- private, secure dns, so they don't know the domains you're visiting
- https everywhere, so they can't see any of the data you're sending or receiving
All that's left is what ip's you're connecting to. Which is useless half the time, especially since most websites are behind cloudflare or some other anti-ddos proxy already.
Also, don't use the web browser that came with your phone. Some manufacturers and isp's might enjoy adding tracking into those. Some, like Apple, even got caught not encrypting amy of that.
Side note:
- https everywhere is pretty much the standard in modern web browsers
- an adblocker can still help a lot in blocking trackers
- a secure dns you can find in your browser settings
Oh, good catch! I have to say I don't usually look at what specific tls version websites use. I'll be paying attention to this for a bit