CloakMyIPAddress

Is an IP Address Personal Data Under GDPR? (Plain-English Guide)

Yes, in most cases. What the GDPR, Recital 30 and the CJEU's Breyer ruling say about IP addresses, what it means for websites, and your rights as an EU resident.

By CloakMyIPAddress Privacy Desk Published

Disclosure: This guide contains links to VPN providers via our /go/ links, which may earn us a commission in future. Disclosure · This is general information, not legal advice.

On this page
  1. What the GDPR says
  2. The Breyer ruling (CJEU, 2016)
  3. Static vs dynamic IPs
  4. What this means for websites (and why you see cookie banners)
  5. The Google Analytics decisions
  6. Your rights as an EU resident
  7. Reducing how much your IP is collected
  8. FAQ
  9. Sources

Last reviewed: 30 October 2026 · By the CloakMyIPAddress Privacy Desk

Short answer: in most real-world situations, yes. The EU’s General Data Protection Regulation (GDPR) treats IP addresses as “online identifiers”, and the EU’s top court has ruled that even a dynamic IP address can be personal data in the hands of a website operator. That means companies need a legal reason to collect and keep your IP, must tell you about it, and must respect your data-protection rights.

See the IP address websites receive from you right now →

What the GDPR says

Article 4(1) defines personal data as any information relating to an identified or identifiable natural person — including someone who can be identified indirectly by reference to “an online identifier”.

Recital 30 spells it out: people “may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers”. Combined with other information, such identifiers can be used to create profiles and identify people.

The key word is identifiable. An IP address on its own doesn’t contain your name. The question is whether the organisation holding it could, using means reasonably likely to be used, link it to you — directly or with someone else’s help (Recital 26).

The Breyer ruling (CJEU, 2016)

The leading case is Patrick Breyer v Bundesrepublik Deutschland (C-582/14), decided by the Court of Justice of the EU on 19 October 2016 (under the old Data Protection Directive, but the reasoning carries over to GDPR).

  • German federal websites stored visitors’ dynamic IP addresses.
  • The court held that a dynamic IP address is personal data for a website operator if it has legal means to identify the person with additional information held by a third party — here, the internet provider, which can be compelled to disclose subscriber information, e.g. in case of cyber-attacks.
  • The court also said website operators may have a legitimate interest in storing IP addresses to keep their sites working and secure.

Static vs dynamic IPs

TypePersonal data?Why
Static IP linked to a customer (e.g. small business, some fibre users)YesDirectly linkable to the subscriber
Dynamic IPUsually yes (Breyer)ISP can link IP + time to a subscriber; legal routes exist
IP of a large mobile carrier gateway shared by many usersContext-dependentHarder to single out one person, but often combined with other data
Truncated IP (e.g. last octet removed)Often not, if truly anonymisedDepends on what else is held

If a site logs IP addresses — in server logs, analytics, fraud checks or ad-tech — GDPR applies:

  1. Legal basis (Article 6). Commonly legitimate interests (security, fraud prevention) or consent (advertising/analytics in many cases).
  2. Transparency (Articles 13–14). The privacy notice must say IPs are collected, why, and for how long.
  3. Data minimisation and storage limitation (Article 5). Keep only what’s needed, for as short as possible; many sites truncate or delete IPs after days or weeks.
  4. International transfers (Chapter V). Sending IPs to non-EU services needs a valid transfer mechanism.

Separately, the ePrivacy Directive (the “cookie law”) requires consent for storing or reading information on your device — which is why banners mostly talk about cookies rather than IP addresses.

The Google Analytics decisions

In 2022, data-protection authorities in Austria, France, Italy and others found that particular Google Analytics deployments transferred personal data (including online identifiers related to IP addresses) to the US without adequate protection. After the EU-US Data Privacy Framework was adopted in July 2023, transfers to certified US companies can rely on that adequacy decision. Google Analytics 4 also does not log or store IP addresses, according to Google’s documentation.

Your rights as an EU resident

Because your IP can be personal data, you can generally:

  • Access (Article 15): ask a company what personal data it holds, including IP logs linked to you.
  • Erasure (Article 17): ask for deletion, subject to exceptions (e.g. security logs needed for a legal claim).
  • Object (Article 21): object to processing based on legitimate interests, including profiling.
  • Complain to your national data-protection authority (in Estonia, the Andmekaitse Inspektsioon; in Germany, your state’s DPA; in Ireland, the DPC).

In practice it’s hard for a company to find “your” IP records without you proving which IP you had and when.

Reducing how much your IP is collected

GDPR limits what companies may do, but the simplest protection is not to hand over your home IP in the first place:

  • Use a VPN for everyday browsing — the site then logs the VPN server’s IP, which is shared by many users. EU-based or EU-adjacent options include Proton VPN (Switzerland), Mullvad (Sweden) and Surfshark (Netherlands-based operator). Remember the VPN provider itself then sees your IP — choose one with an independently audited no-logs policy.
  • Use the Tor Browser for high-anonymity needs.
  • Block third-party trackers with your browser’s built-in protections.
  • Check for WebRTC, DNS and IPv6 leaks.

FAQ

Is an IP address personal data? Usually yes — Recital 30 and Breyer.

Can a website log my IP? Yes, with a legal basis, transparency and limited retention.

Can I ask for deletion? Yes, under Article 17, with exceptions.

Does Google Analytics break GDPR? Some older setups were ruled unlawful in 2022; the 2023 Data Privacy Framework changed the transfer basis.

Sources