In the US, your internet provider can legally sell your browsing history — and Congress made sure of it in 2017. Here’s exactly what your ISP can see, why incognito mode does nothing to stop it, and the one fix that covers every device in your home.

University of Michigan researchers put 281 Android VPN apps through an automated security audit. 29 leaked the browsing data they promised to hide. 76 handed your device ID to advertisers. The uncomfortable finding: you can’t tell a safe VPN from its app-store listing.