In a story first run by Media Post News on July 6 and picked up by Slashdot on July 8, Judge Richard Jones of the U.S. District Court based in Seattle handed down a decision that defined how identifiable an IP address was. His determination: it isn’t identifiable information, as it “identifies a computer” rather than a person.The case involved a class-action lawsuit filed against Microsoft that claimed it violated end-user agreements by logging IP addresses, which are perceived to be identifying information by several electronic privacy groups; the EU ruled recently that IP addresses are identifying, and a case in New Jersey last year resulted in a ruling that ISPs must protect IP addresses from unauthorized disclosure, much like the rest of its customers’ data.
Quite a few in the tech industry would agree that an IP address on its own is not useful; a quick WHOIS reveals what organization owns the block containing the IP, and it may be possible to geolocate the IP through a traceroute, as quite a few ISPs name their routers with geographic names. If a user on your forum consistently posts under the same IP, you can be fairly certain that “dragonslayer1728″ can be tied to that IP, and if you saw that same IP pop up in the logs of your new Facebook application, you can likely tie that IP, username, and Facebook profile together to “John Doe.”
That’s quite a bit of information to make an IP address identifiable. But the quote from Rotenberg in the Media Post article has the key point: “the significance of the IP address or the reason it was collected.” It really comes down to what information Microsoft collected: did they also keep installation IDs, which patches were installed, the locality of the Windows installation? These things are not personally identifiable on their own (the install ID, if you’re wondering, is only tied to a name if you register with Microsoft) but one could argue that in this example, all of this data is unnecessary and jeopardizes users’ privacy. The one thing that’s clear: Jones’ ruling makes the identity of an IP address a little more cloudy.
