For almost every website and SaaS operator, yes. The Court of Justice held in Breyer that a dynamic IP address is personal data in the hands of a website operator where that operator has legal means reasonably likely to be used to identify the visitor, even when the identifying information sits with an internet service provider. The answer is relative to who holds the address, not fixed to the address itself.
This article covers the case that decided it, the test the courts actually apply, why the static and dynamic distinction matters less than people expect, what the 2025 SRB judgment changed, and what all of it means for your logs.
The Case That Settled It
Patrick Breyer, a German politician, objected to federal government websites logging visitor IP addresses. The question referred to the Court of Justice was whether a dynamic IP address, held by a website operator who could not by itself link it to a person, was personal data.
In its judgment of 19 October 2016 in Case C-582/14, the Court said it could be. Reasoning from Recital 26 of the then-applicable directive, it observed at paragraph 43 that because the recital refers to means likely reasonably to be used by the controller "or by any other person," it is not required that all the information enabling identification be in the hands of one person.
The Court then set the qualifier that does the real work. It is personal data where the operator has legal channels enabling it to obtain the additional information from the internet service provider, in that case by contacting the competent authority after a cyberattack. That combination amounted to a means reasonably likely to be used.
The Test Is What You Could Reasonably Do
Recital 26 of the GDPR carries the same standard: account should be taken of all the means reasonably likely to be used to identify the person, judged against objective factors including cost, time required, available technology and technological developments.
Breyer supplied the negative limb. Identification is not reasonably likely where it is prohibited by law or practically impossible, requiring a disproportionate effort in time, cost and manpower, so that the risk of identification appears in reality to be insignificant. That threshold is high. "We have not tried" does not clear it, and neither does "we would need to ask someone."
This is why the honest answer is conditional rather than a flat yes, and why it is still a usable answer. You are not being asked whether identification is theoretically conceivable. You are being asked whether a route exists that you could realistically take. For a SaaS operator with an abuse process, a legal team and a relationship with a hosting provider, that route usually exists.
It is also why the question is better asked in the regulation's own vocabulary. The GDPR does not use the term PII, and the American frameworks that do tend to sort data into fixed categories rather than assess identifiability in context. If you need the wider taxonomy, our guide to personally identifiable information covers it; it classifies an IP address as context-dependent, which is correct as far as it goes and is precisely the point at which the legal analysis has to start rather than stop.
The same reasoning underpins the boundary between pseudonymised and genuinely anonymous data, which our article on anonymisation versus pseudonymisation works through in more detail.
Static Versus Dynamic Matters Less Than People Think
The received wisdom is that static IPs are personal data and dynamic ones are not. Breyer was specifically about a dynamic address, and it still found personal data.
The practical problem is worse than the legal one. A website operator receiving a request cannot generally tell at the moment of collection whether the address is static or dynamic, whether it belongs to a residential connection or a corporate NAT gateway shared by four hundred employees, or whether it is a VPN exit node. The Article 29 Working Party made this point early: operators will rarely be able to distinguish, and will therefore have to treat all IP addresses as personal data to be on the safe side.
That is not timidity. It is the only operable rule when the distinguishing fact is invisible to you at collection time.
What The SRB Judgment Changed In 2025
On 4 September 2025 the Court of Justice decided EDPS v SRB, Case C-413/23 P, setting aside a 2023 General Court judgment. It is the most significant development on the meaning of personal data since Breyer.
The Court explicitly confirmed the relative approach: "personal" is not an absolute property of data. The same pseudonymised dataset can be personal data for the organisation holding the key and non-personal for a recipient who cannot reverse it and has no other reasonable route to identification. It also held that personal opinions are inherently linked to their author and are therefore personal data, and that transparency obligations are assessed from the controller's perspective at the point of collection.
For IP addresses the direction is consistent with Breyer rather than contrary to it: the question is always whose hands the data is in. What SRB adds is that the answer can legitimately differ between you and a vendor you send data to. It does not mean you can send IP addresses to an analytics provider and declare the problem theirs. Your own assessment is unchanged, and your duty to tell people what you collect is expressly unaffected.
This is a live area. The EDPB's pseudonymisation guidelines were still moving through consultation during 2025, and commentators disagree about how far SRB reaches. Treat the relative approach as settled and the downstream consequences as contested.
What This Means For Your Logs And Analytics
If your servers log IP addresses, you are processing personal data and the ordinary obligations apply: a lawful basis, a retention period, a line in your Article 30 record, and disclosure in your privacy information.
That is usually manageable. Security logging has a strong legitimate interests case, provided you have actually done the balancing exercise and written it down. Retention is where teams get caught, because default log retention is often indefinite and nobody chose it.
Vendor contracts confirm the position rather than complicate it. Cloudflare's data processing addendum describes personal data in Customer Logs "such as IP addresses," and Sentry's schedule lists IP address among the categories of personal data it processes, both checked 7 August 2026. When two major infrastructure vendors write this into their own contracts, arguing that IP addresses are not personal data becomes a difficult position to hold.
The broader question of what else in a log file counts, and how to set retention for logging as a practice, belongs to our article on whether server logs count as personal data.
Common Mistakes With IP Addresses And Personal Data
Assuming the US concept of PII settles it. Frameworks that treat an IP address as merely "linked" information are answering a different question under a different law. The GDPR asks about identifiability, not about membership of a category list.
Treating dynamic addresses as automatically outside scope. Breyer concerned a dynamic address and found it could be personal data. The allocation method is not the test.
Truncating the last octet and calling the result anonymous. Partial masking reduces risk but rarely eliminates identifiability, particularly when the truncated address sits beside a session identifier, a user agent and a timestamp in the same row.
Logging indefinitely because storage is cheap. Retention has to be justified against purpose. An unbounded security log is not a security control, it is an unassessed risk with a lawful basis nobody wrote down.
Assuming a vendor's assessment covers yours. SRB confirms the analysis is relative to the holder. That your analytics provider concludes it cannot identify anyone says nothing about your own position.
FAQ
Is an IP address always personal data under GDPR?
Not automatically, but usually in practice. The test is whether means reasonably likely to be used exist to identify the person, judged from the position of whoever holds the address. For most website and SaaS operators such means do exist, which is why the working assumption should be that it is personal data.
Does the Breyer ruling still apply under GDPR?
Yes. It was decided under the earlier directive, but Recital 26 of the GDPR carries essentially the same identifiability standard, and later case law including the 2025 SRB judgment has built on Breyer's relative approach rather than departing from it.
Can I avoid GDPR by not storing IP addresses at all?
For that data point, yes, and it is a legitimate design choice. Many analytics configurations can discard or hash the address at collection. Be aware that your hosting provider, CDN and error tracker are probably still logging it independently of your application.
Are IP addresses personal data if we only use them for security?
Yes. Purpose does not change classification. Security is a strong basis for processing them under legitimate interests, but it does not take the data outside the regulation, and you still owe retention limits and transparency.
Closing Thought
The reason this question keeps being asked is that the answer is genuinely relative, and relative answers are unsatisfying to anyone hoping to tick a box. An IP address is not personal data in the way a passport number is. It is personal data because of what you, specifically, could do with it.
That is uncomfortable, because it means your own capability is part of the legal test, and capability grows. The team that could not identify a visitor in 2019 may have an abuse workflow, a support tool and a data warehouse that jointly can in 2026. If you want the processing that depends on this to be documented somewhere you can actually maintain, ComplyDog hosts a compliance portal on your own domain covering your DPA, subprocessor list, data subject request handling and security page. It will not make the classification question go away, because nothing does.
