In This Article
Follow BestForAndroid
💡 Quick answer
- What’s keptConnection metadata: who holds the account, when you were online, the type of service and where your equipment was. Not what you said in a call or wrote in an email.
- For how longAt least 2 years, and subscriber details for 2 years after the account closes.
- Browsing historyNot required. The law leaves out the web addresses you visit.
- Where a VPN helpsYour ISP sees a connection to the VPN server instead of the services you use.
Australian internet and phone providers have been legally required to keep certain records about how their customers use their services for over a decade. Most people have heard of the scheme, but few could say what it covers. It gets summed up as “the government stores your browsing history,” which is wrong. It also gets waved away as harmless, which skips over what it does collect.
So what’s actually logged, who can look at it, and does an Australia VPN change any of it? Here’s what the law requires, what it means for everyday internet use, and where a VPN helps and where it doesn’t.
What the Law Requires
The mandatory data retention scheme comes from the Data Retention Act, which added obligations to the existing Telecommunications (Interception and Access) Act, usually called the TIA Act. Under it, phone companies and ISPs must keep a defined set of customer metadata for at least 2 years. Details that identify the subscriber are kept while the account is open and for 2 years after it closes. Providers must also encrypt the data and protect it from unauthorised access, and the law treats it as personal information under the Privacy Act.
Metadata is “data about data.” The law sorts it into six broad categories:
| Category | What it covers |
|---|---|
| Subscriber | Who holds the account, and the services and devices tied to it |
| Source | Where a communication came from, such as a phone number, email address or IP address |
| Destination | Where a communication went, such as the number or email address it was sent to |
| Date, time and duration | When a call or connection started and ended |
| Type | The kind of service, such as a voice call, SMS, email or mobile data |
| Location | Where the equipment or line was, such as the cell tower a phone used |
What providers don’t have to keep is the content of your communications, meaning what you said in a call or wrote in an email. Getting at content needs a warrant.
Access is limited to a defined list of criminal law enforcement agencies, which includes police forces, anti-corruption bodies, the Department of Home Affairs, ASIC and the ACCC, plus security agencies such as ASIO. The government can declare additional agencies in limited circumstances. Agencies don’t need a warrant to access existing metadata, but they do need an internal authorisation, and a journalist’s metadata has its own warrant requirement. The Attorney-General’s Department reports each year on how these powers are used, and the Commonwealth Ombudsman inspects agency records.
What It Means Day to Day
| Kept under the scheme | Not required |
|---|---|
| When your connection started and ended | The web addresses you visit |
| The IP address your account was given | What you read, typed or watched |
| The type of service, such as broadband or mobile data | The content of calls, texts and emails |
| Where your equipment or line was | What you searched for |
In practice, your ISP keeps a record of connection-level information tied to your account: when you were online, for how long, which IP address you were given and where your equipment was. For internet access, the law is aimed at the connection, not the page.
The most common misconception is that your ISP logs every page you visit. The law specifically leaves out web browsing history, so providers aren’t required to keep the addresses you visit or anything you did on a site. Your provider can show that your account was online at a particular time, but not what was read, typed or watched.
That’s still a lot of information. Patterns of metadata can show when you’re home, where your phone has been and how often you’re online. On a mobile, the location record is the cell tower your phone used, which gives a rough idea of where you were. That’s why it’s worth understanding, and why “just metadata” undersells it.
Where a VPN Fits
A VPN encrypts your traffic and sends it through a server run by the VPN provider. Your ISP sees a connection to that server instead of each service you use, and the encryption stops it from seeing inside the traffic, including the DNS lookups that would otherwise show which sites you open, as long as the VPN handles them.
The retained records themselves barely change. Your ISP still logs when you were online and the IP address it gave you. What a VPN changes is everything the ISP could see beyond that, such as the sites you look up and the services you connect to, which it could otherwise log for its own purposes or capture under an interception warrant.
What a VPN doesn’t change
- Your ISP still keeps metadata. It still records that you were online and that you connected to a VPN server. A VPN changes what the record shows, not whether a record exists.
- The trust moves to the VPN provider. You’re relying on your VPN’s policies instead of your ISP’s, which is why its logging practices matter so much.
- You’re still identifiable. Accounts you sign in to still know who you are, and police can use lawful processes to pursue an investigation.
