Are internet service providers keeping tabs on your browsing?

The Toronto Star contacted Bell, Rogers and TekSavvy to see what kind of information the companies keep about the websites their customers visit

What does your internet service providers know about your internet browsing habits?

The Toronto Star contacted three popular internet service providers (ISPs) in Toronto — Bell, Rogers and TekSavvy — to see what kind of information the companies keep that can track the websites their customers visit.

But first, some background. Customers are assigned a new IP address, or Internet Protocol address, whenever their modem connects to the internet. The IP address is a series of numbers that acts as an address online, telling a website where to deliver its data. If, for example, a Hollywood studio wants to find out who downloaded a TV episode illegally, they would try to acquire the user’s IP address then ask an ISP for the name associated with that number.

When asked whether the companies log such information, the responses from the internet services providers varied considerably.

Jason Laszlo, a representative from Bell, said via email that the company collects and stores information about the URLs customers visit “for operational and service related reasons, such as monitoring network quality or diagnosing problems.

“URL information varies, but would include date, time and domain.
Any use of the information would be for operational purposes such as network capacity and provisioning, network quality monitoring, resolving billing issues and so on.”

Kevin Spafford, a Rogers representative, told the Star the company does not collect and store the URLs. TekSavvy provided a similar response. The company’s chief legal officer Bram Abramson, said “we don’t store, or want to know, that information.”

Christopher Parsons, from the University of Toronto's Citizen Lab said the range in the responses to the Star’s questions may have to do with how each company defines the word “logging.”

“I suspect that some companies may be using terms differently," Parsons said.

As for how long an IP address would be associated with a customer’s account, Bell said that in January they began logging IP addresses for a year in order to comply with the Copyright Act that just came into force.

Rogers said the company doesn’t “maintain a list of past IP addresses for each customer, but in some cases we can manually retrieve them for a period of time (generally not further than a year back).”

Abramson, TekSavvy’s lawyer, said via email the company keeps a log of sessions for the previous 30 days.

“Where a session was initiated more than 30 days ago, the starting time-stamp of that session may be retained until the session is manually refreshed. Powering the modem off and on is the best way to refresh.”

All three ISPs acknowledged they log MAC addresses, which identify an individual computer or smartphone on a Wi-Fi network. When a computer connects to a Wi-Fi network it will share an IP addresses with everyone on the connection, but the MAC address pinpoint the individual device. Bell said it logs MAC addresses for 90 days or less.

“A customer’s MAC address could potentially also be manually retrieved, but not browser version, OS or webpage visits,” said Rogers’ Spafford.

Abramson said TekSavvy keeps a log of MAC addresses, “because that is how we are able to authenticate a user who logs on as a user who has an active account. We do not log browser version, OS, or other information about connecting devices.” 

What we asked:

When a customer requests a webpage, is the request ever logged on your system?

How long are IP addresses associated with a customer's account?

Do you log information about the customer device connecting to your network? This might include a MAC address, browser version or OS.

Bell

We...log URLs for operational and service related reasons, such as monitoring network quality or diagnosing problems. Logs are normally cleared within 90 days or less.

We did not previously log IP addresses, but with the coming into force of the Copyright Act at the beginning of the year, we will be logging them for a year going forward to enable us to comply with the requirements of the act.

MAC addresses are logged, for the same reasons as URL information and for similar periods of 90 days or less.

Rogers

No

We don’t maintain a list of past IP addresses for each customer, but in some cases we can manually retrieve them for a period of time (generally not further than a year back).

Customer’s MAC address could potentially also be manually retrieved, but not browser version, OS or webpage visits.

Teksavvy

No. We don’t store, or want to know, that information.

Sessions for the last 30 days are logged.

A customer’s MAC address could potentially also be manually retrieved, but not browser version, OS or webpage visits.