You're right, but the article may be confusing two things: First, ISPs tried injecting a header ("supercookie") into HTTP requests, which won't work over HTTPS

You're right, but the article may be confusing two things: First, ISPs tried injecting a header ("supercookie") into HTTP requests, which won't work over HTTPS unless they MITM certificates (not easy). Second, because they provide the last-mile connection, they know your MAC address, connecting location, and billing information, and can see every host you contact. That's a whole lot of surveillance capital.