Dynamic IP Addresses Qualify as Personal Data Under GDPR, CJEU Advocate General Opines
Written by AI from the linked story. Not reviewed by an editor. How this works
The CJEU Advocate General's opinion in C-654/25 reinforces that dynamic IP addresses transmitted to third parties like Google can constitute personal data when the recipient can reasonably combine them with other data to identify an individual. This matters because many website operators embed third-party scripts, fonts, or analytics tools that silently transmit visitor IP addresses without a lawful basis or adequate disclosure. Organizations that fail to treat these automatic data transfers as personal data processing risk GDPR non-compliance, even when the transfer is technically incidental. The opinion also introduces an abuse-of-rights nuance: data subjects who deliberately engineer data transfers to claim damages may have their claims dismissed, signaling courts are sensitive to bad-faith litigation tactics alongside genuine privacy harms.
Tactical Insight
Immediate actions
- Audit all third-party scripts, CDN resources, and embedded content on your websites to identify automatic IP-transmitting requests to external parties.
- Ensure your privacy notice explicitly discloses every third-party service that receives visitor IP addresses and the lawful basis for that transfer.
Long-term improvements
- Implement a Content Security Policy (CSP) and a consent management platform (CMP) to gate third-party resource loading until valid user consent is obtained.
- Replace externally hosted third-party resources (e.g., Google Fonts, analytics) with self-hosted alternatives to eliminate unnecessary IP disclosures.
- Establish a recurring Data Protection Impact Assessment (DPIA) process for any new third-party integration that processes visitor data.
Detection & compliance measures
- Deploy automated web-scanning tools to continuously detect new third-party network requests that were not reviewed by your privacy team.
- Maintain a Records of Processing Activities (RoPA) entry for each third-party data transfer, reviewed at least annually against current legal opinions and regulatory guidance.