When you back up photos to Google Drive or upload files to any cloud service, the files travel over HTTPS — encrypted in transit. The encryption means no one monitoring the wire between your home and the server can read the contents of what you’re sending.
But your internet service provider sits in a privileged position between your device and every server on the internet. And while HTTPS encrypts the contents of your traffic, it doesn’t hide everything. Your ISP can see — and in many jurisdictions, is permitted to retain and sell — a category of data that reveals quite a lot about your cloud storage habits, even without being able to read a single file.
What HTTPS Hides (and What It Doesn’t)
HTTPS protects the payload: the actual content of what you’re sending and receiving. When you upload a photo to a cloud storage service, the image file is encrypted before it leaves your device, and only the destination server can decrypt it. An ISP packet inspector sitting between you and the server sees encrypted bytes — not your photos, not your documents, not the file names.
This is meaningful protection. It prevents eavesdropping on the content of what you’re doing online. It’s the reason that HTTPS deployment became a baseline requirement rather than an optional enhancement.
What HTTPS doesn’t hide is the metadata layer.
DNS queries: When your device needs to connect to drive.google.com, www.dropbox.com, or any other service, it first performs a DNS lookup — asking a DNS server to translate a domain name into an IP address. By default, DNS queries are sent in plaintext. Your ISP handles these queries and can see every domain you’re looking up. This is a log of every service you connect to, timestamped, without needing to decrypt any traffic.
IP address and hostname: Even after DNS resolution, your traffic flows to a specific IP address. The destination IP is visible in the packet header — not encrypted by HTTPS. Your ISP can see that you’re connecting to Google’s servers, to Amazon’s S3 infrastructure, to any cloud storage provider’s infrastructure.
Server Name Indication (SNI): HTTPS uses a field called SNI during the connection handshake to tell the server which certificate to present. This field has historically been transmitted in plaintext, meaning your ISP can see the exact hostname (photos.google.com, api.dropbox.com) of every encrypted connection, even without reading any of the encrypted content. Encrypted Client Hello (ECH), a newer protocol extension, is designed to hide this — but ISP infrastructure support for ECH is not yet universal.
Traffic volume and timing: Your ISP can see how much data you’re transferring and when. A large upload to a cloud storage domain at 11pm, followed by a large download the next morning, paints a behavioral picture without revealing any file content.
What ISPs Are Permitted to Do With This Data
The rules governing ISP data use vary significantly by jurisdiction, and this is where the practical impact is most uneven.
United States
In the US, ISPs are regulated primarily by the Federal Trade Commission rather than by sector-specific privacy rules comparable to GDPR. The FTC Act prohibits unfair or deceptive practices, but there’s no comprehensive framework specifically governing ISP data collection and use.
ISPs in the US can — and several major carriers do — collect and use data about your internet activity for advertising purposes. This includes selling or sharing data with third-party advertising networks. The data available to ISPs is the metadata layer described above: DNS queries, IP connections, traffic volumes. This is enough to build a detailed behavioral profile: which services you use, how often, how much data you transfer, at what times.
ISPs also respond to law enforcement requests. A legal request for ISP connection logs can reveal which cloud services you accessed and when, without requiring any cooperation from the cloud service itself.
European Union
Under GDPR and the EU’s ePrivacy Directive, ISPs operating in EU member states face tighter constraints. Traffic data is generally classified as personal data, and its processing requires a legitimate legal basis. Most EU ISPs cannot sell traffic metadata to advertising networks. Government access requires compliance with national legal frameworks that, in many EU countries, include independent oversight and judicial authorization requirements.
The EU framework is stronger for users but not absolute. ISPs still retain traffic logs for varying periods under national security and lawful intercept requirements. The protection is from commercial exploitation, not from legal access entirely.
Other Jurisdictions
ISP privacy rules in other countries range from very strong (Canada, Australia have some sector-specific rules) to effectively nonexistent (many countries with limited privacy enforcement). The jurisdiction of your ISP matters significantly — a user on a major US carrier faces different ISP data practices than a user on a carrier in Germany.
The Behavioral Profile From Metadata
Even without ever reading a file, an ISP that retains metadata about your cloud storage activity can build a meaningful picture of your life.
Which cloud services you use: A list of the storage and file services you connect to regularly. This includes not just primary storage services but backup services, photo syncing tools, document services, and collaboration platforms.
Usage frequency and timing: How often you access each service, at what times, and whether usage is consistent or correlated with specific life events.
Data volume patterns: Large upload events suggest backup activity, travel, device upgrades, or major life moments (extensive photo uploads often correlate with significant events like births, weddings, relocations).
Behavioral correlates: Patterns that correlate with life events — unusual activity late at night, shifts in service usage, access to services from new IP addresses (travel).
