{"id":11635,"date":"2026-03-24T08:33:49","date_gmt":"2026-03-24T07:33:49","guid":{"rendered":"https:\/\/techgdpr.com\/?p=11635"},"modified":"2026-03-24T08:33:50","modified_gmt":"2026-03-24T07:33:50","slug":"is-an-ip-address-considered-personal-data","status":"publish","type":"post","link":"https:\/\/techgdpr.com\/blog\/is-an-ip-address-considered-personal-data\/","title":{"rendered":"Is an IP address considered personal data?\u00a0"},"content":{"rendered":"\n

The concept of personal data lies at the heart of the General Data Protection Regulation (GDPR), shaping the scope of its protections and obligations. Among the most debated examples of such identifiers are IP addresses. While often perceived as neutral technical data, regulatory authorities and courts within the European Union have clarified that IP addresses can constitute personal data when they enable identification, directly or indirectly. Understanding why IP addresses fall within the GDPR\u2019s scope requires examining legal interpretation, regulatory guidance, and practical realities of online data processing.<\/p>\n\n\n\n

What qualifies as personal data?<\/strong><\/h3>\n\n\n\n

Article 4.1 of the GDPR defines personal data as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”<\/p>\n\n\n\n

The EDPB explicitly identifies IP addresses<\/a> as being personal data due to their ability to identify individual data subjects. If an IP address is successfully anonymized, then under the GDPR it is no longer considered personal data. <\/p>\n\n\n\n

The French Data Protection Authority (CNIL) ruled over a case dealing with the transfer of personal data to a company not in the EU. In the decision<\/a>, the CNIL wrote: <\/p>\n\n\n\n

\u201cIt should be noted that online identifiers, such as IP addresses or information stored in cookies can commonly be used to identify a user, particularly when combined with other similar types of information. This is illustrated by Recital 30 GDPR, according to which the assignment of online identifiers such as IP addresses and cookie identifiers to natural persons or their devices may “leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.” In the particular case where the controller would claim to not have the ability to identify the user through the use (alone or combined with other data points) of such identifiers, he would be expected to disclose the specific means deployed to ensure the anonymity of the collected identifiers. Without such details, they cannot be considered anonymous.\u201d<\/em><\/p>\n\n\n\n

What is an IP address?<\/strong><\/h3>\n\n\n\n
\n
\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\n

An IP address is a way of identifying a device or user attached to the Internet. It is a set of numbers that distinguishes how the device requests and receives information from the Internet. The two main formats are IPv4 and IPv6. Originally, IPv4 was the sole way of identifying devices but it does not allow for as many unique addresses that are needed in the modern age. <\/p>\n<\/div>\n<\/div>\n\n\n\n

The format of IPv4 addresses are xxx.xxx.xxx.xxx where x is a decimal number. The format of IPv6 addresses is hexadecimal (2001:db8::ff00:42:8329), which means a value can be 0-9A-F. Static IP addresses are IP addresses that are constant and dynamic IP addresses can change over time. IP addresses can identify explicit addresses or the exact location of devices.<\/p>\n\n\n\n

The GDPR perspective on IP addresses <\/strong><\/h3>\n\n\n\n

The GDPR explicitly includes \u201conline identifiers\u201d (e.g., IP addresses) as personal data when they can identify a person. Even if the controller doesn\u2019t have the identifying data itself, if there are means reasonably likely<\/em> (e.g., legal processes to get ISP logs) to link an IP to a person, then it qualifies as personal data. This logic comes from the CJEU case Breyer (C-582\/14)<\/strong><\/a>. The CJEU relied on Recital 26<\/a> of the GDPR, which states that in determining whether a person is identifiable, \u201cto determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly<\/em>.\u201d<\/em><\/p>\n\n\n\n

IP addresses can<\/em> be personal data if the controller has legal ways to obtain additional info to identify someone via an ISP. This is due to the objective possibility of identification of a data subject. Under the GDPR there is less concern with whether it is probable or whether it has happened and the concern lies with whether it is objectively possible to identify an individual. Given an IP address, it is possible to identify an individual. EDPB decisions<\/a> affirm that online identifiers like IP addresses<\/strong> are often treated as personal data because they can be combined with other information<\/em> to profile or identify a data subject. <\/p>\n\n\n\n

Personal data vs PII <\/strong><\/h3>\n\n\n\n

Personal data<\/strong>, in the context of the GDPR, covers a much wider range of information than personally identifiable information (PII)<\/strong>, commonly used in North America. In other words, while all PII is considered personal data, not all personal data is PII. For more information about PII vs personal data, read our blog<\/a> post on the matter. <\/p>\n\n\n\n

Device IDs, IP addresses and Cookies are considered as personal data under GDPR. According to the definition of the PII; however, they are not PII because they are anonymous<\/strong> and cannot be used on their own to identify, trace, or identify a person<\/strong>. <\/p>\n\n\n\n

PII includes any information that can be used to re-identify anonymous data<\/a>. Information that is anonymous and cannot be used to trace the identity of an individual is non-PII. Device IDs, cookies and IP addresses are not considered PII for most of the United States. But some states, like California, do classify this data as PII. California classifies aliases and account names aspersonal information<\/a> as well.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

Controllers must treat IP addresses as personal data<\/strong><\/h3>\n\n\n\n

For organizations, this means IP addresses cannot be treated as neutral technical data. Controllers must:<\/p>\n\n\n\n

\n
\n