[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOKfUxuQFCLfQLd7VxF_VI8gOLCKeD6dQB5L3X5tvKj0":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"6b795a50-33e9-4ad6-8646-ea5d4a40f790","CJEU - C-654\u002F25 - Undelam","cjeu-c-654-25-undelam-da9def","← Older revision Revision as of 08:13, 11 November 2026 Line 4: Line 4: |ECLI=ECLI:EU:C:2026:948 |ECLI=ECLI:EU:C:2026:948 |Opinion_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Opinion_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2025\u002FC-0654-25-00000000RP-01-P-01\u002FCONCL\u002F328909-DE-1-html |Judgement_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Judgement_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2025\u002FC-0654-25-00000000RP-01-P-01\u002FCONCL\u002F328909-DE-1-html |Date_Decided= |Date_Decided= Line 62: Line 62: }} }} The Advocate General opined that a dynamic IP address that was automatically sent to Google is personal data for the sender when Google is likely to identify the data subject by combining the data with other data that Google has access to. Since the data subject provoked the circumstances that led to the data transfer, they did not suffer immaterial damages, and abused their rights. The Advocate General opined that a dynamic IP address is personal data for the website provider automatically sending the IP address to Google when Google has means reasonably to be used to identify the data subject. Also, since the data subject provoked the data transfer, they cannot claim immaterial damages. ==English Summary== ==English Summary==","The Advocate General opined that a dynamic IP address automatically sent to Google constitutes personal data for the sender if Google can reasonably identify the data subject by combining it with other data. The opinion also stated that if the data subject provoked the circumstances leading to the data transfer, they cannot claim immaterial damages and may have abused their rights.","Advocate General opines dynamic IP is personal data if Google can identify user.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-654\u002F25_-_Undelam&diff=53679&oldid=53667","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-11-11T08:13:02+00:00","2026-11-11T09:00:29.443859+00:00",7,[17,20],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Google Fonts","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18],{"controls":47,"vendors":48},[],[],{"slug":50,"title":51,"body":52,"framework_refs":53,"framework_notes":59},"dynamic-ip-addresses-qualify-as-personal-data-under-gdpr-cjeu-advocate-general-opines","Dynamic IP Addresses Qualify as Personal Data Under GDPR, CJEU Advocate General Opines","The CJEU Advocate General's opinion in C-654\u002F25 reinforces that dynamic IP addresses transmitted to third parties like Google can constitute personal data when the recipient can reasonably combine them with other data to identify an individual. This matters because many website operators embed third-party scripts, fonts, or analytics tools that silently transmit visitor IP addresses without a lawful basis or adequate disclosure. Organizations that fail to treat these automatic data transfers as personal data processing risk GDPR non-compliance, even when the transfer is technically incidental. The opinion also introduces an abuse-of-rights nuance: data subjects who deliberately engineer data transfers to claim damages may have their claims dismissed, signaling courts are sensitive to bad-faith litigation tactics alongside genuine privacy harms.",[54,55,56,57,58],"GDPR Article 4","GDPR Article 6","GDPR Article 13","GDPR Article 35","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"GDPR Article 4":60,"GDPR Article 6":61,"GDPR Article 13":62,"GDPR Article 35":63,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":64},"Article 4(1) defines 'personal data'; the opinion directly applies this definition to dynamic IP addresses, confirming organizations must treat them as personal data when a third party can reasonably link them to an individual.","Article 6 requires a lawful basis for every processing activity; automatically transmitting visitor IP addresses to Google without a valid basis is the core compliance failure this case addresses.","Article 13 mandates transparency about third-party data recipients at the time of collection; failing to disclose that IP addresses are sent to Google violates this transparency obligation.","Article 35 requires a DPIA for high-risk processing; embedding third-party services that transfer personal data to large data controllers like Google warrants prior impact assessment.","This control requires organizations to assess privacy and security risks introduced by suppliers and third-party services before integrating them into their systems."]