Digital Phenotyping via Passive Network Traffic Monitoring: Feasibility and Acceptability in University Students (Preprint)

BACKGROUND Digital behaviors such as sleep, social interaction, and productivity reflect how individuals structure daily life. Among university students, online activity patterns mirror academic schedules, social rhythms, and lifestyle habits, with disruptions linked to sleep, stress, and well-being. Existing approaches—including wearables, apps, and surveys—yield useful insights but depend on self-report or active participation, limiting adherence in real-world use. Passive sensing of network traffic provides a scalable and less burdensome alternative, enabling unobtrusive capture of smartphone usage patterns while preserving privacy. OBJECTIVE This study evaluated whether encrypted smartphone network traffic, collected via a standard virtual private network (VPN), can be used to capture patterns of digital behavior. We assessed feasibility (sustained data capture) and acceptability (usability, burden, and privacy perceptions), and examined whether traffic-derived features reveal aspects of digital behavior—including timing, intensity, and regularity—relevant to health and daily functioning. METHODS We conducted a two-week prospective observational study at New York University. Thirty-eight students enrolled; 29 provided valid network data, 27 remained active for more than five days, and 25 completed the exit interview. Participants installed the WireGuard VPN client on personal smartphones, which enabled passive capture of encrypted network traffic. Feasibility was assessed across two domains: user retention and data coverage. Acceptability was evaluated using the System Usability Scale (SUS), NASA Task Load Index (NASA-TLX), and semi-structured exit interviews. Beyond evaluating feasibility and acceptability, we conducted exploratory analyses that visualized traffic-derived features in relation to digital activity patterns. RESULTS Of the 29 participants who contributed valid data, 27 (93%) remained active for more than five days. Mean data coverage was 74.1% (median 77.1%). Participants contributed an average of 311.6 hours of monitored traffic (~13 days, SD 3.5), with totals ranging from 121 to 496 hours. Usability ratings were high (mean SUS score = 78) and perceived workload low (NASA-TLX scores minimal). Participants described the system as easy to install, unobtrusive, and generally trustworthy, though some reported temporarily disabling the VPN during activities they considered private. No inferential statistical tests were conducted; analyses were descriptive. Exploratory analyses indicated that traffic-derived features reflected daily digital activity rhythms and revealed distinctive lifestyle patterns, including gaming and irregular late-night food delivery use. CONCLUSIONS VPN-based monitoring of encrypted smartphone traffic was feasible and acceptable, enabling sustained passive data collection with minimal burden. The findings demonstrate the potential of this approach as a scalable and device-agnostic method for digital phenotyping—capable of capturing fine-grained behavioral rhythms while preserving privacy. With broader validation and deployment, the technique could expand the toolkit for studying health, well-being, and cognitive function in everyday life. CLINICALTRIAL Not applicable. This study was not registered as a clinical trial because it did not involve randomization.