Can My Employer See My Browsing History on Company Wi-Fi?

They can see where you went. They usually cannot see what you did there. On a personal phone connected to the office Wi-Fi, the network owner gets a list of the domains your phone talked to, when, and how much data moved, and that list exists whether or not anyone ever reads it. What is on the page, what you typed into a search box, what you said in a message and what you entered in a form are encrypted, and the network cannot open them. The exception is a device the company manages, where an inspection certificate turns the encryption into something the company can read.

Most pages that rank for this question get it wrong in one direction or the other. One well ranked article claims the router owner can see your search terms, which has not been true for ordinary web traffic in years. Others promise that incognito or a VPN makes you invisible. This page sets out what the network actually sees, why the privacy upgrades you may have heard about do not help on a work network, how a device gets tied to you, and what US law says.

What the network sees, and what it cannot

An HTTPS connection leaks the destination in three places and protects everything else.

The left column rests on standards, not vendor claims. Cloudflare's explainer on DNS notes that ordinary DNS queries "are sent in plaintext" and "even if a website uses HTTPS, the DNS query required to navigate to that website is exposed." RFC 8744, the IETF's own account of the problem, says the SNI extension "is carried in cleartext in the TLS ClientHello message" and lists "firewalls within enterprise networks blocking websites not deemed appropriate for work" as a current use of it.

The right column rests on the same documents, and on the vendors whose equipment sits in the server room. Cisco's documentation for its Meraki firewalls says that for HTTPS "it is not possible to see the actual URLs being requested by the client device" and that content filtering "can classify and block only domains, not full URLs, when TLS/HTTPS is in use." The EFF's HTTPS FAQ puts the whole picture in one sentence: HTTPS "does not conceal the identities of the sites you access, or the amount of time you spend using them, or the amount of information you upload or download," while protecting "the contents of the site."

What the owner sees in practice is a per client page in the firewall dashboard. Meraki's hostname visibility feature, when enabled, lists for each device the applications, the destination hostnames, and the bytes sent and received. So "YouTube, 2.1 GB, Tuesday afternoon" is visible. Which video is not.

Incognito does nothing here

Private browsing changes what your own device stores. Google's description of Incognito says it "limits the information that's saved to your device," that it "doesn't make you invisible," and that your activity may still be visible to "organizations that manage your network, like your school, employer, or internet service provider." Firefox's page on private windows says the same: "your actions could be visible to the websites you visit, your employer or school, or your internet service provider." The DNS lookup and the SNI field are identical in a private window. Deleting your history afterwards has the same effect on the network logs, which is none.

Why encrypted DNS and ECH do not help on work Wi-Fi

Two technologies close the two leaks in the table. DNS over HTTPS hides the lookup inside ordinary web traffic, and Encrypted Client Hello, standardized as RFC 9849 in March 2026, encrypts the SNI field so an observer sees only that you connected to a content network, not which site. On your home network, with a modern browser, both may be on. On a corporate network, three things switch them off, and you get no warning.

Browsers defer to managed networks. Chrome, per the Chromium blog, "will disable Secure DNS if it detects a managed environment via the presence of one or more enterprise policies." Firefox checks for enterprise policies and for a canary domain the network can block, and turns DNS over HTTPS off when it finds either.

Firewalls block the keys ECH needs. ECH only works if the browser can fetch the server's key from a DNS record, and the RFC itself notes that "in managed enterprise settings, one approach may be to disable ECH entirely via group policy." Palo Alto Networks "currently recommends blocking all DNS record types used by ECH." Fortinet's firewalls can strip the ECH response from DNS or block the encrypted hello so that "TLS falls back to using a plaintext ClientHello." Zscaler describes returning a DNS failure for those records so the client proceeds with "a conventional TLS connection." Cisco Umbrella's bypass prevention guide tells administrators to block known DNS over HTTPS providers at the firewall and enable the content category that catches the rest.

The fallback is silent. When the key does not arrive, the browser sends the ordinary, readable hello. Nothing on screen tells you the privacy feature stood down. On a network you do not control, assume the domain is visible.

The managed device exception

Everything above assumes the phone or laptop does not trust the company. A company managed device does, and that changes the right column of the table.

Enterprise firewalls can decrypt HTTPS by standing between the device and the website. Palo Alto's forward proxy documentation describes the result plainly: "traffic that matches the rule is converted to cleartext." For that to work without an error on every site, the device must trust the firewall's certificate, which the same page says is usually pushed "via an Active Directory Group Policy Object." Fortinet's deep inspection and Zscaler's service, which calls itself "an SSL/TLS man-in-the-middle proxy," work the same way. On a device with the certificate installed, full URLs, page content and form data are readable. On a personal phone without it, every app and browser would throw a certificate warning the moment inspection started, which is why employers do not do it to devices they do not manage.

The test is simple. On an iPhone, Settings, then General, then VPN and Device Management shows a management profile or an installed certificate. On Android, a managed device says so in Settings and on the lock screen. If neither is present, the network sees domains. If either is, assume it sees everything. Our guide to what an employer can see on a personal phone covers the management side in detail.

How they know the phone is yours

A domain list is only interesting if it attaches to a name, and four things attach it.

