Online Privacy

How Internet Surveillance Really Works

Who can see what you do online? Your internet provider, the Wi-Fi owner, your employer, advertisers — and, with legal authority, the police. Each of them sees a different slice, and the slice depends on how you connect and where you live. This guide maps it, party by party and country by country.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Who sees what: one request's journey

When you visit a website, your request passes through several hands. Your internet provider carries it and can see which site you connect to, when, and how much data moves. The Wi-Fi owner — a café, a hotel, an employer — can see the same on their network. The website sees your IP address and what you do on its pages. Advertisers and analytics firms whose code runs on the page see you visit. Each party sees a slice; nobody ordinary sees the whole journey — unless the connection is unencrypted, in which case anyone on the path can read the content too.

Connection type	Your provider sees	The website sees
Plain HTTP (no encryption)	Which site, and the full content	Your IP address and everything you send
HTTPS (the normal modern web)	Which site, when, how much — not the page content	Your IP address and your activity on the site
HTTPS + VPN	Encrypted traffic to the VPN only	The VPN server's address, not yours
Tor	That you use Tor, not the sites	The Tor exit relay's address, not yours

The single most important row is HTTPS. Most of the modern web uses it, and it is the reason your provider cannot read the content of your browsing. Check for the padlock and "https" in the address bar — and remember that HTTPS encrypts content, not the fact of the visit. Your provider still knows which site you connected to. For the full picture of what a VPN adds and what it does not, see our guide to what a VPN hides, and for tracking beyond the network, our how websites track you guide.

Can the police monitor your internet activity?

The short answer: with legal authority, yes — and the authority required differs by country. In the United States, law enforcement generally needs a court order or warrant to compel a provider to hand over communications content, and providers keep different records for different periods; metadata such as connection logs is obtainable under a lower standard. In the United Kingdom, the Investigatory Powers Act 2016 sets out how communications data can be obtained, with authorisation and oversight requirements. In the European Union, the picture varies by member state and is bounded by EU law, which has limited blanket data-retention. In Pakistan and other countries with broad interception laws, the state's powers are wider and the oversight thinner. Every one of these summaries is general: the law changes, court rulings shift the boundaries, and this site does not give legal advice. Last checked: 14 November 2026.

What is consistent everywhere is the mechanism. The police do not usually sit watching your connection in real time. They ask your provider for records — connection logs, account details, sometimes content — under whatever legal process applies. That is why retention matters: how long your provider keeps logs decides what exists to be requested. And it is why a VPN's protection is limited: it moves the records from your provider to the VPN company, which can itself be compelled under its own country's law.

Your employer, your school, your Wi-Fi owner

On a device or network owned by an employer or school, assume monitoring. Employers in most countries may monitor work devices, work email and work networks, usually with a policy or notice, and they commonly log which sites are visited and which files are accessed. A personal device on a work network is more private, but the network owner can still see which sites you connect to. The same logic applies to a café or hotel network: the owner can see the connections, though HTTPS stops them reading the content. This is the strongest case for a VPN — see our do I need a VPN guide — and the strongest case for never doing anything sensitive on a network you do not trust.

Government surveillance: what it is and is not

Government surveillance is real, and it is also widely misunderstood in both directions. Governments can compel providers to hand over records, can monitor specific people with legal authority, and some countries run mass collection programmes that have been documented by journalists and court cases. What does not happen is a person sitting and reading every message of every citizen in real time: the volume is too large, the law in most democracies forbids it, and the programmes that do exist are targeted at specific accounts, devices or keywords under some form of authorisation — the quality of that authorisation varying enormously by country. The honest position is between the two extremes: you are not watched every second, and you are not invisible either. If you want the technical detail, our can you be tracked on Tor guide explains what Tor hides from each party, and our metadata guide explains why encrypted messages still leak who talked to whom.

What you can actually do

1. Use HTTPS everywhere. Check the padlock; do not enter passwords or card details on a page without it.
2. Know your network. Treat public and work Wi-Fi as watched. Use a VPN on networks you do not trust.
3. Keep work and personal separate. Do not do personal browsing on a work device, or work on a personal account from a work network.
4. Limit the records. Block trackers, delete old accounts, and keep your digital footprint small — fewer records means less to be requested.
5. Understand the limits. No tool here makes you invisible to the law. A VPN, Tor and encryption change who sees what — they do not remove the view.

Sources

• Electronic Frontier Foundation — surveillance and privacy explainers (eff.org). Last checked: 14 November 2026.
• Tor Project — Download Tor Browser (torproject.org, 2026). Last checked: 14 November 2026.
• Investigatory Powers Act 2016 (UK) and US Stored Communications Act — cited by name only; summaries are general information, not legal advice. Last checked: 14 November 2026.
• Learn Dark Web Editorial Policy — how this site researches and checks its guides (2026).

Last checked: 14 November 2026.

Frequently asked questions

Can the police monitor my internet activity?

In many countries the police can obtain records of your internet use through a court order or warrant, and the exact rules depend on the country. The police do not usually watch individuals in real time without legal authority, but your provider keeps records they can request. This page explains the rules country by country — it is general information, not legal advice.

Can my internet provider see what I do online?

It can see which sites you connect to, when, and how much data you move. With HTTPS it cannot see the content of most pages. With a VPN it sees only encrypted traffic to the VPN server. Without HTTPS, it can see much more.

Can my employer see what I do on a work device?

Generally yes, on a device or network they own. Employers commonly monitor work devices, work email and work networks, and the law in most countries allows it with notice or a policy. Assume anything on a work device is visible to your employer.

Does the government track everything on the internet?

No — that overstates what is technically and legally possible. Governments can compel providers to hand over records, can monitor specific targets with legal authority, and run mass collection programmes in some countries. Wholesale real-time monitoring of every person is not how the system works, and the rules differ sharply by country.

Does a VPN protect me from surveillance?

A VPN moves the view from your internet provider to the VPN provider — it does not remove the view. The VPN provider can see your traffic, and governments can compel VPN companies under their own law. No tool in this guide makes you invisible to the law.