. Multiple people may also share a single device.
Why a domain can be visible when the video is private
Suppose a fictional site has the address https://example.org/watch/blue. With a normal HTTPS connection, the path /watch/blue is inside the encrypted request. The network still needs a destination IP address. A plain DNS lookup may reveal example.org when the browser looks up that address. The server name may also appear during the connection setup.
Encrypted DNS protects the name lookup on its way to the chosen resolver. Encrypted Client Hello can also conceal the requested hostname during setup when supported. Several sites can share one IP, so an address observed on the wire does not always identify a particular site. There is no single list of page titles that all routers automatically receive. How DNS encryption works · How Encrypted Client Hello protects a hostname
What changes if you switch on a VPN?
A typical device VPN carries covered traffic to the VPN server inside an encrypted tunnel. The household connection can still show when you used data and the address of the VPN server. When the browser and its DNS traffic both go through the tunnel, the home network ordinarily loses its direct view of the final site. The VPN operator gains a position from which it can observe connection information. HTTPS continues to protect page contents on the onward journey.
Check the app's exclusions before relying on that arrangement. A browser extension may cover a tab while another video app connects directly. Split tunnelling can deliberately exclude one browser. A connection that drops may send subsequent requests directly if the app allows it. You can compare the address reported by our browser exposure tool before and after connecting. That checks what this website saw for that request, rather than proving what every app or DNS lookup did.
Choose the control that matches the concern
If a housemate saw the title in the browser's address bar, start with private browsing on a shared phone. If an email receipt appeared in a shared inbox, check the account's contact and notification settings. Buying a VPN will have little bearing on either problem.
If the concern is the local network keeping destination records, review device coverage, DNS handling and the VPN provider's retention policy when you compare VPN plans. An account you use on the adult site can still record what you watch. Electronic Frontier Foundation's guide to choosing a VPN
Related reading
Can you prove you’re 18 or over on a UK porn site without a passport?
A passport upload is one way to pass an age check. Other options can involve a mobile network, a digital wallet or a selfie. Here’s how to choose between the checks a site actually offers.
Read guide
What to do if an online age check fails and you’re 18 or over
A blank camera, a rejected age estimate and a website that forgets a successful check need different fixes. Start with the last screen that worked.
Read guide
Private browsing on a shared phone, from the first tab to the last
Use Safari Private Browsing or Chrome Incognito for adult browsing on a personal phone, and check the downloads, open tabs and account records that can survive afterwards.
Read guide