This is a hotly debated question that has different answers in different legal jurisdictions.
Under the EU General Data Protection Regulation and EU case law, IP addresses (both static and dynamic) are considered personal data, while definitions of personal information in the U.S. Privacy Act and many state privacy laws do not include IP addresses, as well as other HTTP header information that website hosts regularly collect about their visitors.
The U.S. Federal Trade Commission’s 2013 Children's Online Privacy Protection Act rule stakes out an intermediate position by including in its definition of personal information “persistent” IP addresses and other identifiers that “can be used to recognize a user over time and across different Web sites or online services.”
While IP addresses and other “online identifiers” were included in the definition of “personal information” in the California Consumer Privacy Act, the meaning of this language has been a subject of debate in the rulemaking process the California Attorney General’s Office is conducting to implement the CCPA. The modified proposal that the attorney general’s office released Feb. 10 proposed new language (Section 999.302) clarifying that IP addresses a business collects from visitors but does not link to particular people or households would not be “personal information.” This language was removed from the next draft released March 11 after some commenters objected that the IP addresses could still potentially be linked to particular individuals.
This issue came up recently for the first time in the context of the federal Freedom of Information Act. An opinion issued by a federal judge in the Southern District of New York (New York Times v. Federal Communications Commission) April 30 evaluated whether IP addresses and other server log information could be covered by “Exemption 6,” the privacy provision in FOIA that protects personal information from public disclosure.
The case started in 2017, when the FCC conducted a rulemaking to reexamine the “Open Internet” rules the FCC had adopted in 2015. The proceeding (known as “Restoring Internet Freedom”) was controversial, and the agency’s public online comment system, the Electronic Comment Filing System, was swamped with more than 20 million comments. As it did for all FCC rulemaking proceedings, ECFS notified RIF commenters that the information they submitted to the agency for consideration, including their names and addresses, which were required fields, would be publicly available.
As outside researchers began analyzing the public comments in the RIF proceeding, they discovered a number of problems, including comments filed through suspicious bot campaigns, under false names and with stolen email addresses. To conduct its own analysis of the comments, The New York Times submitted an FOIA request to the FCC for the ECFS server logs. After negotiations with the FCC, the Times narrowed its request down to two server log elements, the originating IP addresses of the comments and their associated HTTP “Agent-User” headers, which provide information about a user’s browser and operating system.
The FCC refused to provide this information to the Times, arguing among other things, that the IP addresses and Agent-User headers were “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy” under FOIA Exemption 6.
Federal courts have broadly interpreted the statute’s “similar files” language to mean any information that can be linked to particular individuals. Because IP addresses and User-Agent headers could be linked to individual commenters, the FCC claimed, they could be withheld from release. While they had been notified that their names and addresses would be made public with their comments, the commenters would not have reasonably expected that the log information they generated by visiting the ECFS website would also be disclosed.
The Times responded that any privacy interest the commenters had in the log information was a de minimis one. Under well-developed FOIA case law, agencies may only withhold personal information in which there is a “significant privacy interest.” Commenters were on notice that their personal information would be made public as part of the rulemaking proceeding; therefore, they would not have expected the server log information associated with their comments to be private.
The Times also made the technical argument that because internet service providers “dynamically” assign IP addresses to their customers’ devices, it was unlikely that an IP address would still be associated with a particular commenter many months later.
In the court’s decision granting summary judgment for the Times, Judge Lorna Schonfield refused to accept the argument that the commenters’ privacy interest in the log information was de minimis. She noted that IP addresses and other device-specific information were the types of information digital advertisers and platforms used to compile detailed behavioral profiles of consumers.
Schonfield relied instead on what is known as the FOIA Exemption 6 “balancing test” and FOIA’s strong presumption in favor of disclosure. She determined that the commenters’ privacy interests were outweighed by the public interest in knowing how fraudulent activity might have impacted the integrity of the FCC rulemaking process.
This case shows that in many different legal contexts, policymakers are moving beyond the traditional notions of personal identifiers, such as name, address, birthdates and government-assigned identification numbers. They are increasingly recognizing that consumers’ web-based activities are generating large volumes of “observed” (rather than “provided”) personal information that many different parties — government agencies, advertisers and journalists, to name a few — can use to analyze their past conduct and predict their future activity.
This trend means that the definition of “personal information” is likely to remain a contested territory.
Photo by Markus Spiske on Unsplash
