SNI for one ( https://www.cloudflare.com/en-gb/learning/ssl/what-is-sni/ https://www.cloudflare.com/en-gb/learning/ssl/what-is-sni/ ). The handshake contains en

SNI for one ( https://www.cloudflare.com/en-gb/learning/ssl/what-is-sni/ https://www.cloudflare.com/en-gb/learning/ssl/what-is-sni/ ). The handshake contains endpoint IP addresses, and they likely know what sites are on what IPs from either crawling the web like search engines do, or buying that data from somewhere. Size of packets. Number of packets. Size of response. If the site content is static, that could give a good idea which page was loaded. Packet frequency. Enough to say if it's probably a page load or a realtime chat or a download, etc. There are probably enough details in the handshake endpoints to tell them whether you visited Facebook in a browser or opened the Facebook app, for example. What time you went to the site, how often you go there, how long you stayed. Vodafone mobile would know which cell tower(s) you are connected to. They can probably narrow in on whether you work and roughly where you work (cell towers you connect to during the day vs. at night) and from the land use in those areas they could guess roughly what you do. They know your home address for billing, so how expensive your home is and how desirable the area is, they could also guess at that from which cell towers you connect to. What times you visit sites, whether you usually busy on a Friday evening or using your phone, whether you are regularly on gambling sites or regularly on crypto sites or healthcare sites. Yes they can't see that you typed "glasses" into a Google search, but they can see you visiting google.com then visiting zennioptical.com. They can see you visiting Reddit and then whether you load a lot of imgur pictures or a lot of video traffic or load some fashion blogs and inferr what kind of things you're interested in.