IP tracking: what an IP address reveals about visitors

„IP tracking“ sounds like surveillance. In fact an IP address reveals less than many think. At the same time it reveals more than some website operators know. This article sorts out which details can be reliably derived from an address, which are only estimated and which not at all.

What an IP address is

Every device that requests a website on the internet sends its request from an IP address. The website needs this address to send the answer back. That is why every server knows the address of every visitor, with no cookie or script at all.

The address, however, rarely belongs to the device alone. In an office, hundreds of computers often share one address to the outside. At home, the whole household shares one. In mobile networks, many customers frequently share an address at the same time.

What can be read reliably

The network holder. Every address belongs to an address range that is allocated to an organisation in the public registry. That can be an internet provider, a data centre, a university or a company. How to look this up yourself is described in Who owns this IP address? How to find the holder.

The type of network. From the network holder it follows whether the visit came from a company network, a private connection, a mobile network or a data centre. Data centres are often a sign of bots, VPN services or cloud services.

The country of the entry. The registry names a country. Usually it matches the location, but not for international companies and VPN services.

What is only estimated

City and region. Geolocation services estimate the place from databases, measurements and information from providers. At country level they are mostly reliable. At city level they are often off, in mobile networks frequently by hundreds of kilometres, because the address there is assigned at the point of transition to the internet and not at the mast.

The company behind an internet provider's connection. Small companies often have a connection with a changing address. The registry then shows the provider. Some tools estimate the company anyway, for example via purchased databases or via the host name of the address. Such assignments go out of date quickly when the provider reassigns the address.

What an IP address does not reveal

• No name. Only the provider knows who had a connection. It releases this only to authorities or on a court order.
• No home address. Even precise geolocation shows at best a place, never a house.
• No particular device. Many devices can be behind one address. Conversely, a device changes address as soon as it changes network.

Anyone who wants more, that is to recognise which person visits a page, needs other means for that, such as cookies, login or fingerprinting. In the EU this is generally inadmissible without the visitor's consent.

IPv4 and IPv6: an important difference

With IPv4, addresses are scarce and shared. With IPv6, a connection usually gets its own address range, often the same over a longer period. As a result, an IPv6 address can narrow down a household more precisely than an IPv4 address. Operating system privacy features therefore change the latter part of the address regularly. Anyone evaluating addresses should, with IPv6, look only at the front part that belongs to the network.

What this means for website operators

Every web server logs IP addresses, often without the operator knowing. For the GDPR, the IP address counts as personal data in many cases. The assessment is in IP address and GDPR: is it personal data?.

Three simple rules help:

1. Store only as long as necessary. For troubleshooting and defence against attacks, a few days are often enough.
2. Truncate where possible. For statistics, the network portion is usually enough.
3. Describe openly. The privacy policy states which services process addresses and for what.

Visitor identification uses exactly one part of the address: the network holder. An example of this principle, in which the address is discarded after the lookup, is described in How does company identification work? The technology in 6 steps. Who remains fundamentally invisible from which networks is shown in Home office, VPN and mobile: whom you do not see.

Frequently asked questions

Can someone be located with an IP address? Roughly, at country and sometimes region level. A home address cannot be derived.

What do „IP tracker“ links show? Such links log the address on click. Afterwards they show the same details as above, that is network holder and estimated place. Anyone who uses them without others knowing processes personal data without a legal basis.

Does my website see which company visits me? Only if the visit comes from a network that is registered to the company in the registry. How often that is the case is explained in Which companies visit my website? Three ways at a glance.