I'm confused, are they actually getting the plaintext content of HTTPS traffic, or are they just harvesting connection metadata? Not that bulk metadata collecti

I'm confused, are they actually getting the plaintext content of HTTPS traffic, or are they just harvesting connection metadata? Not that bulk metadata collection isn't bad, but getting access to unencrypted data would be much worse.