What Your ISP Knows About You Even With a VPN

A subscription to a commercial virtual private network has become almost as routine for Australians as paying for mobile data. From Sydney offices to Perth share houses, the little green padlock sits in the corner of browsers and the modest app icon hums in system trays. The marketing pitch is consistent: switch it on, and your internet provider disappears from your digital life. For many users that promise feels reassuring enough to stop thinking about.

The problem is that a tunnel only obscures the content of what travels through it. The road itself remains visible. Every time you connect, your internet service provider still records the shape of your session, the destination you pointed at, and a steady stream of routine details that, taken together, describe your online life almost as clearly as the unencrypted version would. Understanding what stays visible is the first step toward building a setup that actually matches the privacy you thought you bought.

The illusion of total privacy behind a tunnel

Virtual private networks were designed to solve a specific problem: letting employees at a Brisbane branch office log into a corporate server over a hostile network without their credentials being intercepted. The technology has since been repackaged for consumers, where the threat model is broader and the protections narrower than most advertising suggests. When a provider claims to make you anonymous, it is worth asking what, exactly, that word means in their vocabulary.

A VPN creates an encrypted channel between your device and a server operated by the VPN company. From that point onward, traffic is mixed with that of other users and forwarded to its destination. The user sees a private conversation. The internet service provider sees a single, persistent connection to a remote address, which is itself a meaningful piece of information. Knowing that a household connects to a server in Frankfurt every evening between seven and eleven, while uploading several gigabytes, tells a story even without reading the bytes inside.

This matters because the metadata of online behaviour has become, in many jurisdictions, more valuable and more reliable than the content. Patterns of connection, durations, and the specific services a user reaches through the tunnel can reveal religious affiliation, medical queries, political interest, and romantic life with alarming accuracy. The encrypted wrapper does not erase these signals; it merely repackages them.

What your provider can still see: connection metadata

Encryption protects payloads, not the fact that a payload was sent. The metadata visible to an Australian ISP typically includes the source IP address assigned to the home or mobile connection, the destination IP address of the VPN endpoint, port numbers, connection timestamps, session duration, and the rough volume of data exchanged. Even when the tunnel is doing its job, all of these details are observable in the network logs that major providers like Telstra, Optus, and TPG are required to maintain under Commonwealth law.

The popular response to this is to choose a VPN provider that advertises a no-logs policy. The claim is reassuring but difficult to verify from the outside. Independent audits have begun to address this gap, yet they capture a moment in time and say nothing about the legal pressure a foreign provider might face. Under Australia's Telecommunications (Interception and Access) Act, carriers and carriage service providers can be compelled to keep records covertly and to hand them over without notifying the customer. Some Australian VPN companies operating inside the country are subject to the same regime, even when their servers sit overseas.

What an ISP does with this metadata varies. In the routine case it feeds network management and abuse complaints. In less routine cases, it can be retained for the two-year period mandated by the data retention scheme and accessed by law enforcement, security agencies, and certain regulatory bodies. The promise of anonymity from a no-logs provider is only as strong as the jurisdiction the provider operates in, the integrity of its staff, and its willingness to absorb the cost of contempt.

DNS leaks, WebRTC and the cracks in encrypted tunnels

Beyond the metadata of the tunnel itself, several common configuration mistakes allow the ISP to see more than the user expected. The first is a DNS leak. Every time a browser resolves a domain name, the query is usually sent to a resolver operated by the ISP. When a VPN is misconfigured or when the operating system ignores its routing rules, those queries travel in the clear over the regular connection, revealing every site the user visits regardless of the tunnel. A second crack is the WebRTC protocol used by browsers for real-time communication. It was designed to help web applications discover the best path between peers, and in doing so it can reveal the user's local and even public IP address to any page running a short piece of JavaScript. Many VPN providers now block or anonymise these responses, but older configurations and certain browser extensions expose the underlying address to every website that asks.

Third, and probably the most overlooked, is the dropped connection. VPN clients occasionally fail, especially on flaky hotel Wi-Fi in places like Cairns or regional New South Wales. Without a kill switch that blocks all traffic when the tunnel collapses, the device silently reconnects through the ordinary internet for a few seconds, long enough to send a request that the ISP can read in full. The user experiences nothing unusual, but the privacy guarantee of the session has been quietly broken. A fourth subtle issue is IPv6. Many VPNs route only IPv4 traffic through the tunnel while IPv6 packets escape around it. If the operating system prefers IPv6 for a destination, the request leaves the user's network in the clear.

The fifth and most pervasive leak is identity. Logging in to a Google account, a bank, or a social platform hands those services the exact URL of every page visited, stripping away most of what the tunnel was meant to obscure. Biometric logins deepen the problem by binding a session to the body in a way that cannot be rotated once compromised. Before relying on a fingerprint reader or a face scan, it is worth reading why you should avoid biometric authentication for everyday devices and treating any biometric shortcut with the suspicion it deserves.

Australia's data retention regime and what it means for you

Australia's metadata retention scheme, in force since late 2017, requires internet service providers and mobile carriers to store a defined set of records for at least two years. The set is broad: subscriber details, source and destination identifiers, the dates, times and durations of communications, and the type of service used. Importantly, the content of communications is excluded, but the boundary between content and metadata is contested, and several court decisions have pressed against it.

For a resident of Melbourne or Adelaide, this means the quiet assumption that an ISP will simply forget what its customers did is no longer accurate. Under the regime, agencies including the Australian Federal Police, state police, the Australian Security Intelligence Organisation, and the Australian Criminal Intelligence Commission can request metadata without a warrant in defined circumstances, and the volume of requests has grown year on year. The Telecommunications (Interception and Access) Act also allows the Attorney-General's Department to issue authorisations that compel cooperation without disclosure to the target.

Layered on top of this is the Assistance and Access Act of 2018, which gives authorities the power to compel providers to build new capabilities into their products, including in some cases the weakening of encryption. For users who choose an Australian-domiciled VPN, the practical effect is that the company may be required to add features that undermine its own privacy claims, and refusal is a narrow path. None of this makes a VPN useless; it simply means the location of the provider, the legal regime it operates within, and the design of its software all carry weight beyond the simple promise of encryption.

Hardening your setup beyond the basics

A VPN is one layer in a stack, not a finished privacy system. The first practical improvement is to force every DNS query through a resolver that the ISP cannot see. Modern operating systems support encrypted DNS standards such as DNS over HTTPS and DNS over TLS, and many VPN clients now offer their own resolvers. Testing the configuration on a public site that reports the resolver in use is a quick way to confirm that no requests are leaking to Telstra, Optus, or another carrier.

The second improvement is to remove habits that quietly strip the privacy the tunnel provides. Logging in to a Google account, for instance, hands that company the full URL of every page visited, and by extension a great deal of what the VPN was meant to obscure. Browser compartmentalisation, separate profiles for work and personal life, and resistance to the convenience of single sign-on all narrow what a single observer can assemble.

Finally, there are situations where a VPN is simply the wrong tool. For communications that could attract serious scrutiny, a separate device and a separate identity are worth considering. Building a burner phone strategy for sensitive conversations, kept away from the daily driver and used only when needed, removes the link between the user and the message at the level the network cannot bridge.

Start with a small audit before changing anything else: open the VPN client, enable the kill switch, and confirm that DNS queries are routed through the tunnel rather than the provider's resolvers. Run a leak test, record the result, and only then place trust in the rest of the stack.