I noticed that when I hit my tethering cap, and start seeing an upsell page, my Linux vms can still access content like normal. Seems that they do all of their fancy tracking via user agent strings and consider Linux browsers as being smart phones.

If true, it means that Linux users might end up getting accused of being ToS breaking "hackers." Beware.