Think of it as occuring between TCP and HTTP. So you browser establishes a network connection to example.org, then negotiates to speak SSL/TLS, and then all the

Think of it as occuring between TCP and HTTP. So you browser establishes a network connection to example.org, then negotiates to speak SSL/TLS, and then all the web things happen over the top of that (there are minor exceptions for vhost TLS configs). So no web traffic should traverse in the clear - the URL, domains, GET data, POST data, headers, etc are protected. however that does leave a surprising amount of info. Your IP address, the IP address you're connecting to, the host domain you're connecting to if your browser just did a DNS lookup (99% likely it did), how long you communicate with that site, the traffic shape, etc etc. As a crude example: your ISP sees a DNS lookup to pornhub.com, followed by a connection to the IP address associated with that name, followed by 3 hours of fairly large packet sizes in regular repetitive patterns. It's highly likely they can extrapolate what's in your browser.