CJEU - C-654/25 - Undelam
CJEU Advocate General opines dynamic IP addresses sent to Google are personal data.
The CJEU Advocate General has opined that a dynamic IP address automatically sent to Google constitutes personal data for the sender if Google can identify the individual by combining it with other data. This case involves a website provider using Google Fonts, leading to IP address transfers to the US. The data subject's claim for damages was questioned due to potentially abusive intentions, prompting the referral to the CJEU.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonEmbedding third-party resources such as Google Fonts directly from an external CDN causes end-users' dynamic IP addresses to be automatically transmitted to the third-party provider — in this case, a US-based entity — without the user's knowledge or consent. The CJEU case confirms that even a dynamic IP address can constitute personal data under GDPR when the recipient can combine it with other information to identify an individual. This matters because countless websites unknowingly trigger transatlantic personal data transfers simply by including an external script or font tag, exposing operators to regulatory liability and potential damages claims. Website owners must treat every third-party resource embed as a data transfer decision requiring a legal basis and appropriate safeguards.