UK's Investigatory Powers bill set to become law after being approved by parliament; bill allows bulk surveillance, hacking of mobile devices and networks, more
The Investigatory Powers Bill has been passed by both Houses of Parliament. Once it receives Royal Assent it will become law
Context & Ripple Effects
This closes a year-long legislative arc: the revised bill introduced in March added privacy safeguards while still requiring ISPs to store browsing data for 12 months, and the Commons approved it by a wide margin in the 444-69 June vote, after modifications aimed at appeasing tech companies including Apple. With both Houses now behind it, only Royal Assent stands between the bill and statute.
First-order effects
- ISPs become legally obliged to retain every customer's browsing history for 12 months, with police and several government agencies able to access those records once the law takes effect.
- Bulk surveillance and the hacking of mobile devices and networks move from contested practice to explicitly authorized power for UK authorities.
Second-order effects
- Tech companies that pushed for safeguards during the Commons stage — Apple among them — face a domestic legal baseline that conflicts with their encryption and privacy positioning, forcing choices between compliance and service design.
- Other governments gain a worked parliamentary template for codifying bulk interception and equipment interference, lowering the political cost of proposing similar bills at home.
Third-order effects
- The pattern holds and extends: the same framework returns in the Investigatory Powers (Amendment) Bill seven years later, with critics and tech companies again warning about privacy — suggesting the 2016 act functions as a base layer that subsequent UK legislation builds on rather than revisits.
- Alongside the Online Safety Bill's passage in 2023, this points toward a structural norm where UK law increasingly assigns private infrastructure operators duties of state surveillance and content control.
The trend: UK digital legislation is converging on a model where parliament grants state surveillance powers first and negotiates safeguards with tech companies second, with each new bill extending rather than restraining the 2016 baseline.