How Long Do Internet Providers Keep My History?

What your internet provider can actually see

Almost every website now uses HTTPS, and that changes what your provider can know. HTTPS hides “everything after the slash”: the page you read, what you search for on the site, what you type into forms. What is left:

Your IP address and when you had it. The provider assigns it, so it always knows. On shared addresses (carrier-grade NAT) it logs the port numbers too, so it can still tell subscribers apart.
The sites you connect to. Your device looks up each site’s name before it connects, and if it uses the provider’s DNS server, the provider sees every lookup. The name is also sent openly at the start of most encrypted connections; the standard that fixes this calls it “perhaps the most sensitive information left unencrypted” in today’s encryption.
When and how much. Connection times and data volumes, which providers keep for billing and data caps anyway.

The FTC confirmed this in its 2021 study of six US providers: several collected browsing information at the level of domains and subdomains, and many had access to all of their customers’ unencrypted traffic. So your provider’s “history” of you is closer to an itemized phone bill than to a diary. It knows you were on a health site at 2 am for forty minutes, not which article you read.

Private or incognito mode changes nothing here. It only keeps history off your own device; AT&T even notes that its collection as an internet provider “works independently of your web browser’s cookie and private browsing settings”. What a VPN hides from the provider is in our guide Can my ISP see my history if I use a VPN?

How long ISPs keep your data, country by country

Two kinds of rules decide it. Some countries have data retention laws that oblige providers to keep certain records for the police, whether they need them or not. Everywhere else, the provider keeps what it needs for its own business, for as long as it likes, until someone asks it to preserve a record.

In the EU, a general duty to keep everyone’s data was struck down twice. The EU Court of Justice annulled the Data Retention Directive in 2014 and ruled in 2016 that EU law forbids “general and indiscriminate” retention of traffic data. Since then it has allowed countries to keep IP addresses for limited periods for national security and serious crime and, since 2024, for online copyright cases too, provided the IP data is kept strictly apart from other data. So each country now has its own answer:

Two things stand out. Where a law exists, it is about who had which IP address and who connected to what, not the pages you read; Australia excludes browsing history in the law itself, and Brazil forbids providers to log the sites you visit. And the rules keep moving. Germany’s cabinet approved a three-month IP address duty in April 2026, and the Bundestag heard experts on it in October; Canada’s Bill C-22 is in the Senate; and the European Commission’s plan for a new EU-wide rule looked “more uncertain” in July 2026.

The United States: no minimum, and every provider decides

No US law requires internet providers to keep records. What exists is a duty to preserve: once police ask, a provider has to keep the records it already holds for 90 days, and 90 more if the request is renewed. Anything already deleted stays deleted.

So the real answer is in each provider’s own rules, and most don’t publish them:

• Comcast (Xfinity): “IP address logs are retained for 180 days”, according to its guide for law enforcement (February 2026). Its periods for other data are in a portal only police can see.
• Cox: IP assignment logs for up to 6 months (2020 notice).
• AT&T, Verizon, T-Mobile and Spectrum: no period. Their privacy policies say they keep data as long as needed for business, tax or legal purposes.

The FTC’s study of six providers shows how far apart those periods can be. One deleted its logs of the websites customers visited after 24 hours, another kept them 35 days, a third a whole year; demographic data was kept two to three years. The FTC called the providers’ retention rules “virtually unfettered discretion”.

What those logs are mostly used for is matching an IP address and a time to a customer, which is what most police requests ask for. Verizon received 93,805 subpoenas in the first half of 2026 and says they “typically” ask only for the name and address behind a phone number or IP address.

The United Kingdom: up to 12 months, and nobody tells you

Under the Investigatory Powers Act 2016, the Home Secretary can order a provider to keep communications data for up to 12 months. That can include internet connection records: which sites and services a device connected to, and when. The Home Office describes them as a record of “a website visited, such as a search engine, but not the information that was searched for”.

