What Can a PAC File Learn About the Sites You Open?
Consider the routing script and its DNS helpers separately from destination TLS, and check whether the browser strips HTTPS paths before PAC evaluation.
A PAC decision happens before the destination's HTTPS connection. FindProxyForURL(url, host) still needs routing input, including the hostname.
What else reaches the script depends on browser and version. PAC documentation describes HTTPS differences; Chromium strips sensitive path and query data. A full-HTTPS-path rule may therefore have no such input. Historical full-URL behavior is not a universal current-browser contract.
Hostname processing remains, and DNS helpers can initiate lookups during evaluation. Encryption of the later website request does not conceal that earlier routing work.
Keep the script source in the privacy assessment: manual configuration, device management or discovery. Use approved delivery and investigate unexpected changes. Confirm which script the browser actually fetched as part of that assessment. A script can select an unwanted intermediary without seeing the entire HTTPS URL.
Record browser version, effective policy, script origin and the actual function input. Those establish what this routing program can learn and influence.