It follows from case law from the ECJ, e.g. C‑70/10 (28 January 2010) and C-582/14 (19 October 2016), that IP-addresses are personal data.

It also follows from [Recital 30](https://gdpr-info.eu/recitals/no-30/) of the GDPR. This recital lists the identifiers that makes natural persons *identifiable*:

> Natural persons *may* be associated with online identifiers provided by their devices, applications, tools and protocols, such as **internet protocol addresses**, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis).

To understand what this means, we need to examine the case law i mentioned in the introduction. The first of those are [ECJ C-70/10](http://curia.europa.eu/juris/document/document.jsf?text=&docid=115202&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=152181).  In this, the court concludes that *all* IP-addresses are "protected personal data":

> It is common ground, first, that the injunction requiring installation of the contested filtering system would involve a systematic analysis of all content and the collection and identification of users’ IP addresses from which unlawful content on the network is sent. Those addresses are **protected personal data** because they allow those users to be precisely identified. (my emphasis)

Then, in 2016, the ECJ ruled in a more narrow case [ECJ C‑582/14](http://curia.europa.eu/juris/document/document.jsf?docid=184668&doclang=EN) specifically ruling on *dynamic IP-addresses*:

The court goes through a number of deliberations, then concludes:

> Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a **dynamic IP address** registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

It is very clear from this text that the court does *not* challenge or invalidate ECJ C-70/10 on *static* IP-addresses.  The court is very careful, in its ruling to point out its ruling is specifically about *dynamic* IP-addresses.

So the ruling of ECJ C-70/10 still stands for *static* IP-addresses, these are always protected personal data.

To not beat about the bush: *Unless* you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR.

I think the legal framework I have cited is *sufficient* to state that their is legal base to conclude that under the GDPR is protected personal data.

However, in ECJ C‑582/14, the ruling hinges on the controller having the legal means to identify the data subject by connecting the IP address to some other data.  The court seems to think that getting access to ISP logs is the *only* means of doing that.  This is wrong.

In 2015 the [Norwegian computer scientist Einar Otto Stangvik working for Noway's larges newspaper VG](https://www.vg.no/nyheter/innenriks/i/PM9V0/this-map-shows-95-000-downloaders-of-child-abuse-pictures-worldwide)

> identified 78 Norwegians who seem to have downloaded abuse material.

I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to.

I will not reveal what methods Stangvik used to identify these 78 individuals starting only with their IP-address, but if you now how to do this, it is not too difficult or labour-consuming.

It also follows from the GDPR that logging of IP-addresses falls under its definition of "processing".

Your privacy policy should list all personal data personal data that is collected by yourself and *third parties* ("processors" in the terminology of the GDPR) that you rely on.  Your hosting company is such a third party, and you need to declare the logging of IP-addresses in your privacy policy.