&gt; Can they legally do this?<p>You should ask lawyers in your country about that.<p>&gt; Isn&#x27;t my browser sending each visited-domain&#x27;s cookies to my ISP now?<p>Yes, but that&#x27;s not different even if they didn&#x27;t hijack your sessions. Everything goes thru your ISP, so in any case, they see everything (not just cookies) that goes thru http.<p>&gt; Doesn&#x27;t this pose a security risk?<p>Yes.<p>&gt; I have no idea whom to complain to.<p>As first measure, complain with those sites and ask them to implement and enforce TLS and move all traffic to https. That way your ISP doesn&#x27;t see your traffic and can not MITM you. Then, complain to your ISP or even better find new one (after you complained to them, vote with your money).<p>Btw, TLS is really first solution (but not the only and last) to this (and many other) problems on the web.