Using Tor: Tor provides limited anonymity. The best-documented and best-tested attacks against Tor have one demanding requirement – that the attacker have access to the network infrastructure carrying the traffic.
De-anonymising Tor traffic works even better if you're able to see traffic at both ends – where it enters a network, and where it leaves the network.
While it's paranoid to think that any government would bother de-anonymising Tor on a mass scale, it's fair to say that if you, as an individual, end up being of interest to spooks, you can be identified – at least in theory.
For reference, I don't have enough rep to post more than 2 links, so the pastebin file contains the references.
The ISP can't see http/https requests or DNS queries. It can see that traffic is encrypted:
"The only thing the ISP can see is encrypted traffic heading to a tor server, so they can tell your using tor, but the data that is sent is totally encrypted, and they cant see it. also the exit node routes the encrypted website data back to you through the tor network, so the only node that your isp can see that you received data from is the entry node."
However, because they know that you are using TOR, they could (and probably do) measure the amount of traffic going over. They already measure the amount of traffic, and (I assume) it would be trivial to add a filter for TOR connections and measure that bandwidth usage separately.
Also, there are bad actors that can intercept traffic anyway: F-secure source
And here's a statement from a person who has set up a virtual ISP:
Firstly, an ISP "owns" the connection for administrative purposes, so in simple terms "anything is possible". That is - in the same way that you have control of your computer, the ISP has control over their network. They can do pretty much whatever they want with it because you connect through it.
This being said, they can tell when you are actively doing something vs not doing anything, as the traffic going over the line, although encrypted, would increase. They can't tell what it is or what you are doing, just whether you are active.
And TOR can be differentiated from other protocols.
Unsettling, isn't it?