Think of it as occuring between TCP and HTTP. So you browser establishes a network connection to example.org, then negotiates to speak SSL&#x2F;TLS, and then all the web things happen over the top of that (there are minor exceptions for vhost TLS configs).<p>So no web traffic should traverse in the clear - the URL, domains, GET data, POST data, headers, etc are protected.<p><i>however</i> that does leave a surprising amount of info. Your IP address, the IP address you&#x27;re connecting to, the host domain you&#x27;re connecting to if your browser just did a DNS lookup (99% likely it did), how long you communicate with that site, the traffic shape, etc etc.<p>As a crude example: your ISP sees a DNS lookup to pornhub.com, followed by a connection to the IP address associated with that name, followed by 3 hours of fairly large packet sizes in regular repetitive patterns. It&#x27;s highly likely they can extrapolate what&#x27;s in your browser.