Is an IP address personal information?
Part of US and Canada targeting
The short answer
Canada's privacy commissioner says an IP address can be personal information if it can be associated with an identifiable individual. California's privacy law lists Internet Protocol address among its identifiers, and Virginia covers data reasonably linkable to a person. Truncating or hashing an address does not settle the question on its own.
Key takeaways
- The OPC's test is whether there is a serious possibility that a person could be identified, alone or with other information.
- In 2024 the Supreme Court of Canada held that an IP address attracts a reasonable expectation of privacy against police requests.
- California names Internet Protocol address in its personal information and unique identifier definitions; Virginia uses a reasonably linkable test.
- The FTC's technologists say hashed identifiers are not anonymous and can still track a person or device over time.
- Parties that receive the ad request or serve the creative can see an IP address, so the question applies along the whole chain.
Is an IP address personal information in Canada?
Under PIPEDA, personal information is information about an identifiable individual. The Office of the Privacy Commissioner of Canada's interpretation bulletin on personal information (opens in a new tab) gives the test from Gordon v. Canada (Health), 2008 FC 258: information is about an identifiable individual where "there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other information."
Applied to network addresses, the bulletin says an IP address can be personal information if it can be associated with an identifiable individual, and describes an OPC finding that IP addresses an internet service provider collected were personal information because the provider could link them to customers through their subscriber IDs. The bulletin also states that "These Interpretations are not binding legal interpretations." The OPC's separate guidance on behavioural advertising is covered on the PIPEDA online advertising page.
Definition
- Serious possibility of identification
- The Federal Court test the OPC applies: information is about an identifiable individual when there is a serious possibility that someone could be identified from it, alone or combined with other available information.
The OPC's archived 2013 research report, What an IP Address Can Reveal About You (opens in a new tab), showed why the link matters. It found that IP addresses and related subscriber data can be used to build "very detailed portraits of individuals," and that lookup tools can "determine the geolocation of the computer, with varying degrees of accuracy."
An IP address attracts a reasonable expectation of privacy.
R. v. Bykovets (opens in a new tab) is a criminal case under section 8 of the Charter: the Court held that a police request for an IP address is a search. It does not interpret PIPEDA. The Court's plain language summary says the majority found that if section 8 was to meaningfully protect the online privacy of Canadians, "it must protect their IP addresses."
How do US state privacy laws treat IP addresses?
US state laws take two approaches. California names the address. Section 1798.140(v) of the CCPA (opens in a new tab) defines personal information as information that "could reasonably be linked, directly or indirectly, with a particular consumer or household," and lists "Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address" among its examples. Section 1798.140(aj) also lists an Internet Protocol address as a unique identifier.
Virginia uses a linkability test without naming IP addresses. Its Consumer Data Protection Act definitions (opens in a new tab) cover "any information that is linked or reasonably linkable to an identified or identifiable natural person," exclude de-identified data, and define pseudonymous data as personal data that "cannot be attributed to a specific natural person without the use of additional information" kept separately under appropriate safeguards.
| Point | Canada (PIPEDA, OPC) | California (CCPA) | Virginia (VCDPA) |
|---|---|---|---|
| Core test | Serious possibility of identifying an individual | Reasonably capable of being associated with, or linked to, a consumer or household | Linked or reasonably linkable to an identifiable natural person |
| IP address named? | Yes, as information that can be personal when associated with a person | Yes, in the personal information and unique identifier definitions | No; covered when it meets the linkable test |
| Household or device | Not addressed in the bulletin | Household and linked device included | De-identified data must not be linkable to a person or a device linked to that person |
| Location detail | Bulletin and research describe IP geolocation with varying accuracy | Precise geolocation: device derived, within a circle of 1,850 feet radius | Precise geolocation: within a radius of 1,750 feet |
Does geotargeting by IP involve personal information?
Geotargeting by IP starts with the address itself, so the address is processed even when the output is only a country or a city. OpenRTB 2.6 carries it in the Device object as the "IPv4 address closest to device" next to a Geo object with the derived location; the geo targeting guide explains those fields. The regulators' definitions then turn on what else travels with the address and who can link it.
Both state laws single out fine location. California defines precise geolocation as data "derived from a device" and used to locate a consumer within an area "equal to or less than the area of a circle with a radius of 1,850 feet"; Virginia's figure is 1,750 feet, and both list precise geolocation as sensitive. An IP lookup to a city describes a far larger area than either circle, while GPS coordinates from a phone can fall inside it.
California also defines aggregate consumer information as information about a group "from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device." A delivery report by country holds no individual rows, while a log file can keep the address beside each impression.
What changes when IP addresses are truncated or hashed?
