Understanding Digital Behaviors Through Network Traffic

When we think about digital health, we often imagine fitness trackers or apps that count steps, measure sleep, or ask us to fill out surveys. These tools are useful, but they also come with limits: people forget to use them, batteries run out, or surveys get ignored. What if there was a way to measure digital behaviors automatically, without asking people to do anything?

That’s exactly what our new study explored. Instead of using wearables or apps, we looked at encrypted smartphone network traffic—the behind-the-scenes data your phone already generates every time it connects to the internet. With the help of a simple VPN (virtual private network) app, we were able to collect this information in a way that is privacy-preserving and easy to use.

Why Study Digital Behavior?

How people use their phones—when they text, scroll, or stream—says a lot about daily life. Patterns in online activity reflect routines like sleep, study, and socializing. When these patterns are disrupted, they can signal stress, irregular sleep, or even early signs of health challenges.

Traditionally, researchers rely on wearables, surveys, or special apps. But these methods have limits: they can be intrusive, drain battery life, or depend on people remembering to log their activity.

A Different Approach

Our study explored something new: using encrypted network traffic to study digital habits. Every time a phone connects to the internet—whether to Instagram, YouTube, or food delivery apps—it leaves behind tiny data traces. These don’t reveal content (like what video you watched), but they do show when and how often a service is used.

By routing all phone traffic through a standard VPN app, we captured this metadata without touching personal content. It’s like noticing lights turning on and off in a building—you don’t know what’s happening inside each room, but you can still recognize daily routines.

The Study

We worked with 38 university students at NYU. Each installed the WireGuard VPN on their phone for two weeks. This allowed us to passively monitor their network activity in real time. Importantly, the system only collected metadata: timestamps, hostnames (like youtube.com), and traffic volume. Content stayed private.

To evaluate this approach, we looked at two things:

What We Found

Most students kept the VPN on for nearly the full two weeks. On average, we captured about 13 days of traffic per student, covering around 74% of their daily phone use windows. Usability scores were high, and participants described the system as “easy,” “invisible,” and “effortless.” Some even forgot it was running.

A few students disabled the VPN during sensitive tasks, like banking, showing that having the option to pause mattered for trust. Interviews also revealed that participants appreciated the transparency dashboard, which showed their activity patterns in real time. For some, this visualization prompted reflection on their habits—like realizing how late they stayed up or how much time they spent on social media.

Insights From Traffic

Even without knowing exact content, traffic patterns revealed clear daily rhythms. Some students showed highly regular routines, with strong day-night cycles and predictable app use. Others had more irregular patterns, like bursts of late-night food delivery traffic or scattered social media activity.

This shows the promise of network metadata as a lens into lifestyle differences—who has stable routines, who has fragmented ones—without needing invasive monitoring.

Why It Matters

This method offers a scalable, device-agnostic way to study digital behavior. Unlike apps that only work on certain phones, or wearables that require constant charging, VPN-based monitoring works across devices and platforms with minimal burden.

In the future, this approach could help researchers:

Limitations & Next Steps

Of course, there are limits. Background traffic can look like user activity, and offline behaviors leave no trace. Our student sample also may not reflect older adults or other populations. Reliability issues—like the VPN shutting off after a phone reboot—need fixing.

Still, the results are encouraging. By balancing privacy, scalability, and ease of use, encrypted traffic monitoring could become a powerful tool for understanding how digital life connects to health and well-being.

Closing Thoughts

In short: you don’t need to read messages or watch screens to learn about daily digital life. By simply observing when and how phones connect to the internet, we can begin to map the rhythms that shape how people live, study, and connect with others.

See the full preprint: https://preprints.jmir.org/preprint/84618

Authors

Rameen Mahmood (NYU), Donghan Hu (NYU), Annabelle David (NYU), Zachary Beattie (OHSU), Jeffrey Kaye (OHSU), Nabil Alshurafa (Northwestern), Lou M. Haux (MPI), Josiah Hester (GaTech), Andrew Kiselica (University of Georgia), Shinan Liu (University of Hong Kong), Chenxi Qiu (Harvard Medical School), Chao-Yi Wu (Harvard Medical School), Danny Yuxing Huang (NYU)

Questions? Contact us.