Biggest problem IMO with this is that they left the data collection and storage to each ISP individually without any support. This results in a large surface area for security failure and the inevitable leak of this data into the public domain. I wrote my MP with these concerns but they wanted it on the cheap and forced it through.

I don't like that they're storing the data in general as even if they centralised it and secured it properly it'd still probably leak but they've more or less chosen the worst approach on top of recording information that they shouldn't be recording in the first place. Also its linked to billing account which is a lossy way to deriving who is actually looking at what and begs the question: "do you actually know what websites your children are visiting?". Because now those sites come up as places YOU (the bill payer) are going to. I'm looking forward to the "scandal" when MPs are "found" to visiting dubious sites when its really someone else in their household.

and everyone going anywhere vaguely dark with half-decent tech knowledge just switches to VPN undermining the whole premise. My MP was _very_ interested in that bit without realising that even if you close that loop hole we just invent another.