Truncation drops part of the address, for example the last block of an IPv4 address, which leaves a group of 256 possible addresses instead of one. Hashing replaces the address with a fixed code. Neither is a legal category by itself. The OPC bulletin says de-identified personal information "does not qualify as anonymous information if there is a serious possibility of linking the de-identified data back to an identifiable individual." California's deidentified definition requires that information "cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer," and that the business takes reasonable measures, publicly commits not to reidentify, and contractually binds recipients.
The FTC's Office of Technology addressed hashing directly in July 2024, in a post titled No, hashing still doesn't make your data anonymous (opens in a new tab). It says "data is only anonymous when it can never be associated back to a person," that a hash "still creates a unique signature that can track a person or device over time," and lists IP addresses among common identifiers whose hashes can be reversed by guessing.
| Transformation | What it removes | What remains to check, in the regulators' terms |
|---|---|---|
| Last block truncated | The exact address; about 256 IPv4 addresses share the result | Whether the record can still be linked to a person or household with other data |
| Hashed address | The readable address | Per the FTC, a persistent signature that can track a device over time |
| Address dropped after country lookup | The address from that record | Copies kept upstream, and identifiers left in the same row |
| Aggregated report | Individual rows | Whether it meets California's aggregate consumer information wording |
Which party in the ad chain handles the IP address?
Every server a browser or app connects to sees the connecting address, and programmatic ads involve several of them. The address arrives first at the publisher's site or app, passes to the supply platform in the ad request, travels to each bidder in the OpenRTB Device object, and reaches the ad server that delivers the creative and any measurement tags that fire. Each of those parties makes its own decision about what to keep.
Facts to collect about each party, in the regulators' vocabulary
- Whether the party receives the full address, a truncated one, a hash or only a derived location.
- Which other identifiers travel in the same record, such as device or user IDs.
- Whether the party acts for another business or decides its own purposes, the controller and processor split in Virginia's definitions.
- How long the full address is kept, and where copies remain.
- Whether any precise geolocation, as California or Virginia define it, travels with the address.
How does one plan record the identifier facts?
Fictional example
A garden center chain on Prince Edward Island
An unnamed garden center chain with stores in Charlottetown and Summerside plans spring display ads beside gardening, seed starting and local news articles, with delivery limited to Prince Edward Island. The site list is built from article content. Location comes from the buying platform's province setting, which reads the location in each bid request.
Its marketing lead asks whether the campaign uses personal information. The agency's notes record the facts in the OPC's terms: bid requests carry the visitor's IP address and a derived province; the agency receives only a province level report; the supply platform and bidders receive the full address under their own terms. No user segments are applied.
The notes go to the chain's privacy officer with links to the OPC bulletin and the Bykovets decision. The agency does not label the campaign anonymous, and no conclusion about compliance is drawn in the plan.
How does PlacementGraph choose sites without personal data?
Frequently asked questions
Does the Bykovets decision apply to advertisers?
R. v. Bykovets, 2024 SCC 6, concerned section 8 of the Charter, which limits searches by the state, and held that a police request for an IP address is a search. Private sector handling of IP addresses is governed by PIPEDA and the provincial laws in Alberta, British Columbia and Quebec.
Is an IP address that maps to a whole city precise geolocation under California law?
California defines precise geolocation as data derived from a device and used to locate a consumer within a circle of 1,850 feet radius or smaller. A city level lookup describes an area much larger than that circle. Coordinates sent from a phone's location services can fall within it, which is where the definition is aimed.
Does a country level delivery report contain personal information?
California's statute treats aggregate consumer information, about a group with identities removed and not reasonably linkable to any consumer, household or device, as distinct from personal information. The statute sets that wording; it does not classify any particular report. The raw logs that produced it may still hold addresses and identifiers.
Does an IPv6 address change the analysis?
The definitions do not change, since California's statute names Internet Protocol addresses generally and the OPC's test is about identifiability. OpenRTB carries IPv6 in its own Device field. Truncating IPv6 removes a different share of the address than truncating IPv4, so record exactly which part was dropped.
Sources
- Interpretation Bulletin: Personal Information (opens in a new tab)Office of the Privacy Commissioner of Canada
- What an IP Address Can Reveal About You (May 2013, archived) (opens in a new tab)Office of the Privacy Commissioner of Canada
- R. v. Bykovets, 2024 SCC 6 (opens in a new tab)Supreme Court of Canada
- California Consumer Privacy Act, as amended, effective January 1, 2026 (opens in a new tab)California Privacy Protection Agency
- Code of Virginia, section 59.1-575, Definitions (opens in a new tab)Virginia General Assembly
- No, hashing still doesn't make your data anonymous (opens in a new tab)Federal Trade Commission, Office of Technology
- OpenRTB 2.6: Device object (opens in a new tab)IAB Tech Lab
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.