Australia’s mandatory data retention scheme requires telecommunications carriers and carriage service providers, in practice your phone and internet companies, to keep records about your communications for at least two years. Those records are metadata: who, when, where and how you communicated, not what you said or wrote. The scheme does not capture message content, does not include your web-browsing history, and does not apply to app companies such as WhatsApp or Facebook. This guide explains exactly who must retain what, who can access it, what the real penalties are, and what a VPN can and cannot do about it.
The 2026 quick guide:
- Telcos and internet providers (carriers and carriage service providers) must retain communications metadata for at least two years.
- Retained data covers subscriber details, source and destination, timestamps, duration, service type and device location. Message content and web-browsing history are excluded.
- 21 enforcement agencies can access metadata without a warrant, subject to internal authorisation and a reasonable-connection test. Journalists’ metadata needs a journalist information warrant, and content needs a stored communications warrant.
- The scheme does not apply to messaging apps, social platforms, web hosts or individuals. It applies to the companies that carry communications.
- Non-compliance draws civil penalties up to AUD 250,000 for a company and AUD 50,000 for an individual per contravention.
- A VPN does not stop metadata retention, but it does hide the destination of your traffic from your ISP.
What Is Metadata Retention in Australia?
Metadata is the data about a communication. When you make a call, send a message or visit a website, your provider’s network generates records: the number or account that started the communication, the destination, when it happened, how long it lasted, what type of service was used, and the location of the equipment at both ends. Add the subscriber details the provider already holds, such as your name, address, phone number, IP address and billing information, and you have the metadata set.
Content is the opposite. The words in a message, the body of an email, the audio of a call and the pages of a website are content, and content is not part of the retention scheme. The law draws that line deliberately: retained metadata must not include content, and web-browsing history is explicitly excluded from what must be kept.
Who Must Retain Metadata
The obligations sit on carriers and carriage service providers under section 187AA of the Telecommunications (Interception and Access) Act 1979. In plain terms:
- Carriers own the physical network: Telstra, Optus, Vodafone, NBN Co and the other licensed network owners.
- Carriage service providers supply the services you buy over that network: every ISP and mobile reseller, including the budget brands that lease capacity from the big carriers.
What the scheme does not do is more important than most summaries admit:
- It does not apply to individuals. You have no obligation to retain anything, and the penalties for non-compliance are aimed at providers, not customers.
- It does not apply to web-hosting companies or domestic social media platforms. Hosting a website or running a social feed is not a carriage service, so those businesses are outside the retention obligation.
- It does not apply to messaging apps. WhatsApp, Signal, Facebook Messenger and similar services are not carriage service providers, so their message metadata is not captured by the scheme. The telco records of your connection still are.
What Metadata Must Be Kept
Section 187AA spells out the closed list of what can be retained: subscriber information, the source and destination of each communication, its date, time and duration, the type of communication (call, SMS, email, internet session), the identifiers used (phone numbers, IP addresses) and the location of equipment at the start and end of the communication.
Two things are outside the list: content and web-browsing history. Providers are not required to keep either, and access rules for anything retained separately are much stricter.
How Long Is Metadata Kept?
Metadata must be retained for at least two years from the moment the communication occurs. Providers may keep records longer for billing and business purposes, and if they do, the same protections and access rules continue to apply. The law does not require the data to be stored in Australia: that requirement was debated when the scheme passed in 2015 and was not included in the final Act, so offshore storage is possible.
Who Can Access Your Metadata
Access is not open to every government body. The 2015 law cut the number of agencies able to access metadata on an ongoing basis to 21 specified enforcement agencies, including the Australian Federal Police, state and territory police, the Australian Border Force and a set of anti-corruption and regulatory bodies. The Attorney-General can declare additional agencies in prescribed circumstances.
- No warrant is needed for metadata. An agency must authorise the request internally through a senior officer and the disclosure must be reasonably necessary in connection with an investigation. That is a much lower bar than a warrant.
- Content always needs a warrant. Accessing the content of stored communications requires a stored communications warrant, issued by an issuing authority such as a judge or tribunal member.
- Journalists have extra protection. Metadata relating to journalists requires a journalist information warrant, a higher hurdle created by the 2015 amendments.
- Security agencies are separate. ASIO and related agencies access metadata under their own security-authority provisions rather than the 21-agency list.
Oversight comes from the Commonwealth Ombudsman, which inspects agency use of telecommunications data and reports to Parliament, and the Parliamentary Joint Committee on Intelligence and Security, which reviews the scheme itself. Non-compliance by providers is enforced through the ACMA’s compliance role under the Act.
Penalties for Non-Compliance
Failing to meet the retention obligations is a civil penalty matter, not a criminal one. The maximum penalties are AUD 250,000 for a body corporate and AUD 50,000 for an individual for each contravention. Those are the figures the law sets for providers that fail to retain, protect or disclose metadata as required; no figure like “66,000” appears anywhere in the scheme’s penalty provisions.
Where the Law Stands in 2026
The scheme has not been static. The journalist information warrant protections remain in force, and the Parliamentary Joint Committee on Intelligence and Security has repeatedly reviewed the regime, recommending tighter limits on which agencies can access metadata and stronger protections for journalists. Those recommendations have been accepted in part and legislated in part; the core two-year retention obligation and the 21-agency list remain the law today. Separately, the Privacy Act amendments that passed in December 2024 raised the maximum penalties for serious or repeated privacy interferences by Australian businesses, which applies alongside rather than inside the metadata scheme.
What This Means for You
The practical picture for a normal Australian: every call, message and connection you make generates records your telco holds for at least two years, and 21 agencies can see those records without a warrant. Content is not collected, browsing history is not collected, and app-to-app messages are outside the scheme.
A VPN changes part of that picture, not all of it. Connected to a VPN, your ISP still sees your connection and retains the subscriber record, but the destination metadata for that traffic becomes the VPN server rather than the individual sites you visit. If that trade-off matters to you, our best VPN for Australia guide compares the providers that pass independent no-logs audits, and our secure DNS guide covers a second layer of control over your DNS lookups. For the wider picture of how Australian filters and blocks operate, see how governments block websites.
Frequently Asked Questions
Does the data retention scheme mean the government reads my messages?
No. The scheme only covers metadata: the records about a communication, not its content. Reading message content, email bodies or call audio requires a separate stored communications warrant, which is a much higher bar.
Can a VPN stop metadata retention?
No. Your ISP retains the record of your connection regardless of what you use. What a VPN does change: your ISP sees the VPN connection instead of the individual sites and services you visit, so the destination metadata shifts to the VPN provider. Subscriber details such as your name and address are still retained either way.
Does metadata retention apply to WhatsApp, Signal or social media?
Not their message metadata. The obligation falls on carriers and carriage service providers, which means telcos and internet providers. Apps such as WhatsApp, Signal, Facebook Messenger and social platforms are not carriage service providers, though the telco records of the connection you use to reach them are still covered.
How long is metadata kept?
At least two years from the moment the communication occurs. Providers may keep records longer for their own purposes, in which case they must take the steps the law requires to protect the information.
What penalties apply for not retaining metadata?
Contraventions attract civil penalties of up to AUD 250,000 for a body corporate and AUD 50,000 for an individual for each contravention, enforced through the scheme’s compliance regime.