An Australia VPN limits what your ISP can see. It won’t make you invisible.
Is Using a VPN Legal?
Yes. Using a VPN for personal use is legal in Australia, and VPNs are a mainstream tool for public Wi-Fi security, remote work and everyday privacy. The retention rules, set out in the Telecommunications (Interception and Access) Act, put obligations on telecommunications providers. They don’t stop individuals from using encryption or VPN services.
A VPN doesn’t make illegal activity legal, though. Anything that’s unlawful without a VPN is still unlawful with one. If you’re still deciding whether you need one at all, our guide on why you need a VPN covers the everyday cases, from cafe Wi-Fi to working from home.
How to Choose a VPN
If your concern is what gets recorded about your connections, a few criteria matter more than any feature list:
Five things to check
- A no-logs policy that’s been independently audited. The point of a VPN is that records of your activity shouldn’t exist on its servers either. A policy is a promise; an audit is evidence. Check what the audit covered and when it was done.
- Where the provider is based. Jurisdiction decides which laws can force a provider to hand over data. Look at where the company is legally set up, and whether that country sits in the Five Eyes alliance Australia belongs to or its wider Nine and Fourteen Eyes circles.
- Strong, current encryption. This is the baseline: AES-256 and up-to-date protocols such as WireGuard or OpenVPN.
- Servers in Australia. Local servers help with speed and give you a local IP address. If you live or travel overseas, they let you reach Australian banking or government portals that block foreign connections, as if you were at home.
- Openness about ownership and history. A provider that says who runs it and deals openly with past problems is easier to trust than one that only shows a feature list.
Be wary of free VPNs here. A service that costs nothing has to make money somewhere, and logging is often how. Our breakdown of free VPN myths and truths goes through what to check.
How PureVPN Handles Privacy
PureVPN says it runs a no-logs policy, meaning it doesn’t keep logs that identify users or track what they do on the service. The company is registered in the British Virgin Islands, outside the Five, Nine and Fourteen Eyes alliances.
PureVPN says KPMG has independently assessed its no-logs claims, and it has signed up to an “always-on” audit, under which the auditor can make unannounced checks of its systems. It supports WireGuard and OpenVPN with AES-256 encryption, has servers in Australia and lets one account cover up to 10 devices. It also offers quantum-resistant encryption on OpenVPN connections, which it pitches as protection against future computers that could break today’s encryption.
| Criterion | What PureVPN says |
|---|---|
| Audited no-logs | Claims assessed by KPMG, plus an always-on audit |
| Jurisdiction | British Virgin Islands, outside the Eyes alliances |
| Encryption | AES-256 over WireGuard or OpenVPN, with a quantum-resistant option |
| Australian servers | Yes |
| Devices | Up to 10 per account |
These are the company’s own claims, so read its latest audit report before you rely on them. That’s the same test you’d apply to any provider on the checklist above.
The Bottom Line
The data retention scheme is easier to live with once you know what it records by default and who can ask for it. A VPN is a legal way to limit what your ISP sees on top of that, and the right one comes down to audited claims, jurisdiction and openness about its past. It won’t put you outside the law, and it shouldn’t need to.
If you want to try one, explore PureVPN’s Australia servers and see whether it fits how you use the internet.
Key takeaways
- KeptAccount details, session times, IP addresses and location, for at least 2 years.
- Not keptBrowsing history and the content of calls, texts and emails.
- A VPNHides the services you use from your ISP, but not the fact that you were online.
- Choose onAn audited no-logs policy, jurisdiction, encryption and local servers.
Data Retention and VPN FAQ
Does the scheme record the websites I visit?
No. The Home Affairs data retention guideline says providers don’t have to keep “an address to which a communication was sent on the internet”, which in practice means your browsing history. Your ISP may still keep some data for its own business reasons, so its privacy policy is worth a read.
Can agencies read my emails and messages?
Not from retained data. The scheme doesn’t cover content at all, and getting at the content of a call, text or email needs a warrant.
Does a VPN hide my location from my mobile carrier?
No. Your carrier still knows which cell tower your phone connects to, and that location is part of the retained data. A VPN hides the services you use, not where your phone is.
How long is my data kept?
At least 2 years from when it was created. Subscriber details, such as your name and address, are kept while the account is open and for 2 years after it closes.
