Law · 7 November 2026 · 5 minute read
IP address and GDPR: is it personal data?
Is an IP address personal data? The Breyer ruling, means of identification and what it means for visitor identification tools.
Behind almost every debate about visitor identification lies one question: is an IP address personal data? The answer determines whether the GDPR applies at all. The short answer is: often yes, but not always and not for everyone. The longer answer has to do with means of identification.
This article gives a sober assessment. It is not legal advice. For the more recent case law, it is worth looking at the original.
Static and dynamic addresses
A static IP address belongs permanently to the same connection. A dynamic address is newly assigned at every dial-in, but an internet provider can later say which customer it belonged to at a given time.
For the legal assessment, the type of address matters less than the question: who could find out with reasonable effort who is behind it?
The Breyer ruling and the means of identification
On 19 October 2016, in case C-582/14 (Breyer), the Court of Justice of the European Union ruled that even a dynamic IP address can be personal data for the operator of a website. The condition: the operator has legal means that allow it to have the person concerned identified with the help of third parties, such as the internet provider.
The ruling was still made under the old Data Protection Directive. It is nevertheless regarded as a reference point for the GDPR as well, whose recital 26 carries the same idea: what matters are all the means reasonably likely to be used to identify the person.
A relative view from the recipient's perspective
Whether information is personal is therefore not decided in the abstract, but from the point of view of whoever holds it. The CJEU has developed this relative view further more recently, most recently in case C-413/23 P (European Data Protection Supervisor v Single Resolution Board) with its judgment of 4 September 2025. That case concerned pseudonymised data. The court interpreted the concept of personal data broadly and also took the recipient's perspective into account.
For you this means: the fact that information is easy for someone else to link to a person does not automatically make it personal data for everyone. But the question cannot be answered across the board with „harmless“ either. Before relying on this judgment in a statement, check the case number and the state of further case law yourself, because a lot is in flux here.
How the IP question fits into the overall assessment of visitor identification is shown in Visitor identification and GDPR: a sober assessment.
Company address versus employee
Visitor identification adds a particularity: the address often does not belong to a private household but to a company. The GDPR does not protect data about legal entities. But behind the company connection sits a person who is reading your page right now.
That is why a company connection is not automatically free of personal data. A connection from the office of a company with two employees is easier to link to a person than one from a group with 5,000 computers behind the same address. The smaller the company, the closer the assignment comes to an individual. Reputable tools therefore go only as far as the level of the organisation and refrain from naming individuals.
Processing is not storing
The distinction between processing and storing is important. Even briefly using an IP address for a lookup is processing within the meaning of the GDPR, insofar as the address is personal data. A legal basis is then needed. But the depth of the intrusion is different if the address is not kept after the lookup.
Which legal basis fits is explained in Consent or legitimate interest: how to decide.
Typical places where an address gets stuck anyway:
- Server logs, if accesses are recorded together with the address.
- Check values and throttles (protection against abuse). This can be prevented by keeping only a hash in working memory and not the address itself.
- Passing on to directories: anyone who looks up the holder of a network sends the address to a registry. For addresses outside Europe, European registries forward queries to the registries of other world regions. The query then lands with bodies outside the EU. This concerns the question of whether there is a transfer to a third country. It belongs in the documentation.
The stations an address passes through in company identification are shown in How does company identification work? The technology in 6 steps.
Whovisit is an example of a tool that uses the address only for the lookup in the network registry and then discards it. What remains in working memory is a check value made from a hash with a server secret. This is a description of the technology and not a promise that it answers every legal question.
What is stored and for how long is set out in the help section under Retention and deletion.
Data minimisation checklist: questions for any tool
- Is the IP address stored, in the database or in logs?
- If not: where exactly is it discarded? How long does it stay in working memory?
- Are there check values or throttles? Are they hashed?
- Where is the address sent for resolution (registry, DNS, company data provider)?
- Are these recipients in the EU, or do third-country rules apply?
- How is this described in the privacy policy and in the data processing agreement?
- Is identification limited to companies, or are individuals named as well?
