The California Consumer Privacy Act (“CCPA”) is one of a number of new laws that take aim at regulating the abusive data practices we’ve seen companies, particularly online companies, undertake the last couple of decades. Privacy law experts such as Moi consider the CCPA to be a foundational law on privacy in the United States, but one that can be a bit difficult to apply to daily scenarios. In this article, we tackle one of these situations by answering whether an IP address is personal information under the CCPA?
Definition of Personal Information
As you may have noticed, just about every nation, state, province, and town seems to be passing a privacy law these days. (Thank you, Facebook.) Many of these laws are enacted by elected officials who don’t really understand the Internet and realize as much to their credit. They react by trying to draft the laws to be as expansive as possible to cover any nefarious tactics the evil Internet companies might come up with to swipe peoples’ data.
The California State Legislature used the “broad is better” approach with the CCPA. One merely needs to read the definition of personal information in the Act to get a feel for just how far-reaching the language can be:
(o) (1) “Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household…
One can argue it is more efficient to try to identify a category of data that does not qualify as personal information under the CCPA than data that fits the bill. With this in mind, you probably shouldn’t find it particularly surprising that IP addresses are considered a form of personal information. In fact, a subsection of the quoted code above specifically names these addresses:
(A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Is an IP address considered personal information under the CCPA?
Richard A. Chapo, Esq.