How long do ISPs keep your browsing history?

It depends on where you live, and in the US on which provider you use. No US law requires an internet provider to keep a record of the sites you visit, and when the Federal Trade Commission studied six of the largest in 2021, one deleted its logs of visited websites every 24 hours, another kept them for 35 days and another for a year. In the UK, a provider served with a government retention notice can be made to keep "internet connection records" for up to 12 months, and those show the site or service, not the pages. Australia requires two years of connection data but explicitly excludes browsing history. In the EU, the law that once required six to 24 months of retention was struck down in 2014.

The answer by country, in one table

These are the rules as the laws and regulators word them. Read the second column first: a retention period only matters if the provider is recording the sites you visit at all.

The UK and Australian rules set a floor for what the state can demand. The US rule sets nothing, so the provider's own retention schedule is the whole answer, and the same company can keep different data for very different lengths of time.

Why "twelve months" and "nothing" both get quoted

The 12 month figure comes from the UK Investigatory Powers Act 2016, nicknamed the Snooper's Charter, and it gets repeated as "your provider keeps your browsing history for a year." That overstates it in three ways. Section 87 lets the Secretary of State require "a telecommunications operator" to retain data by notice, so the duty applies to providers that have received one, not to every provider. Twelve months is the maximum a notice may demand, not a fixed term. And the record is narrower than a history: the Home Office factsheet says internet connection records "do not provide a full internet browsing history" and "do not reveal every web page that a person visited." Its later factsheet gives the examples: a search engine visited "but not the information that was searched for," a website "but not the articles that were read."

The opposite claim, that providers keep nothing, comes from the absence of any US retention law. The absence of a law is not the absence of a log. The FTC's October 2021 staff report on AT&T Mobility, Verizon Wireless, Charter, Comcast, T-Mobile and Google Fiber found that many "keep information as long as it is needed for a business reason" and can define that reason themselves. Two said they use web browsing information to target ads, and a third reserved the right to.

What your provider can see in the first place

Retention is about keeping what the provider sees, so the starting point is what passes through it. On an ordinary connection it sees the numeric address of every server you connect to and, because routers usually point at the provider's own resolver, the name lookups your devices send, as covered in what your DNS resolver can see about you. Combined with your account, that is a list of sites with times attached.

It does not see the page, as long as the site loads over HTTPS. What the padlock actually protects is precisely the part after the site name: the page address, the search you typed and the form you filled in. That matches what the UK law asks for, because the site name is roughly what a provider can still record.

The FTC put the exposure in one phrase: many providers "have access to 100% of consumers' unencrypted internet traffic." The word that matters is unencrypted. The provider also always knows which IP address it handed your router, which is why that address, rather than your browsing, is what the EU still lets countries keep.

The law sets a minimum, the business sets the rest

A retention law is a minimum, not a deletion date. Australia's data retention guideline says providers must keep the required data "for at least two years" and adds that "a provider may keep the data for longer periods for its own business purposes." So two years is the earliest an Australian provider is free to delete, not the moment it must.

The pull in the other direction comes from privacy law. In the EU, Article 6 of the ePrivacy Directive says traffic data "must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication," with an exception for billing that lasts only "up to the end of the period during which the bill may lawfully be challenged." The directive lets a provider keep traffic data longer for marketing or extra services only with your prior consent, which you can withdraw. The UK carries the same erase-or-anonymize rule in regulation 7 of the Privacy and Electronic Communications Regulations 2003.

The EU tried a blanket minimum once. The Data Retention Directive required providers to keep traffic and location data for between six months and 24 months, and the Court of Justice declared it invalid on April 8, 2014. When Germany later required 10 weeks for traffic data and 4 for location data, the court held on September 20, 2022 that EU law precludes "general and indiscriminate retention" of such data, except for a genuine and serious threat to national security. It does allow general retention of IP addresses for a period "limited in time to what is strictly necessary," which is why some countries still keep those.

The US has one narrow limit: cable operators must destroy personally identifiable information once it "is no longer necessary for the purpose for which it was collected." It sets no number of days, and the FTC found that some affiliated ad networks do not delete at the end of the stated period but de-identify the data and keep it for "two years to indefinitely."

Where these rules stop

• Only the provider. These rules cover the company carrying your traffic. The sites you visit, your browser's synced history, your search engine account and chat services each keep their own records on their own clocks, as how long ChatGPT keeps your chats shows for one of them.
• A preservation request freezes, it does not create. Under US federal law a provider asked by a government agency must preserve records "in its possession" for 90 days, extendable by another 90. A provider that never logged the sites you visited has nothing to preserve.
• You cannot check for a UK notice. Section 95 forbids a provider and its staff to "disclose the existence or contents of a retention notice," so no provider can tell you whether it holds connection records. Local authorities are barred from obtaining them at all.
• Some networks are outside the scheme. Australia's duty does not apply to a service offered only to a provider's "immediate circle," such as a university network for current staff and students.
• Policies change. The FTC figures describe practices reported to it after its August 2019 orders, and the report does not name which provider kept what. Your provider's current policy is the binding document.

This is general information about how the rules work, not legal advice about a particular case.

What to do with the answer

1. Read your provider's privacy policy for two things: how long it keeps "browsing" or "web activity" data, and whether it uses that data to target ads. If it does, look for the ad targeting opt out in your account settings.
2. Ask. In the UK and the EU you can request a copy of what your provider holds about you, and Californians have a right to ask for deletion; how to use your data rights has the wording.
3. Switch to encrypted DNS with a resolver other than your provider's, in your browser or device settings, which takes the name lookups away from it, though it still sees the server addresses you connect to.
4. Consider where the log moves before buying a VPN. A VPN hides your sites from the provider by sending everything to the VPN company instead, and what a VPN does and the three things it cannot do explains why that is a trade, not an escape.
5. Do not count on a private window. Private browsing only hides activity from other people using your device; the provider sees exactly what it saw before.
6. Keep the bigger picture in proportion. Your provider sees which sites you reach; the sites and ad networks see what you do on them, which is the more detailed record and the one cookies, pixels and fingerprinting build.