IP Address

An IP address (Internet Protocol address) is a numerical identifier assigned to each device connected to a computer network that uses the IP protocol. It enables routing and identification of devices on the network.

There are two main types of IP addresses:

• IPv4: made up of four numbers between 0 and 255, separated by dots (e.g., 192.168.1.1);

• IPv6: a more recent version that allows a larger addressing space, using hexadecimal notation (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334).

Legal status

Under European and French law, an IP address is considered personal data if it can directly or indirectly identify a natural person.

In its judgment of October 19, 2016 (Case C-582/14, Breyer), the Court of Justice of the European Union (CJEU) held that a dynamic IP address can be considered personal data if the internet service provider has the legal means to identify the user.

This interpretation has been confirmed in France by the French Supreme Court (Cass. 1st civ., November 3, 2016, no. 15-22.595), which considers IP addresses to be personal data and subject to data protection regulations.

Practical implications

Processing IP addresses requires compliance with strict personal data protection obligations: legal basis, transparency, limited retention, etc. This applies to websites, mobile apps, network security systems, and any data-collecting services.