Metadata Retention in Australia: What's Kept and How Long

Every time you make a call, send a text or connect to the internet in Australia, your provider creates a record about it. Under federal law, a set of those records has to be kept for at least two years. That sounds as if your whole browsing history is sitting in a database somewhere. It isn't, and the difference matters if you're deciding whether a VPN is worth it. The facts below were checked on official Australian government pages and the companies' own websites on 30 October 2026.

SecureCheck.com.au is an independent guide operated by Dominet BV. This page is general information, not legal or technical advice for your situation. We don't sell VPNs or security software. No link on this site is an affiliate link right now. We may earn a commission from VPN or security companies in future when a reader buys through a link on this site. If that happens we'll label those links and explain it in our affiliate disclosure, and it won't change the facts we publish. Facts were checked on official and company websites on 30 October 2026. Read our general information notice. This page explains the scheme as Home Affairs describes it, not how any one provider applies it.

The short answer

The data retention scheme sits in the Telecommunications (Interception and Access) Act 1979. According to the Department of Home Affairs' Data Retention Guideline:

• Section 187C requires telecommunications providers, including internet providers, to keep certain metadata for at least two years from when it's created.
• Subscriber and account information is kept for the life of the account plus two years.

Home Affairs' industry FAQs set out what isn't covered. Under section 187A(4), providers don't have to keep the content of communications, and internet access providers don't have to keep the web addresses their customers visit.

What counts as metadata

Metadata is information about a communication rather than the communication itself. Think of an envelope: the scheme covers details on the outside, not the letter.

Home Affairs groups the retained data into two kinds. The first is information about you as a customer: your account, the services you have and the details you gave when you signed up. The second is information about each communication, rather than what was said or sent.

We haven't listed every individual data field here, because the guideline is long and written for providers. If you want the full detail, the Home Affairs guideline is the source. What matters for most people is the line the law draws: records about communications are kept, and the content of communications isn't.

How long it's kept

Two years is the minimum, counted from when the record was created. Account details are kept for longer: for as long as your account is open, then two more years. So if you've had the same internet or mobile account for ten years, your subscriber information is kept for those ten years and then two years after you close the account.

The scheme sets a minimum, not a maximum. Providers may keep some information for longer for their own reasons, such as billing. Their privacy policy is the place to check.

What isn't kept

Two exclusions in section 187A(4) are worth knowing:

• Content. The words in your calls, texts and emails aren't part of the scheme.
• Web browsing destinations. Internet access providers aren't required to keep the websites you visit.

That second point is why the "your ISP keeps your browsing history for two years" claim you see online isn't right as a description of this law. It doesn't mean nobody can see where you browse. Your provider can still technically see which servers you connect to while you're online. It means the retention scheme doesn't require that list to be kept.

What changes when you use a VPN

A VPN doesn't switch the scheme off or make you exempt. Your internet provider still keeps the records it's required to keep about your connection.

What changes is what your provider can see in the first place. With a VPN on, your traffic is encrypted between your device and the VPN company's server. Your provider can see that you're connected to that server, when and for how long. It can't see what's inside the tunnel.

The VPN company can. That's the trade. If you're using a VPN for privacy, the question becomes what the VPN company keeps. Two examples of companies that have had their no-logs claims checked by outside firms, from their own sites:

• NordVPN says Deloitte Lithuania carried out its sixth no-logs assurance engagement between 10 November and 12 December 2025 (NordVPN).
• Proton VPN says Securitum completed its fifth consecutive annual no-logs audit, with a 2026 report (Proton).

These are listed alphabetically as examples, not recommendations. Our VPN checklist explains what to look for in any provider, and what a VPN is covers the basics.

Three things people get wrong

"My provider records every site I visit." The scheme doesn't require that. Web browsing destinations are excluded for internet access services.

"A VPN makes the retention law not apply to me." It still applies to your provider. The VPN changes what your provider can see, not what the law requires it to keep.

"Metadata isn't personal." Subscriber details are part of the scheme and are kept for the life of the account plus two years. Information about your communications can say a lot about a person even without the content. That's why the Privacy Act and the breach notification rules matter here too.

The Privacy Act and data breaches

The retention scheme says what must be kept. The Privacy Act 1988 governs how personal information is handled. It's administered by the Office of the Australian Information Commissioner (OAIC), contains 13 Australian Privacy Principles, and covers Australian Government agencies and organisations with annual turnover above $3 million, plus some others.

If information an organisation holds about you is lost, hacked or sent to the wrong person, the Notifiable Data Breaches scheme can apply. An organisation or agency covered by the Privacy Act must notify affected people and the OAIC when a breach is likely to cause serious harm. The notice has to recommend steps you should take.

Stored data is only as private as the systems holding it. That's one reason to keep the accounts that hold your details well protected.

Practical steps

• Read your provider's privacy policy. It says what the provider keeps beyond the legal minimum and for how long.
• Turn on multi-factor authentication for your provider account, email and bank. Moneysmart lists this among its scam protection tips.
• Act on a breach notice. If a company tells you your data was involved in a breach, follow the steps it recommends and watch for scam contact that uses your details. Our online scams guide has what to do.
• Use a VPN where it helps. On public Wi-Fi, the Australian Cyber Security Centre says a VPN can hide your activity from others on the network (ACSC). Our public Wi-Fi guide covers the rest.
• Don't expect a VPN to fix everything. The ACSC also says a VPN won't protect you from malware, phishing or software flaws.
• Ask your provider directly if its privacy policy isn't clear. You can ask what it keeps about your account and how long it keeps it.

Frequently asked questions

Does my internet provider keep my browsing history?

The retention scheme doesn't require internet access providers to keep the websites you visit. Home Affairs' industry FAQs say web browsing destinations are excluded. Your provider's own privacy policy says what it keeps for other reasons.

How long is metadata kept in Australia?

At least two years from when it's created. Subscriber and account information is kept for the life of the account plus two years.

Are my texts and emails kept?

The content isn't part of the scheme. Information about the communication, rather than what it said, is.

Does a VPN stop data retention?

No. Your provider still keeps the records it must keep about your connection. With a VPN on, those records mostly show a connection to the VPN server, and the VPN company sees the traffic instead.

Who does the Privacy Act cover?

The OAIC says it covers Australian Government agencies and organisations with annual turnover above $3 million, plus some other organisations.

What should I do if my data is in a breach?

Follow the steps in the organisation's notice. Under the Notifiable Data Breaches scheme, the notice must recommend steps to take. Watch for scam messages that use your details.