Can my employer see my browsing history? Device by device

The answer changes with two things: who owns the device in your hand, and whose network it is connected to. Incognito mode and deleting your history change nothing.

Short answer: on a work-issued device, yes, assume your employer can see the websites you visit, on any network and in incognito mode. On your own device connected to work Wi-Fi, the company can see which sites you visit but not the pages. On your own device on your own connection, your employer cannot see your browsing.

What your employer can see in each situation

Can my employer see my browsing history on a work computer or work phone?

Yes. On a device the company manages, the recording does not happen in the browser, so nothing you do in the browser removes it.

A managed computer usually runs security software that reports back to the company. In Microsoft's Defender for Endpoint, the web content filtering feature exists to "track and regulate access to websites," works on managed devices "whether users are on your network or away," and gives administrators reports that list the domains that were accessed or blocked.

Dedicated monitoring products go further. A 2022 memo from the general counsel of the US National Labor Relations Board described employers that "monitor employees' computers with keyloggers and software that takes screenshots, webcam photos, or audio recordings throughout the day." The memo was rescinded in February 2025, but the tools it described are still sold.

Company phones work the same way. On a company-owned Android phone, the management app can switch on network logging, which records every DNS lookup and every connection attempt along with the app that made it. On a company-owned iPhone, Apple lets the organization route web traffic through its own proxy "at school or business and at home," and Apple's page on supervised devices says you may see a message in Settings that your organization can monitor your internet traffic.

That is why the answer for a work device stays yes at home and off the company network. The monitoring travels with the device.

Can my employer see what I browse on my personal phone on work Wi-Fi?

Partly. Whoever runs a network can log which sites each device connects to, at what time, and how much data moves. With HTTPS, the network cannot see the specific page, your searches, or anything you type. A company firewall knows your phone connected to a job board at 1:15pm. It does not know which listing you opened.

There is one exception. Many companies run TLS inspection, where a security gateway decrypts HTTPS traffic, reads it, and encrypts it again. Cloudflare's documentation for its own gateway describes the process plainly: it will "decrypt all traffic sent over HTTPS, apply your HTTP policies, and then re-encrypt the request." This only works on devices that have the company's root certificate installed and trusted. Work devices do. Your personal phone does not, unless you installed a certificate or profile to get onto the office Wi-Fi. If you did, the company can read the content of your browsing on that network. If you only typed in a Wi-Fi password, it sees site names and nothing more. On mobile data, it sees nothing at all.

Can my employer see my browsing history at home on my own device?

No. On a personal computer or phone with no work software, connected to your home internet or mobile data, your employer has no technical way to see the sites you visit.

Three things move you out of this safe case:

• Work accounts. Anything you do inside a work account is visible to the company no matter which device you use. That includes work email, files, and chat, as we explain in whether your boss can read your Slack messages.
• A work profile in your browser. If you sign in to Chrome with a work account, that browser profile can be managed. Google says an administrator of a managed browser can "set up or restrict certain features, install extensions, monitor activity, and control how you use Chrome." Keep personal browsing in a separate personal profile.
• The company VPN. While a company VPN is connected, some or all of your traffic goes through the company network, where it is logged like any office traffic. Disconnect when you finish work.

What can MDM see on a personal phone?

Less than most people fear, if the phone was enrolled the way Apple and Google intend for personal devices.

iPhone and iPad. Apple publishes a table of what each enrollment method allows. "View Safari browser history" is marked not allowed for every method, including full company ownership. So are viewing personal mail, messages, and call logs. With User Enrollment, the method Apple designed for employee-owned devices, the company also cannot list your personal apps, set up a device-wide VPN, or erase the whole phone.

The stronger enrollment types allow more. If your iPhone was enrolled with a full device profile, the company can list all installed apps and configure a VPN for the device. Apple's documentation notes that when traffic goes through a VPN, "network activity can be monitored and filtered." The company still cannot open Safari's history, but it can log traffic that passes through its tunnel.

Android. A work profile splits the phone in two. Google's Android Enterprise help says: "Apps and data in your personal profile aren't visible to your organization." The company can see the work profile's apps, the managed account, and network activity from work apps, plus device details such as model, serial number, and phone number. A VPN set up inside the work profile does not carry traffic from your personal apps.

