> As far as I know, it’s only one German court which once considered that an IP address was PII in a specific case. There is nothing in the law that explicitly

> As far as I know, it’s only one German court which once considered that an IP address was PII in a specific case. There is nothing in the law that explicitly says that IP addresses are PII. CJEU ruled back in 2016 that IP address is personal data if provider has legal means to identify the person. This includes, as example that was given in the case, laws that give means for service provider to identify the users in the case of cyber attack by requesting help from other authorities. This ruling is from before GDPR and relates to the older Data Protection Directive, but the relevant chapters are largely same (GDPR mostly increased the explicit scope). Ruling: https://curia.europa.eu/juris/document/document.jsf?docid=184668&mode=req&pageIndex=1&dir=&occ=first&part=1&text=&doclang=EN&cid=2713657 https://curia.europa.eu/juris/document/document.jsf?docid=18... The "tl;dr" parts are 30 (the question) & 47-49. The old directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31995L0046&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...