The IP Address as Personally Identifiable Information

Joshua J. McIntyre, DePaul University College of Law, has published The Number is Me: Why Internet Protocol (IP) Addresses Should Be Protected as Personally Identifiable Information, in volume 60 of the DePaul Law Review (2011). Here is the abstract.

Although computer logs typically correlate online activity only to Internet Protocol (IP) addresses, those addresses can be used to expose the individuals who initiated that activity. While various federal statutes protect similar data, such as telephone numbers and mailing addresses, as Personally Identifiable Information, federal privacy law does not sufficiently protect IP addresses. Thus, it has become commonplace for litigants to subpoena Internet Service Providers (ISPs) to unmask online speakers. Many ISPs have no reason to fight these subpoenas and readily give up their subscribers’ names, addresses, telephone numbers, and other identifying data without demanding any court oversight or providing any notice to those identified. Left unchecked, such reporting could undermine free speech and the free exchange of ideas by encouraging users to censor their own online conduct.

This Comment explores the possibility of protecting the IP address itself as Personally Identifiable Information (PII). It explores the various definitions of PII and the relevant technical aspects of IP addressing. It concludes that, despite some technical shortcomings, IP addresses are functionally similar to other types of PII and should be similarly protected in order to protect online privacy.

Download the comment from SSRN at the link.