Does a UK VPN Store Your Browsing History? Read the Notice

A subscription page cannot answer the retention question, and neither can the operator's country of registration on its own. The framework that matters here is Part 4 of the Investigatory Powers Act, which works through retention notices served on telecommunications operators rather than through a blanket rule that every VPN keeps every browsing record. Whether your provider is covered, and what it must keep, are two separate questions with two separate answers.

What the Question Actually Asks

People usually mean "what does my provider hold about me", while the law answers "what must this operator retain under a notice it was served". The two overlap without being identical. An operator can hold data for its own operational reasons and retain nothing extra under a notice, or the reverse. Answering one and believing you answered the other is where most of this conversation goes wrong.

Start by separating the statutory duty from the ordinary product policy.

Then separate the categories. Communications data and the contents of communications are treated differently, and a phrase like full logs names neither of them. A list of what is collected, why, who can reach it and how long it lives tells you more than any adjective in a marketing claim.

Scope: Which Operator, Which Data, Which Instrument

A retention notice applies to an operator, and that term covers a fact-dependent category rather than a tidy list of company types. Charging a subscription settles the classification in neither direction. Whether a particular service falls inside it is a question for a qualified adviser holding the actual facts.

A notice also specifies data and arrangements rather than simply everything. The published code of practice describes the tests applied, including necessity and proportionality, and the approval role of a Judicial Commissioner. Read that mechanism before reading a summary, because it explains why two providers under one Act can carry very different obligations. The code is also explicit that the regime is not a universal retention mandate.

Keep this mechanism apart from interception, from equipment interference, and from requests for data already held. Each has its own conditions and its own approvals.

Two Records, Kept Separately

For ordinary operation, keep an account of what you process, why, who may access it, and how long you keep it. Account and support records count, along with anything tunnel-related, and a statement about one category should never be allowed to cover the others by implication.

For a formal demand, preserve the instrument and route it to the responsible reviewer without delay.

Ask which entity and which service it covers, what action it requires, what deadlines apply, and what review exists. Check any confidentiality restriction before publishing or discussing it, since the code contains limits on disclosing a notice's existence or contents. Those limits belong in the handling procedure rather than in the afterthought.

What a Public Policy Can and Cannot Tell You

When comparing providers, look for a precise policy with a scope statement rather than a reassuring sentence. A useful one names the categories held, the retention period for each, and the legal basis it relies on. It also states which entity is the contracting party, because a brand and its operating company are not always the same. Vague reassurance and vague alarm are equally uninformative.

An absence of published notices is not a technical inventory either, since disclosure limits can stop an operator confirming one.

Treat the published code as the framework and your provider's own documents as the claim to be checked against it. Where the two do not meet, ask a written question that names the data category and the retention period. The answer, or the refusal to answer, is worth more than another forum thread about what a country supposedly requires.