What Your Phone Carrier Can See — Even With a VPN

This video was made possible by Proton VPN in support of PCMag’s independent editorial journalism.

VPNs are designed to create secure connections, but they don’t make you invisible to your wireless carrier. They can still see your identity, where you are, and who you’re talking to. Here’s what you should know.

You can find the products mentioned in this video linked below Proton VPN: https://zdcs.link/9lx1GN PCMag may get a commission on this offer.

0:00 What your VPN hides (and what it doesn’t) 0:44 1. Identity (IMSI & IMEI) 1:07 2. Location & Cell Towers 1:31 3. Calls & Texts Metadata 1:50 4. Data Volume 2:08 The FCC Fines Carriers 2:54 Carpenter v. United States 3:23 What can you actually do? 4:01 Does an eSIM protect privacy? 4:32 VPN History Trivia

Read more on PCMag.com Add PCMag as a trusted news source https://www.google.com/preferences/source?q=pcmag.com Check out PCMag’s Amazon Storefront: https://zdcs.link/aNJxW2 Subscribe to PCMag’s YouTube: https://www.youtube.com/c/PCMag Facebook: https://www.facebook.com/PCMag Instagram: https://www.instagram.com/pcmagofficial Pinterest: http://www.pinterest.com/pcmag LinkedIn: https://www.linkedin.com/company/pc-magazine/ X: https://x.com/PCMag

#VPN #Privacy #TechSafety #DataProtection #Cybersecurity #CellCarriers #MobilePrivacy #PCMag

What Your Phone Carrier Can See — Even With a VPN

In an era where online privacy is a growing concern, many users assume that turning to a virtual private network (VPN) automatically severs all ties to their data trails. While a VPN can dramatically improve anonymity and encrypt traffic between your device and the VPN server, it does not render you invisible to every watcher. Your phone carrier sits higher in the communication chain than many apps and services, and some metadata and patterns can still reveal a surprising amount about your activity. Here’s a clear, practical look at what a carrier can see, what a VPN can protect, and where privacy trade-offs tend to tighten.

What a carrier typically can observe Top-level network visibility is dictated by the role carriers play in routing traffic. Even when you’re connected to a VPN, most carriers can still see and log certain information, including:

DNS requests (in some configurations): If your device uses the carrier’s DNS resolvers, or if DNS leaks occur, the carrier can see which domains you’re attempting to reach, even if the content is encrypted. – IP addresses associated with traffic: Your device emits connections to IPs, including the VPN server’s IP when using a VPN. The carrier can observe the source and destination IP pairs that your data packets traverse at various network nodes and up to the edge of their network. – Volume and timing metadata: The amount of data sent, duration of sessions, and timing patterns can be diagnostic. This metadata can be correlated with other data sources to infer usage patterns, even if the content is encrypted. – Destinations and endpoints: When traffic is not traversing a VPN, your carrier can see the websites or services you are accessing. Even with a VPN, some metadata patterns (like bursts of traffic to known VPN endpoints) can be noticeable.

What a VPN can and cannot shield A reputable VPN creates a secure tunnel between your device and the VPN server, encrypting traffic inside that tunnel and masking content from anyone on the local network or on-path observers. However, there are important limits and caveats:

Encryption of content: Inside the VPN tunnel, content is encrypted, preventing your carrier (and your ISP in many jurisdictions) from seeing the exact pages you visit or data you transfer. The VPN server decrypts the data before sending it to the final destination if the destination is not itself a VPN endpoint. – VPN endpoint visibility: The VPN server itself can see your traffic once it exits the tunnel and heads to the destination. Trust in the VPN provider is essential; a malicious or compromised provider could log or misuse data. – DNS resolution: If your VPN handles DNS requests, you reduce the risk of DNS leaks. If DNS is not properly routed through the VPN, the carrier can learn which domains you’re visiting even if the content is encrypted. – Metadata remains: While content may be hidden, timing, size, and frequency of VPN-connected sessions can still reveal behavior. Some traffic patterns can be fingerprinted to infer activities, even when using a VPN. – Smartphone apps outside the VPN tunnel: If apps use split tunneling or direct connections outside the VPN, those destinations may be visible to the carrier. Proper configuration is important to ensure all traffic runs through the VPN when privacy is the goal.

Practical steps to improve privacy against carrier surveillance If reducing what your carrier can observe is a goal, consider these best practices:

Use a reputable VPN with a solid privacy policy: Look for providers with no-logs commitments, strong encryption, and independent audits where available. – Route all traffic through the VPN: Enable full-tunnel or force all traffic through the VPN to minimize leaks and exposures. – Ensure DNS is resolved through the VPN: Use apps or OS settings that direct DNS queries to the VPN’s DNS resolver, or implement a DNS-over-TLS/HTTPS solution if supported. – Check for DNS and IPv6 leaks: Regularly test for leaks using reputable online tools to confirm that your traffic is not leaking outside the VPN tunnel. – Review app permissions and network settings: Disable or restrict apps that bypass the VPN via split tunneling unless specifically needed, and monitor for unexpected background activity. – Consider additional privacy tools: For highly sensitive use cases, combine a VPN with encrypted messaging apps, Tor for extra anonymity in specific scenarios, or privacy-focused browsers and search engines.

What to weigh when privacy is a priority Privacy is not a binary state but a spectrum shaped by technology, policy, and personal behavior. When evaluating how much to trust a VPN and how much to rely on your carrier’s visibility, consider:

Jurisdiction and data-retention laws: Different countries require carriers to retain data for varying periods and may compel access by law enforcement. – VPN provider trustworthiness: The provider’s business model, geographic location, and governance impact the risk of data exposure. – Personal threat model: For some users, the mere knowledge that the carrier can observe certain patterns is a meaningful concern; for others, the risk might be outweighed by convenience and accessibility. – Device security: A secure device with updated software reduces the risk that malware or compromised apps reveal data outside the intended channels.

Closing thoughts A VPN is a powerful tool for shifting your visibility boundaries, but it does not grant absolute invisibility from your phone carrier. Understanding what information remains visible, how to minimize leakage, and how to choose trustworthy infrastructure can help you navigate the privacy landscape with greater confidence. For most users, a well-configured VPN paired with mindful digital hygiene offers a practical balance between privacy, performance, and usability.