• The Wi-Fi address. Both Apple and Android now randomize it, but per network. Apple's private address documentation says the device "identifies itself to each network using a different Wi-Fi address," and under the default setting that address does not rotate on the same network. Android derives the address from the network profile and keeps it "until a factory reset." The office sees the same identifier for your phone every day.
• The hostname. When a phone asks the network for an address it usually sends its name in the request, which on many phones is still the owner's name.
• Your login. On a corporate network secured with 802.1X, the firewall's client page shows "the username the client sent via 802.1X authentication." Meraki's client details page lists it alongside the address, the manufacturer and the operating system.
• The guest portal. A splash page that asks for an email, a company account or an SMS code records that against the device. Meraki notes the phone number appears as the recent user on the clients page.

Guest Wi-Fi, VPNs and mobile data

Guest networks are separated from the internal network so that a visitor's laptop cannot reach the file server. They still exit through the owner's gateway, and the filtering and logging configured there apply to the guest network as well. Guest Wi-Fi is private from the company's computers, not from the company.

A VPN on your own phone moves the destinations and content inside a tunnel, so the network sees a connection to one VPN server, its timing and its volume. It does not hide that a VPN is in use, and the device identifiers above sit below the tunnel. Corporate firewalls have a category for VPN and proxy traffic and can block or flag it, and many acceptable use policies prohibit it. A VPN on a company managed device hides nothing from the device's own management software. Our guide to whether a work laptop can be tracked covers the laptop side.

Mobile data is the clean answer. Traffic over the cellular connection never touches the employer's network, so none of the above applies. The carrier takes the network owner's seat. For anything you would not want on the office domain list, switching Wi-Fi off for a minute is simpler than every workaround on this page.

What US law says

The federal rule is that a network owner may monitor its own network. The Wiretap Act, at 18 U.S.C. 2511, allows an agent of "a provider of wire or electronic communication service" to intercept communications on its facilities "in the normal course of his employment while engaged in any activity which is a necessary incident to the rendition of his service or to the protection of the rights or property of the provider." It separately allows interception "where one of the parties to the communication has given prior consent," which the acceptable use policy you accepted when you joined the network provides.

Three states add a notice duty. New York's Civil Rights Law 52-c requires private employers to give written notice on hiring to employees whose email, internet use or transmissions are monitored, acknowledged and posted. Connecticut's 31-48d defines electronic monitoring as "the collection of information on an employer's premises concerning employees' activities or communications by any means other than direct observation," a definition broad enough to reach a personal phone on the office network, and requires prior written notice of the types of monitoring. Delaware's 19 Del. C. 705 requires a daily electronic notice or a one-time acknowledged notice before monitoring "employer-provided" email or internet access, which is a reasonable description of company Wi-Fi. Our guide to employee monitoring laws by state has the wording and penalties.

Nothing we found addresses a personal phone on company Wi-Fi specifically. Employment lawyers who write about it draw the line at the device: an employer "can generally track the websites you visit on their network" because it is "monitoring their own systems, not your personal device itself," while a search of the phone's own contents is a different and much harder thing to justify. That matches the technical picture exactly. The network is theirs. The phone is yours.

What to do with this

1. Use mobile data for anything personal. It removes the employer from the path entirely and breaks no rule.
2. Do not install bypass tools on a company device. Several articles that rank for this question recommend getting around admin rights or disguising sites. On employer equipment that is a policy breach with your name on it, and the monitoring agent sees it anyway.
3. Read the acceptable use policy for the word "network." It usually states that traffic on company networks is logged, and sometimes states the retention period. That sentence is the answer to this page for your employer.
4. Ask for the monitoring notice in New York, Connecticut or Delaware. You are entitled to it, and it must describe the types of monitoring in use.
5. Check whether the phone is managed. If it is, the domain only picture does not apply and the guide to personal phone monitoring is the one to read.

If you are the employer

Three decisions keep network logging proportionate. Say in the policy what is logged and for how long, because "we log DNS for 30 days for security" reads very differently from silence. Do not run TLS inspection against devices you do not manage; it fails loudly and signals an intent you will have to defend. And keep guest Wi-Fi genuinely for guests, with the same written notice that the corporate network carries, since in Connecticut and Delaware the statutes reach it. The monitoring policy template and the privacy line cover the wording.

Key takeaways

• On company Wi-Fi the network owner sees the domains your phone contacts, when, and how much data moved. The DNS lookup and the TLS Server Name Indication carry the domain in the clear.
• Pages, search terms, form fields and message content are encrypted and not visible from the network. Cisco's own documentation says its firewalls cannot see URLs on HTTPS traffic.
• Incognito changes what your device stores and nothing about the network logs. Google and Mozilla both say so.
• Encrypted DNS and Encrypted Client Hello are switched off or blocked on managed networks, and browsers fall back silently to the readable version.
• A company managed device with an inspection certificate installed makes everything readable. A personal phone without one does not.
• Your phone is identifiable by its per network Wi-Fi address, its hostname, your 802.1X login or the guest portal sign-in.
• A VPN hides destinations but advertises itself and may breach policy. Mobile data removes the employer from the path entirely.
• Federal law lets a network owner monitor its own network. New York, Connecticut and Delaware require written notice. The device itself is a different legal question from the network.