They don’t need to. DNS is still mostly in the clear, and SNI is still unencrypted so they may not know exactly what you are reading, but they definitely know w

They don’t need to. DNS is still mostly in the clear, and SNI is still unencrypted so they may not know exactly what you are reading, but they definitely know what sites you are on.