Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
In EU's GDPR the IP address is considered personal data (lots of discussions about it, but this seems to be the correct interpretation at the moment). Several countries have now privacy laws which are quite similar to GDPR (e.g. Switzerland's revDSG, CCPA in California, APPI in Japan, LGPD in Brasil, ...) or plan to set this up.
Are there privacy laws oher than GDPR which consider IP addresses as personal data? Or is the EU currently the only one?
The California CCPA, Virginia Consumer Data Protection Act (CDPA), and the Colorado Privacy Act (CPA) all use definitions of "personal information" (PI) very similar to that used by the GDPR, and the arguments which have been applied to classify an IP address as Personal Data under the GDPR could logically be used under each of those laws. For example this official page gives the CCPA definition as:
Personal information is information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics.
Note that IP addresses are not specifically mentioned, nor are "online identifiers" a key term under the GDPR. But an IP address often provides geolocation data, which is mentioned.
The April 2020 article "Are IP addresses 'personal information' under CCPA?" from The Privacy Advisor by IAPP says:
For many businesses, the collection of IP addresses provides multiple benefits from monitoring website traffic to advertising, tracking and deterring malicious activity. But are IP addresses “reasonably capable” of being associated with or “linked” to an individual or household? If not, do they still “relate[] to” or “describe” a consumer or household? These questions are critical to address, because if IP addresses are considered to be “personal information,” then businesses may find themselves subject to additional obligations under the CCPA or forced to rethink how they handle IP addresses as part of their online business.
...
The CCPA’s definition of personal information expressly contemplates including IP addresses. An IP address alone may not allow a business to identify a particular consumer or household; however, in many — if not most — cases, an ISP can link an IP address with a name, home address, phone number, email address and even payment information. ...
...
On Feb. 10, the California attorney general issued its first set of modifications to its proposed CCPA regulations. These modifications included the following guidance:
[I]f a business collects the IP addresses of visitors to its websites but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be ‘personal information.
The article goes on to explore the implications of that proposed regulation, saying:
In other words, if the business did not link the IP address to a consumer or household, and the business could not reasonably link the IP address with a particular consumer or household, the IP address would not be personal information. This interpretation aligns with the reality that even if businesses wished to link IP addresses to individuals or households, many would lack the information needed to do so themselves and would be unlikely to succeed in compelling an ISP to do so for them
However, the regulation quoted above was removed in the March 2020 draft of the proposed regulations and did not appear in the (PDF) Final Regulations, issued in August 2020.
The IAPP article goes on to discuss the ECJ case Breyer v. Bundesrepublik Deutschland in which the Court held that IP addresses were personal information in that instance. The article mentions that:
Ultimately, the court held the website provider had the means likely reasonably to tie dynamic IP addresses back to individuals because it had legal means for compelling ISPs to do so. Therefore, it held that dynamic IP addresses collected by a publicly accessible website constituted personal data “in relation to that provider.”
What the article does not specifically mention, and several other published comments relying on the Breyer decision do not discuss was that in that particular case the website was operated by the government of Germany, which has legal powers to require any ISP operating in Germany to disclose IP assignments. That means that in that particular case IP addresses were potentially linkable by the Data Controller of the site, in ways which would not be available to a non-government site. There does not seem to have been an official decision under any of these laws, including the GDPR, as to whether an IP address is PI for an ordinary business site.
The downloadable Privacy Law Comparison matrix compares various aspects of the CCPA, CDPA, CPA, and the GDPR, including their definitions of PI.
In short it is not clear to what extant any of the other privacy laws mentioned in the question or in this answer treat an IP address as personal information (PI), particularly when the site is not operated by a government agency, and has no right to compel an ISP to provide data linking an IP address to a specific user. Future litigation may well clarify this.
