An IP address is a numerical identifier used to address a device in a network such as the internet, and it can be personal data.
When IP addresses relate to a person
Static IP addresses are permanently assigned to a connection and are therefore regularly personal data. Dynamic IP addresses change, but can also be personal data.
In its judgment of 19 October 2016 (C-582/14, Breyer), the CJEU held that a dynamic IP address is personal data for a website operator if the operator has legal means of having the person identified with the help of the internet service provider.
Practical consequences
Every website visit transmits the IP address to the server and to embedded third-party services such as fonts, maps or videos. Each of these transmissions requires a legal basis.
Storing IP addresses in server log files to ensure security can generally be based on legitimate interests, but storage should be limited in time.
Legal provisions
- Art. 4(1) GDPR
- Definition of personal data and of identifiability.
- Recital 30 GDPR
- Online identifiers such as IP addresses as a possible basis for identification.
- Art. 6(1)(f) GDPR
- Legitimate interest, for example for server log files.
Related terms.
Cookies Cookies are small text files that a website stores on the user's terminal device in order to recognise the user or save settings. Section 25 TDDDG Legitimate interest / balancing of interests Legitimate interest is a legal basis under which processing is lawful if it is necessary for the purposes of legitimate interests and the interests of the data subject do not override them. Art. 6(1)(f) GDPR 