Does UK Law Force Your VPN to Keep Browsing Logs?

"UK-based, so they must keep everything" is a common shorthand, and it gets the mechanism wrong. Part 4 of the Investigatory Powers Act works through retention notices served on telecommunications operators, and the Home Office code of practice for that regime states the position plainly: an operator is not obliged to retain communications data unless a notice has been served on it. Whether your provider has one is a fact about that provider, not about the country in its footer.

That single sentence also resets the question. Instead of asking what UK law requires in general, ask which operator, which data category, and which instrument. Those three answers decide almost everything else. Everything before them is a slogan.

A notice is served, not implied

Under the framework the code describes, the Secretary of State serves a retention notice, and the code sets out how necessity and proportionality are considered along with Judicial Commissioner approval. The notice can specify the data, the services and the retention arrangements it covers. It is an instrument with a scope, not a background obligation that attaches to a business category.

So a provider's public statement that it has received no notice is a meaningful claim, and a provider's silence is not evidence either way. The code also restricts disclosing the existence or contents of a notice, which means a well-informed operator may be unable to give you the clean answer you want. That restriction is not a loophole; it is part of the regime's design. Weigh the answer accordingly.

Read the statement for what it is. A published transparency report describing requests received is a different document from a retention notice, and neither one is a complete inventory of the data a company holds for its own purposes.

What counts as a telecommunications operator

The code treats the concept broadly and fact-dependently, and it does not carve out every overlay service that happens to run over someone else's network. Charging a subscription does not settle the classification, and neither does hosting everything in another country. That is a question about the service's connections to the UK, assessed by someone qualified to assess it.

What you can do without legal training is stop treating a marketing phrase as a specification. "No logs" describes a policy. It does not describe a statutory position, and the two can both be true at once for a provider that retains nothing voluntarily and has received nothing compulsory.

Metadata is not message content

The notices regime concerns communications data, which is the who, when and how of a communication rather than what was said. Content sits under different powers entirely, with different authorisation. Lumping both into "full logs" produces arguments that cannot be resolved, because the two categories have separate legal routes and often separate retention periods.

This distinction is also the practical one for a VPN. A provider may hold almost nothing about what you sent while still holding account records, payment details, connection timestamps or support messages. Those are ordinary business records, governed by the provider's own policy and by data protection law rather than by a retention notice.

Which is why a claim about a notice cannot answer a question about account data. Two different instruments, two different sets of limits.

Keep two records, because two questions exist

For everyday purposes, write down the categories your provider says it processes, the purpose, who can access them and how long they last. Include the unglamorous ones: billing records, support tickets, fraud signals, crash reports. A statement about tunnel traffic should not be allowed to stand in for the rest.

For a formal demand, preserve the document and route it to whoever handles legal process, with the date it arrived. Ask which entity and which service it names, what action is required, what the deadlines are, and what review or appeal is available. Check the confidentiality terms before answering anyone's questions about it, including a journalist's.

Those two records answer different audiences. One tells a user what to expect; the other tells a lawyer what to do this week.

How to compare two providers without fooling yourself

Ask for a precise public policy with a scope, a date and a description of the categories it covers. Then check whether the policy distinguishes content from metadata, voluntary retention from compelled retention, and the operating company from its parent. Vague assurances survive scrutiny precisely because they never name a category.

Treat missing information as missing rather than as favourable. The regime's disclosure restrictions mean that "we have received nothing" and "we cannot say" can look identical from outside, and a comparison that scores silence as a win is measuring your own optimism.

The Home Office's notices regime code of practice is the document to read before repeating any claim about what Part 4 requires. It is longer than a blog post and considerably more careful.