19 October

What happened on this date in privacy, anonymity networks and censorship. Every year on the same date we add a new look back and keep the earlier ones as they were.

2026

IP addresses logged by websites as personal data

Every time you open a website, its servers can log the IP address you connect from; an address that changes with each new connection is called a dynamic IP address. On 19 October 2016, according to the court's press release, the EU's Court of Justice ruled that a dynamic IP address is personal data for a website operator that has legal means to obtain additional information from the internet provider to identify the visitor. The same judgment also accepted that a website may have a legitimate interest in storing certain visitor data to protect itself against cyberattacks. In Asia, Taiwan's National Development Council cited the ruling in a 2020 interpretation, noting the court's view that a dynamic IP address is personal data when it can reasonably be matched with other data to identify someone, while Singapore's data protection guidelines revised in May 2024 say an IP address may not be personal data on its own but becomes more likely to identify someone as more data points are tied to it. To find out whether the sites you use keep your IP address, start with their privacy policies.

Also on this day

  • Let's Encrypt announced cross-signatures from IdenTrust, making its free certificates trusted by all major browsers. Source: Let's Encrypt