Re:GDPR will pop the adtech bubble
by sethhochberg on Sunday May 13, 2018 @03:01PM
(#17060374)
The article we're in the comments for is about the GDPR - as defined in article 4 of the GDPR, IP addresses constitute personal data. In many cases, a specific IP address, even a dynamic one, can be used to uniquely identify a natural person.
Even though in many cases this won't help you identify a specific natural person (ie, you don't know whether whether you're dealing with a specific person or multiple people on a shared connection, and an IP address on its own usually isn't enough for you to de-anonymize a person), they're still a considered a personal identifier, are often coupled to a general physical location, and are now explicitly legally protected.
Couple an IP address with a browser user-agent, and you've got the basis for a strong unique fingerprint for a specific person.
https://gdpr-info.eu/art-4-gdpr/
Even though in many cases this won't help you identify a specific natural person (ie, you don't know whether whether you're dealing with a specific person or multiple people on a shared connection, and an IP address on its own usually isn't enough for you to de-anonymize a person), they're still a considered a personal identifier, are often coupled to a general physical location, and are now explicitly legally protected.
Couple an IP address with a browser user-agent, and you've got the basis for a strong unique fingerprint for a specific person.