This is only true in certain jurisdictions. The GDPR recitals specifically mention IP addresses as examples of personal data: > Natural persons may be associat

This is only true in certain jurisdictions. The GDPR recitals specifically mention IP addresses as examples of personal data: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. from https://gdpr.eu/recital-30-online-identifiers-for-profiling-and-identification/ https://gdpr.eu/recital-30-online-identifiers-for-profiling-... Further support for this interpretation in case the above comes off as "only if combined with other data": https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...