Digital Phenotyping via Passive Network Traffic Monitoring: Prospective Observational Study in University Students.

Background: Digital behaviors such as sleep, social interactions, and productivity reflect how individuals structure their daily lives. Among university students, online activity patterns mirror academic schedules, social rhythms, and lifestyle habits, with disruptions linked to sleep, stress, and well-being. Existing approaches-including wearables, apps, and surveys-depend on self-report or active participation, limiting long-term adherence. Passive sensing of network traffic offers a scalable alternative for the unobtrusive capture of smartphone usage patterns that preserves privacy. Objective: This study evaluated the degree to which encrypted smartphone network traffic, collected via a standard virtual private network (VPN), can capture patterns of digital behavior. We assessed feasibility (sustained data capture) and acceptability (usability, burden, and privacy perceptions) and examined how traffic-derived features reveal aspects of digital behavior-including timing, intensity, and regularity-relevant to health and daily functioning. Methods: We conducted a 2-week prospective observational study at New York University. Participants installed the WireGuard VPN client on personal smartphones, enabling passive capture of encrypted network traffic. Feasibility was assessed using a mixed methods approach combining quantitative measures of user retention and data coverage with qualitative analysis of semistructured exit interviews. Acceptability was evaluated using the System Usability Scale, NASA Task Load Index, and qualitative interview analysis. Exploratory analyses visualized traffic-derived features in relation to digital activity patterns. Results: Thirty-eight students consented, of whom 29 (76.3%) contributed valid network traffic data and formed the analytic cohort. Within this cohort, 93% of participants (27/29; Wilson 95% CI 78%-98%) contributed at least 5 days of monitoring, corresponding to 71% retention relative to all consented participants (27/38; Wilson 95% CI 55%-83%). The mean data coverage within the analytic cohort (n=24) was 74.1% (SD 19.3%; median 77.1%, IQR 63.6%-90.0%; bootstrap 95% CI 66.3%-81.4%). These participants contributed an average of 311.6 (∼13 d, SD 3.5) hours of monitored traffic, ranging from 121 to 496 hours. Acceptability outcomes were evaluated among participants completing the exit survey and interview. Usability ratings were high (System Usability Scale score: mean 78, SD 14.96), and perceived workload was low (NASA Task Load Index scores were minimal). Participants described the system as easy to install, unobtrusive, and generally trustworthy, although some reported temporarily disabling the VPN during activities they considered private. No inferential statistical tests were conducted; analyses were descriptive. Exploratory analyses indicated that traffic-derived features reflected daily digital activity rhythms and revealed distinctive lifestyle patterns, including gaming and irregular late-night food delivery use. Conclusions: VPN-based monitoring of encrypted smartphone traffic was feasible and acceptable, enabling sustained passive data collection with minimal burden. This approach shows promise as a scalable, device-agnostic method for digital phenotyping that captures fine-grained behavioral rhythms while preserving privacy. With broader validation, this technique could expand the toolkit for studying health and well-being in everyday life.