Implicit category inference: Connecting frequently to health-related cloud services, legal document platforms, or financial services reveals category information without revealing content.
None of this requires reading a single encrypted file. It’s entirely derivable from the metadata layer that HTTPS leaves exposed.
Encrypted DNS: A Meaningful Mitigation
The most accessible protection against ISP DNS surveillance is encrypted DNS — specifically, DNS over HTTPS (DoH) or DNS over TLS (DoT). These protocols encrypt DNS queries so that your ISP sees that you’re making DNS queries, but not which domains you’re looking up.
Encrypted DNS is available through several public resolvers. Cloudflare’s 1.1.1.1, Google’s 8.8.8.8, and Mozilla’s resolver all support DoH and DoT. Configuring your device or home router to use one of these resolvers and to use the encrypted protocol is a meaningful reduction in ISP DNS visibility.
Important caveats:
Encrypted DNS shifts trust, not eliminates it. Your DNS queries go to a resolver like Cloudflare or Google rather than your ISP. This means Cloudflare or Google sees your DNS queries instead of your ISP. For most users, this is an improvement — Cloudflare’s 1.1.1.1 has explicit data retention commitments and is not an advertising company. But it’s a trust transfer, not the elimination of any party seeing your queries.
It doesn’t address SNI or IP visibility. Your ISP still sees the IP addresses you connect to and, in many cases, the plaintext SNI field that reveals the specific hostname. Encrypted DNS helps significantly with the domain-name visibility specifically.
ECH closes the SNI gap, but adoption is partial. Encrypted Client Hello, supported by Cloudflare and increasing numbers of services, hides the SNI field. Browser support (Firefox, Chrome) exists, but requires the server to also support it. Not all cloud storage providers have enabled ECH on their servers.
VPNs: What They Change and What They Don’t
A VPN routes your internet traffic through an encrypted tunnel to a VPN server, and from there to the destination. From your ISP’s perspective, all your traffic goes to a single IP address (the VPN server) in encrypted form. Your ISP cannot see which cloud services you’re connecting to, what DNS queries you’re making, or what the traffic volume patterns are by destination.
This is a meaningful change for ISP-level surveillance specifically.
The trade-off is that the VPN provider now occupies the position your ISP previously held. The VPN can see your traffic if they choose to. A VPN provider’s data practices, logging policy, and legal jurisdiction are the relevant variables — and they vary widely. A VPN that logs connection data and is incorporated in a jurisdiction with broad law enforcement data access requirements provides limited protection against legal access.
A VPN also adds latency and can affect upload speeds to cloud storage, which matters practically for backing up large files.
The decision about whether to use a VPN for cloud storage traffic is about whether you trust your ISP less than a specific VPN provider — and which risk you’re primarily trying to address.
The Encryption Mismatch
There’s a persistent mental model of cloud storage security that focuses entirely on file-level encryption: “my files are encrypted, therefore my cloud activity is private.” File-level encryption protects the content. It doesn’t protect the fact of the activity.
A complete picture of cloud storage privacy includes:
- File encryption (content privacy): who can read the files themselves
- Transit encryption (connection security): whether files are protected during transfer
- Metadata privacy (activity privacy): who can see that you’re using the service, how often, and what patterns your usage reflects
Most discussions focus on the first two. The third is where ISP data practices become relevant.
For most people, ISP metadata visibility is a lower-priority concern than file-level encryption practices or the data policies of cloud storage providers. But it’s not a zero risk, particularly for users in jurisdictions without strong ISP data use restrictions, and particularly for anyone whose cloud storage usage patterns could be sensitive — people in high-conflict personal situations, journalists, legal professionals, or anyone whose service usage tells a story they’d prefer not to share.
Practical Steps by Risk Level
For most users:
- Enable DNS over HTTPS in your browser (Firefox, Chrome, Edge all support this in privacy settings) or configure your router to use an encrypted DNS resolver.
- Be aware that ISP metadata visibility exists and what it covers.
For users with heightened privacy concerns:
- Use encrypted DNS at the router level so all devices on your network benefit.
- Use a VPN from a provider with a verified no-logs policy, incorporated outside major data-sharing frameworks.
- Consider using cloud services that have Tor support or alternative access methods — Proton Drive’s Tor hidden service, for example, routes traffic in a way that makes even VPN provider attribution difficult.
For users who simply want their files to be private from their storage provider:
- ISP metadata visibility is secondary. The primary concern is what the cloud storage service itself does with your files. A service that doesn’t run advertising, doesn’t sell your data, and doesn’t route your files through third-party AI systems is the baseline. The ISP metadata layer is a separate problem that requires separate mitigation.
The two concerns — provider privacy and ISP privacy — are distinct and call for different tools. Knowing which problem you’re solving helps you pick the right one.