Short answer: yes, it can be. The Court of Justice of the European Union held (case C-582/14, Breyer) that even a dynamic IP address can be personal data when whoever processes it has a lawful means of linking it to a person — for example through the internet provider in legal proceedings.
What it means for website operators
The GDPR, and in Estonia the Personal Data Protection Act, apply to processing IP addresses. In practice:
- process IP addresses only with a legal basis (security, for example);
- keep logs only as long as necessary;
- describe the processing in your privacy policy;
- do not pass addresses on to third parties without reason.
In Estonia the supervisory authority is the Data Protection Inspectorate (Andmekaitse Inspektsioon).
What it means for visitors
You have the right to know whether and how your data is processed, and to ask for it to be erased once there is no longer a basis. An IP address alone does not reveal your name or street address; that requires the provider’s records, which it discloses only under legal process.
How ipaddress.ee handles IP addresses
- Your IP address is used only to answer your request; it is not written to our logs or database.
- Rate limiting works on keyed hashes held in memory and rotated daily.
- We keep no lookup history and set no tracking cookies.
More: privacy policy and how this site works.
This article is general information, not legal advice.