Which providers have received such an order is secret. The Act forbids them to “disclose the existence or contents” of a retention notice, which is why BT, Sky and Virgin Media publish no period for connection data. BT’s privacy policy lists 7 days for the content of text messages and up to 12 months for call data, and mentions that it may have to share data under investigatory powers law. For browsing records, it gives no period.

So how long does BT keep your history? Up to 12 months if it was ordered to, much less if not, and BT isn’t allowed to tell you which.

Since October 2024, MI5, MI6, GCHQ and the National Crime Agency may also search connection records to find out who used a given service in a given period, without knowing the person first. The courts have set limits: the High Court ruled in 2022 that the Act doesn’t allow “general and indiscriminate” retention of everyone’s data.

Do ISPs use or sell your browsing data?

Some do, and in the US it is legal as long as they tell you. Congress voided the FCC’s broadband privacy rule, which would have required your consent, in 2017. Since then there is no federal opt-in rule; Maine requires consent with its own law. The FTC found that two of the six providers it studied used web browsing information to target ads and a third reserved the right to.

What the big ones say today:

• Verizon: its Custom Experience program uses the domains and subdomains of the sites you visit and the apps you use, and you are in it “unless you opt out”. Opt out in Verizon’s privacy choices.
• AT&T: only its opt-in Personalized Plus program uses the browsing data it collects as your internet provider, including websites it infers over encrypted connections. Settings at att.com/PrivacyChoices.
• Comcast: lists “DNS searches and network traffic activity” among the data it collects and may sell aggregated or de-identified information. Choices in its Privacy Preferences Center.
• BT: builds a profile for personalized offers partly from browser records, and says you can opt out of this at any time.

Location data is a different story. In 2024 the FCC fined AT&T, Verizon, T-Mobile and Sprint nearly $200 million for selling access to customers’ location without consent, and the Supreme Court let the fines stand in June 2026.

Your provider is the one company that sees every site you connect to, from every device in the house. That it may also turn this into advertising is a good reason to spend two minutes on the opt-out page.

Can you get, or delete, the history your ISP keeps?

You can ask for it. In the EU and UK, the GDPR gives you the right to a copy of your data and to be told how long it will be kept; providers usually have one month to answer. In California, the CCPA gives a similar right to know, with 45 days to answer (up to 90). Comcast accepts access requests from all customers, not only Californians; Verizon has a privacy inquiry form, AT&T its Choices and Controls page, and BT answers requests within a month.

Don’t expect a neat browsing history in return. The FTC found little meaningful access at the providers it studied: the data they handed out was “often either indecipherable or nonsensical without context”. What a provider keeps for the police under a retention order is a separate question, and no provider says whether such records are included.

Deleting it is harder. The GDPR’s right to erasure doesn’t apply when a law obliges the provider to keep the data (Article 17(3)(b)); otherwise, the data may be kept no longer than needed. In the US, no law makes providers delete logs on time, and a preservation request freezes them. Clearing your browser or router history deletes only those copies; our guide to deleting Wi-Fi history covers the router.

How to keep less of your browsing in your ISP's logs

You can’t stop your provider from logging your IP address, your connection times and how much data you use. You can keep the names of the sites out of its view:

• Encrypted DNS: use a DNS server other than your provider’s, over DNS over HTTPS (DoH). Firefox and Chrome have it in their settings, and Mozilla requires its partner resolvers to delete identifiable data within 24 hours.
• Encrypted Client Hello (ECH): hides the site name at the start of the connection. It became an internet standard in March 2026 and is on by default in Chrome and Firefox, but only works on sites that support it, such as those behind Cloudflare. It needs encrypted DNS too: a provider’s own DNS server can switch it off.
• A VPN: your provider then sees only that you use a VPN, and which one. The VPN provider sees what your ISP used to, so the EFF calls it a way to “shift your trust”. Choose one with an audited no-logs policy (our list). In India, VPN providers must keep customer records for five years.
• Tor: your provider sees only that you connect to the Tor network. Slower, and some networks block it; our Tor guide covers bridges.

None of these erases what your provider already has, and none hides that you were online. Privacy that depends on a company’s storage policy is not much privacy, so it is better to give it less to store.