Are IP addresses generated when users visit websites personal information?

This is a hotly debated question that has different answers in different legal jurisdictions.

Under the EU General Data Protection Regulation and EU case law, IP addresses (both static and dynamic) are considered personal data, while definitions of personal information in the U.S. Privacy Act and many state privacy laws do not include IP addresses, as well as other HTTP header information that website hosts regularly collect about their visitors.

The U.S. Federal Trade Commission’s 2013 Children’s Online Privacy Protection Act rule stakes out an intermediate position by including in its definition of personal information “persistent” IP addresses and other identifiers that “can be used to recognize a user over time and across different Web sites or online services.”

While IP addresses and other “online identifiers” were included in the definition of “personal information” in the California Consumer Privacy Act, the meaning of this language has been a subject of debate in the rulemaking process the California Attorney General’s Office is conducting to implement the CCPA. The modified proposal that the attorney general’s office released Feb. 10 proposed new language (Section 999.302) clarifying that IP addresses a business collects from visitors but does not link to particular people or households would not be “personal information.” This language was removed from the next draft released March 11 after some commenters objected that the IP addresses could still potentially be linked to particular individuals.

This issue came up recently for the first time in the context of the federal Freedom of Information Act. An opinion issued by a federal judge in the Southern District of New York (New York Times v. Federal Communications Commission) April 30 evaluated whether IP addresses and other server log information could be covered by “Exemption 6,” the privacy provision in FOIA that protects personal information from public disclosure.

The case started in 2017, when the FCC conducted a rulemaking to reexamine the “Open Internet” rules the FCC had adopted in 2015. The proceeding (known as “Restoring Internet Freedom”) was controversial, and the agency’s public online comment system, the Electronic Comment Filing System, was swamped with more than 20 million comments. As it did for all FCC rulemaking proceedings, ECFS notified RIF commenters that the information they submitted to the agency for consideration, including their names and addresses, which were required fields, would be publicly available.

As outside researchers began analyzing the public comments in the RIF proceeding, they discovered a number of problems, including comments filed through suspicious bot campaigns, under false names and with stolen email addresses. To conduct its own analysis of the comments, The New York Times submitted an FOIA request to the FCC for the ECFS server logs. After negotiations with the FCC, the Times narrowed its request down to two server log elements, the originating IP addresses of the comments and their associated HTTP “Agent-User” headers, which provide information about a user’s browser and operating system.

The FCC refused to provide this information to the Times, arguing among other things, that the IP addresses and Agent-User headers were “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy” under FOIA Exemption 6.

Federal courts have broadly interpreted the statute’s “similar files” language to mean any information that can be linked to particular individuals. Because IP addresses and User-Agent headers could be linked to individual commenters, the FCC claimed, they could be withheld from release. While they had been notified that their names and addresses would be made public with their comments, the commenters would not have reasonably expected that the log information they generated by visiting the ECFS website would also be disclosed.

The Times responded that any privacy interest the commenters had in the log information was a de minimis one. Under well-developed FOIA case law, agencies may only withhold personal information in which there is a “significant privacy interest.” Commenters were on notice that their personal information would be made public as part of the rulemaking proceeding; therefore, they would not have expected the server log information associated with their comments to be private.

The Times also made the technical argument that because internet service providers “dynamically” assign IP addresses to their customers’ devices, it was unlikely that an IP address would still be associated with a particular commenter many months later.

In the court’s decision…

Read The Full Article