Is an IP Address Personal Data Under GDPR?
Under the GDPR, an IP address can be personal data, because the regulation defines personal data as any information relating to an identified or identifiable person and an IP address will often make someone identifiable when combined with other information. This article gives general background for developers and is not legal advice; your obligations depend on your situation, so involve a privacy professional for real decisions.
What the regulation actually says
GDPR Article 4 defines personal data broadly. It names online identifiers as examples of information that can identify a person, and the recitals mention identifiers such as IP addresses and cookie identifiers that devices leave behind. The key test is identifiability: whether the person can be identified, directly or indirectly, by the organization holding the data or by someone else using means reasonably likely to be used.
The Court of Justice of the European Union addressed this in the Breyer case (2016), concerning dynamic IP addresses. In broad terms, the court held that a dynamic IP address can be personal data in the hands of a website operator where the operator has legal means to obtain the additional information, such as the internet provider's subscriber records, that would identify the visitor. The practical lesson is that the answer is not a fixed yes or no for every address and every holder. It depends on context and on what else can be linked to the address.
Why context matters for developers
A bare IP address sitting in a firewall log is one thing. The same address stored next to a user ID, an email address, a session token and a timestamp is much more clearly personal data, because it is tied to a specific account. If you are in the second category, assume the address is in scope and plan around that.
It also helps to separate two things that are easy to confuse: the address itself and the facts derived from it. When you look up an address, the output typically describes a network rather than a person: the country, the city-level region, the ASN and organization that operate the block, and flags such as whether the address belongs to a known VPN or a datacenter. ipto's IP lookup returns fields such as country, city, asn and org along with the flags is_vpn, is_tor, is_abuser, is_datacenter and bogon. Those describe the network, and city-level geolocation is approximate, as the post on why city accuracy is limited explains. But the input to the lookup, if it is a visitor's address you stored, may still be personal data in your hands, and the enriched record linked to a user profile likely is too.
General considerations for logging and retention
The regulation does not set a number of days for keeping IP addresses. Instead, general principles apply: you need a lawful basis for processing, you should collect only what you need for a stated purpose (data minimization), and you should not keep it longer than necessary for that purpose (storage limitation). Security logging and fraud prevention are commonly cited purposes, and the retention period should be justified by that purpose and documented, not chosen by habit.
- Decide the purpose first. Abuse prevention, rate limiting, debugging and analytics have different justifications and different sensible retention periods.
- Truncate or hash where full precision is unnecessary. Dropping the final IPv4 octet or the lower bits of an IPv6 address reduces identifiability. Regulators and courts have treated truncation and hashing as risk-reducing measures, though a hash of a small address space can often be reversed, so it is not automatic anonymization.
- Set automatic deletion. Expire raw logs on a schedule rather than relying on someone remembering to clean them up.
- Be transparent. Your privacy notice should state that you process addresses, why, and for how long. Third-party processors you send addresses to should be covered by an appropriate agreement.
- Mind transfers. Sending visitor addresses to an external API is a disclosure to another party, so consider where the data goes. Looking up a network yourself, with no visitor data, avoids the question.
Using network lookups without personal data
Many useful questions can be answered about a network without tying anything to a person. The ASN lookup takes an AS number and returns the registered owner, organization, country and number of ranges, which involves no visitor address at all. For addresses, IP whois via RDAP returns registry information about the block holder, which is organizational data about who holds the allocation, and the bogon checker tells you whether an address is private or reserved and therefore not something a public visitor could have.
If you are comparing legal regimes beyond Europe, the post on IP address privacy laws across countries gives general orientation. The free tier of ipto allows 1,000 requests per day with no signup, and the API documentation lists the fields so you can choose to store only what you actually need.