I cannot answer for every ISP or even most of them. I'll look at what they could store and talk about reasons you'll never really know what they actually store.
Bottom line: If this is a worry for you, then assume that yes. Your plaintext traffic is stored. And take measures to protect it.
What's an ISP
- Broadband provider
- Cell service provider
- Coffee shop hotspot
- Your ISPs upstream ISP
- Your work ISP
What they can know.
- IP Address - this is the connection information and required to make the internet work.
- DNS requests - these are sent in plain text and many ISPs log this information.
- HTTPS SNI - this is the subject name identifier information that's sent in plaintext when establishing an HTTPS connection.
- They know who you are and where you are.
- Any other plaintext traffic (eg http).
- Amount of transferred data.
What they can store, but can't utilize:
- HTTPS traffic - other than the SNI. It's encrypted and I don't know why they would store this.
Do they log it?
Probably. It's useful for making their service better, and it's easy money for them to do so. This depends on your TOS; however, I wouldn't trust your TOS.
An ISP may claim not to sell your data or to de-identify the data. But their upstream providers might. De-identification is not guaranteed to be effective. They may not understand they are selling it. They may be giving it away, storing it, or analyzing it to "improve your service," or "enhance your security."
GDPR is a great lever to feel safer, but the truth is logs are hard and mistakes happen.
Top google result:
Ars Technica Writeup
You use the internet in so many places that you should assume that someone's ISP is logging the information. Sure, they may claim to de-identify the data, but it's not guaranteed to be effective because it's hard to do right. They may claim to keep the data to better the service, improve performance, and the like. Often they sell the data to third parties that help them improve security.