[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu4JMKCoAfERCSsHMYcWZfkOhzhZuTH846sovKEmeIyc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"65b2f4c7-622b-4f40-a0f8-970e4ebb2d22","dynamic-ip-addresses-qualify-as-personal-data-under-gdpr-cjeu-advocate-general-opines","6b795a50-33e9-4ad6-8646-ea5d4a40f790","Dynamic IP Addresses Qualify as Personal Data Under GDPR, CJEU Advocate General Opines","The CJEU Advocate General's opinion in C-654\u002F25 reinforces that dynamic IP addresses transmitted to third parties like Google can constitute personal data when the recipient can reasonably combine them with other data to identify an individual. This matters because many website operators embed third-party scripts, fonts, or analytics tools that silently transmit visitor IP addresses without a lawful basis or adequate disclosure. Organizations that fail to treat these automatic data transfers as personal data processing risk GDPR non-compliance, even when the transfer is technically incidental. The opinion also introduces an abuse-of-rights nuance: data subjects who deliberately engineer data transfers to claim damages may have their claims dismissed, signaling courts are sensitive to bad-faith litigation tactics alongside genuine privacy harms.","**Immediate actions:**\n- Audit all third-party scripts, CDN resources, and embedded content on your websites to identify automatic IP-transmitting requests to external parties.\n- Ensure your privacy notice explicitly discloses every third-party service that receives visitor IP addresses and the lawful basis for that transfer.\n\n**Long-term improvements:**\n- Implement a Content Security Policy (CSP) and a consent management platform (CMP) to gate third-party resource loading until valid user consent is obtained.\n- Replace externally hosted third-party resources (e.g., Google Fonts, analytics) with self-hosted alternatives to eliminate unnecessary IP disclosures.\n- Establish a recurring Data Protection Impact Assessment (DPIA) process for any new third-party integration that processes visitor data.\n\n**Detection & compliance measures:**\n- Deploy automated web-scanning tools to continuously detect new third-party network requests that were not reviewed by your privacy team.\n- Maintain a Records of Processing Activities (RoPA) entry for each third-party data transfer, reviewed at least annually against current legal opinions and regulatory guidance.",[12,13,14,15,16],"GDPR Article 4","GDPR Article 6","GDPR Article 13","GDPR Article 35","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"GDPR Article 4":18,"GDPR Article 6":19,"GDPR Article 13":20,"GDPR Article 35":21,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":22},"Article 4(1) defines 'personal data'; the opinion directly applies this definition to dynamic IP addresses, confirming organizations must treat them as personal data when a third party can reasonably link them to an individual.","Article 6 requires a lawful basis for every processing activity; automatically transmitting visitor IP addresses to Google without a valid basis is the core compliance failure this case addresses.","Article 13 mandates transparency about third-party data recipients at the time of collection; failing to disclose that IP addresses are sent to Google violates this transparency obligation.","Article 35 requires a DPIA for high-risk processing; embedding third-party services that transfer personal data to large data controllers like Google warrants prior impact assessment.","This control requires organizations to assess privacy and security risks introduced by suppliers and third-party services before integrating them into their systems.","published","2026-11-11T09:21:16.49354+00:00","2026-11-11T09:21:16.462+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-654\u002F25_-_Undelam&diff=53679&oldid=53667","cjeu-c-654-25-undelam-da9def","CJEU - C-654\u002F25 - Undelam",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]