A startup processes only IP addresses and argues they can never be personal data. Which GDPR position is correct?
Select an answer to reveal the explanation.
Short Explanation
An IP address can be a digital nametag when it points back to a person with reasonably available means—ISP logs, account records, the usual toolkit. “We only store IPs” is not a free pass out of GDPR if identification is still on the table.
Full Explanation
Online identifiers such as IP addresses can be personal data when they relate to an identifiable natural person, including where the person can be identified by the controller or another person using reasonably likely means. Startups that claim IP addresses can never be personal data conflict with Article 4(1), Recital 30, and CJEU reasoning on dynamic IPs. IP addresses are not categorically excluded by Article 4. Online identifiers do not become personal data only after a court names the individual in a public judgment. Dynamic IPs are not personal data solely when stored next to a passport scan. Exam caveat: identifiability via reasonably likely means is the test—not absolute impossibility or passport co-storage. Operational check: treat IP logs in civic apps as personal data by default unless a documented anonymisation assessment proves otherwise; apply retention limits and access controls accordingly. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.