The weak link in the privacy chain:
1. Truly pervasive encryption on the Internet is still a long way off.
2. Even with HTTPS, ISPs can still see the domains that their subscribers visit.
3. Encrypted Internet traffic itself can be surprisingly revealing.
4. VPNs are poorly adopted, and can provide incomplete protection.
Source: What ISPs Can See