Articles / Privacy Law

892 words

  • uk-law
  • investigatory-powers-act
  • communications-data
  • routers
  • pace
  • privacy

Can Police Demand Your Home Router Logs Under the IPA?

Short answer: the Investigatory Powers Act 2016 (IPA) is mostly the wrong tool for getting logs off a household router. Its communications data powers are aimed at telecommunications operators, and a typical home is not one. The police have other routes, though, and some of them are simpler.

This is general information about how the law is structured, not legal advice. Where it depends on circumstances, I say so.

What is actually in a home router's logs

Before the law, the data. Most consumer routers keep very little, and what they keep is often in RAM, so a reboot wipes it. A router running dnsmasq or similar can hold more:

  • DHCP leases: which device (MAC address and hostname) had which local IP, and when
  • DNS query logs, if you switched them on: which names each device looked up
  • Connection tracking or firewall logs: which destinations each device talked to
  • Wi-Fi association events: when a device joined or left

A lease file looks like this (documentation addresses, invented device):

1731240000 aa:bb:cc:dd:ee:ff 192.168.1.42 alice-laptop 01:aa:bb:cc:dd:ee:ff

That is expiry time, MAC, IP, hostname and client ID. Harmless-looking, but it ties a named device to a moment in time.

Is that "communications data" under the IPA?

Very likely yes in kind. The IPA (s.261) splits communications data into entity data and events data, and keeps it separate from content. A log of which device contacted which address at what time is the sort of thing it describes. The category is not the problem; the target is.

A caveat on the content boundary: a bare domain name is usually treated as data about a communication, but a full URL or page title starts to look like content. Where exactly the line falls is contested and I would not state it as settled.

Why the acquisition power does not fit a household

Part 3 of the IPA lets a public authority obtain communications data from a telecommunications operator. The power to grant an authorisation is s.61, and for most requests it needs independent approval (s.60A, via the Office for Communications Data Authorisations). The recipient has to be an operator.

"Telecommunications operator" (s.261(10)) covers someone who offers a telecommunications service to people in the UK, or who controls or provides a telecommunication system. Your own router, serving your own family, is a stretch. Offering the connection to other people changes the picture: a landlord providing internet to tenants, a cafe with guest Wi-Fi, a small business, a community network. For those, the question is genuinely open and fact-dependent.

Quick detour: why police usually ask the ISP instead

Hang on, the more interesting thing is where the useful data sits. Your ISP assigns the public IP address. If police want to know which household was behind an address at a given time, they ask the ISP, which is plainly an operator.

ISPs can be required to retain certain data under a retention notice (s.87), for up to 12 months. Under carrier-grade NAT the ISP's mapping logs matter even more, because many customers share one public address. So the router's own log is often a second-best source, wanted mainly to say which device inside the house did it.

The routes that do reach your router

If police want your router's records specifically, these are the realistic options:

  1. Ask nicely. Data protection law has an exemption that allows voluntary disclosure for preventing or detecting crime, so you may hand logs over if you choose to. You are not obliged to.
  2. A search warrant under the Police and Criminal Evidence Act 1984 (PACE), which lets officers enter and seize material, including the router itself.
  3. A production order under Schedule 1 to PACE, which requires a judge and a set of access conditions.
  4. Seizing the device during an arrest or search, under the PACE seizure powers.

The practical effect is that police are more likely to take the box than to serve a notice on you. A seized router can then be examined, and any stored logs are in play. Separate powers exist for compelled decryption (see RIPA Part 3), but they are not about logs.

What you are and are not required to do

There is no general duty on a household to keep router logs for the police. Not keeping logs is lawful. Deleting logs after you know of an investigation, with intent to hinder it, is a different matter and could expose you to offences such as perverting the course of justice. That distinction matters more than any retention setting.

Also note s.11 IPA: it is an offence for someone in a public authority to knowingly or recklessly obtain communications data from an operator without lawful authority. The Act polices the police side as well.

What I would do with this

  • Decide on purpose whether you log DNS or connections at all; defaults differ by firmware.
  • If you log, set a short, fixed retention and write it down.
  • If you share your connection with others, think about whether you could be an operator, and get proper advice before a request arrives.
  • If a request does arrive, ask what power it relies on. "We would like" and "we require" are legally different sentences.

Primary sources: the Investigatory Powers Act 2016 and PACE 1984 on legislation.gov.uk. Check the current versions, since the IPA was amended in 2024.

← All articles