CJEU - C-654/25 - Undelam
Advocate General opines dynamic IP is personal data if Google can identify user.
The Advocate General opined that a dynamic IP address automatically sent to Google constitutes personal data for the sender if Google can reasonably identify the data subject by combining it with other data. The opinion also stated that if the data subject provoked the circumstances leading to the data transfer, they cannot claim immaterial damages and may have abused their rights.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU Advocate General's opinion in C-654/25 reinforces that dynamic IP addresses transmitted to third parties like Google can constitute personal data when the recipient can reasonably combine them with other data to identify an individual. This matters because many website operators embed third-party scripts, fonts, or analytics tools that silently transmit visitor IP addresses without a lawful basis or adequate disclosure. Organizations that fail to treat these automatic data transfers as personal data processing risk GDPR non-compliance, even when the transfer is technically incidental. The opinion also introduces an abuse-of-rights nuance: data subjects who deliberately engineer data transfers to claim damages may have their claims dismissed, signaling courts are sensitive to bad-faith litigation tactics alongside genuine privacy harms.