How to check whether your device is managed or inspected

1. iPhone or iPad. Open Settings. A supervised device shows a supervision message at the top of the main Settings page. Then go to Settings > General > VPN & Device Management and tap any profile to see what it controls, including certificates and VPN settings. Certificates you installed by hand appear under Settings > General > About > Certificate Trust Settings.
2. Mac. Open System Settings > General > Device Management. An empty list means no configuration profiles are installed.
3. Android. Go to Settings > Passwords and accounts and look for a Work tab, which means a work profile exists. For certificates, open Settings > Security & privacy > More security settings > Encryption & credentials and look at the user credentials and the User tab of the trusted credentials list. Menu names vary between phone makers.
4. Windows. Open Settings > Accounts > Access work or school. A connected work account shows up there.
5. Chrome. Open the menu at the top right. If the bottom says "Managed by your organization," the browser is managed. Google's help page also points to chrome://management, which lists what the administrator has set up.
6. Any browser, any device. Open a well-known HTTPS site, click the icon next to the address, and view the certificate. Look at who issued it. A public certificate authority is normal. If the issuer is your company's name or a security product, your HTTPS traffic is being decrypted and inspected on that device or network.

On a work device all of this is expected. It is the company's equipment and these controls protect it, so do not try to remove or work around them. Keep personal browsing off the device instead.

Is it legal for my employer to monitor my browsing?

This is general information, not legal advice. The details depend on where you work.

United States. Federal law is permissive. The Electronic Communications Privacy Act bans intercepting communications, but 18 U.S.C. 2511(2)(d) makes it lawful when "one of the parties to the communication has given prior consent," and the acceptable-use policy you accepted when you were hired is usually treated as that consent. The federal statute does not require an employer to tell you about monitoring. A few states do:

• New York. Civil Rights Law section 52-c requires written notice on hiring that phone, email, and "internet access or usage" may be monitored. You must acknowledge it, and it must be posted where staff can see it. Civil penalties run up to $500 for a first violation, $1,000 for a second, and $3,000 for each one after that.
• Connecticut. General Statutes section 31-48d requires prior written notice of the types of electronic monitoring used on the employer's premises. Penalties follow the same $500, $1,000, and $3,000 steps.
• Delaware. Title 19, section 705 bars monitoring of email and internet use unless the employer gives an electronic notice each day or a one-time notice that the employee acknowledges. The civil penalty is $100 per violation.

United Kingdom. The Information Commissioner's Office says in its guidance on monitoring workers that data protection law "does not prevent you from monitoring workers," but employers must make workers aware of what is collected and why, and must have a lawful basis. It adds that workers' expectations of privacy "are likely to be significantly greater at home than in the workplace."

European Union and wider Europe. The GDPR applies the same transparency and proportionality tests. In Barbulescu v. Romania (2017), the European Court of Human Rights found a violation of the right to private life after an employee was dismissed over monitored messages, because the national courts never checked whether he had been told in advance.

The common thread: monitoring work systems is generally allowed, and what the law mostly adds is a duty to tell you. That makes your company's monitoring policy worth reading.

How to keep your personal browsing private from work

1. Use your own device for personal things. Job searches, health questions, and banking belong on a phone or computer the company does not manage.
2. Use your own connection. At the office, mobile data keeps your personal phone off the company network entirely.
3. Keep personal accounts off the work laptop. Do not sign in to personal email there. Give recruiters, doctors, and banks a personal address, not your work one. Secria Mail is built for that role: mail is stored under zero-access encryption, tracking pixels are removed automatically and senders never see your IP address, and there is a free plan.
4. Choose the lightest enrollment on offer. If work has to be on your phone, ask for a work profile on Android or User Enrollment on iPhone, and read the enrollment screen before you accept.

Keeping your personal side personal

What you control is your own phone, your own network, and your own accounts. When your personal phone or laptop has to use a network someone else runs, such as office guest Wi-Fi, a hotel, or a client site, a VPN keeps the site names you visit away from that network. Secria VPN keeps no activity logs and costs $7.99 a month on its own or comes included with Pro.

FAQ

Can my employer see my browsing history in incognito mode? On a work device or work network, yes. Incognito only stops the browser from saving history on the device. Google's own Incognito notice says organizations that manage your network, such as an employer, may still be able to observe your activity. The full list is in what incognito mode hides.

Can my employer see my browsing history if I delete it? Yes, if it was recorded in the first place. Deleting history clears the copy in your browser. Logs kept by monitoring software or the company network are out of your browser's reach.

Can my employer see my browsing history if I use a VPN? On a work device, a personal VPN does not hide anything from software running on the device itself. The company VPN does the opposite of hiding: it sends your traffic through the company network. On your own device, a personal VPN does hide site names from a Wi-Fi network you do not control.

Can my employer see my personal phone's browsing on mobile data? No, not on a personal phone with no work management. Mobile data does not touch the company network. With a work profile, only the work apps report to the company.

Does using DuckDuckGo or another private search engine hide my searches from my employer? No. A private search engine limits what the search company keeps. It does not change what a managed device or an inspected network can record.