IP Address Privacy: What Your IP Reveals and Who Sees It

Every website, app, email image and game server you connect to sees a public IP address, and most people have no clear idea what that address reveals, who logs it, or when it actually matters. The answer sits between two myths: an IP address is not a home address, but it is not anonymous either, and in EU and UK law it can be personal data. This guide explains the difference between public and local addresses, what IP geolocation can and cannot do, how "IP loggers" and "IP grabbers" work in defensive terms, and which measures (VPNs, relays, Tor, browser and IPv6 settings) reduce exposure at what cost. It is written for individuals who want an accurate picture and for security, privacy and IT teams who handle IP data in logs, analytics and incident response.

Key takeaways

Your public IP is shared and changes, your local IP is private and routine. Local addresses such as 192.168.1.20 are reused in millions of homes; the public address is what the internet sees, and is often shared by a whole household or, with carrier-grade NAT, many customers.
Geolocation is approximate. One major provider estimates 99.8% country-level accuracy but only about 66% for US cities within 50 km, and says its data is never precise enough to identify a household.
The ISP is the party that can tie an IP to you. Linking a public address and a time to a subscriber normally needs the internet provider's records, which are released through legal process.
The law treats IP addresses as personal data in many cases. GDPR Recital 30 names internet protocol addresses as online identifiers that can be used to profile and identify people.
Hiding your IP moves trust, it does not remove it. A VPN, relay or Tor hides your address from sites but shows your traffic to the operator; pick based on whom you need to hide from.

Public and local IP addresses

Address type	Examples	Who sees it	Privacy relevance
Private (local) IPv4, RFC 1918	10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16	Devices on the same network; can leak to web pages through WebRTC	Not routable on the internet and reused everywhere, but adds fingerprinting entropy and reveals internal ranges
Shared Address Space (carrier-grade NAT), RFC 6598	100.64.0.0/10	Your provider's network	Seeing this on your router's WAN side means many customers share one public address
Public IPv4	Assigned by the ISP to your router or mobile gateway	Every site, server and email image host you contact	Approximate location and ISP; linkable to the subscriber by the ISP
IPv6 global address	Prefix from the ISP plus an interface identifier	Every site you contact over IPv6	The prefix identifies the network; a stable interface identifier can track a device across networks unless temporary addresses are used

RFC 1918 (BCP 5) says routing information about private networks must not be propagated on inter-enterprise links, so a private address on its own does not reach the internet. RFC 6598 reserves 100.64.0.0/10 for the link between carrier-grade NAT equipment and customer routers. See the NAT and Its Security Implications Guide for how address translation works.

What an IP address reveals, and what it does not

Network owner: public registry and routing data show which ISP, mobile operator, cloud provider or company holds the address block. This is often the most accurate thing an IP reveals.
Approximate location: commercial geolocation databases estimate country, region and city. MaxMind, a major provider, states 99.8% country-level accuracy, around 80% at US state level and about 66% for US cities within a 50 km radius, and that its data is never precise enough to identify or locate a specific household, individual or street address. Mobile and VPN addresses can be placed far from the real user.
Connection type: whether the address belongs to a hosting provider, VPN, mobile network or residential broadband, which fraud and anti-abuse systems use as a risk signal.
Behaviour over time: a site or ad network that sees the same address repeatedly, combined with cookies and device fingerprints, can link visits. GDPR Recital 30 describes exactly this: online identifiers such as IP addresses, combined with other information the servers receive, can be used to build profiles and identify people.
Not your name or street address: that link lives in the ISP's subscriber records. Law enforcement and civil litigants obtain it through legal process, not from the IP itself.

The legal view: the GDPR definition of personal data includes "online identifiers", and Recital 30 names internet protocol addresses among them. In Breyer (C-582/14, judgment of 19 October 2016), as summarised by CMS and Simmons & Simmons, the Court of Justice of the EU held that a dynamic IP address can be personal data for a website operator that has legal means to obtain the identifying information from the ISP. Organisations in the EU and UK should therefore treat IP addresses in logs and analytics as personal data by default. See the AI and Privacy Guide and the Cookie and Tracking Technology Compliance Guide.

Who sees your IP address

Party	What they see	How to reduce it
Websites and apps you use	Public IP on every request, usually logged	VPN, relay or Tor; accept that logins still identify you
Email senders	Your IP when your mail client loads remote images or tracking pixels	Block remote images, or use a mail service that proxies images or strips trackers
Link shorteners and "IP logger" links	Your IP, time, browser user agent when you click	Preview links before clicking; use a VPN or relay when clicking unknown links
Peers in calls, games and peer-to-peer apps	Your public IP, and possibly local addresses through WebRTC	Use relayed or server-based connections where offered; restrict WebRTC
Your ISP or mobile operator	Your IP and the destinations you connect to (DNS and server addresses)	Encrypted DNS and a VPN shift this visibility to the VPN provider
VPN or relay operator	Your real IP and the destinations	Choose an operator you trust and understand its logging

IP loggers and IP grabbers, explained defensively

An "IP logger" or "IP grabber" is simply a link, image or file hosted on a server that records the address and browser details of whoever requests it. The same mechanism is behind every web server log; what makes it a nuisance is that it is sent deliberately to capture one person's address. Typical routes are shortened links in chats, images embedded in emails or forum posts, game or voice chat lobbies that connect players directly, and documents that fetch remote content when opened.

What the sender gets: your public IP, a timestamp, the user agent and, by lookup, the ISP and an approximate city. They do not get your home address or your local IP from a normal web request.
Realistic harms: confirming that you opened something, rough location, and for gamers and streamers a target for denial-of-service traffic against the home connection. See the DDoS Protection Guide for how floods work.
Defence: do not click unknown short links, block remote images in email, use relayed connections in voice and game apps where available, and use a VPN when you must interact with people you do not trust. If you are being targeted, ask your ISP whether it can issue a new public address; whether a router restart changes it depends on the provider.

The same technique is used in reconnaissance against organisations: MITRE ATT&CK tracks it as T1590.005 (Gather Victim Network Information: IP Addresses).

Ways to limit IP exposure compared

Measure	Hides IP from websites?	Who still sees it	Trade-offs
Commercial VPN	Yes, sites see the VPN exit address	The VPN provider sees your real IP and destinations	Moves trust to one company; some sites block VPN ranges. See the Choosing a VPN Safely Guide
Two-hop relay (for example Apple iCloud Private Relay)	Yes, for covered traffic	First relay sees your IP but not the site; second relay sees the site but not your IP	Apple documents it for Safari browsing as part of iCloud+, not available in all countries; some sites ask for extra sign-in steps
Tor	Yes	No single relay sees both ends	Slower; many services block or challenge Tor exits. See the Anonymity Networks for Defenders Guide
Proxy or browser extension proxy	Only for traffic configured to use it	The proxy operator	Apps and WebRTC may bypass it
Mobile data instead of home broadband	Partly: carrier-grade NAT shares the address among many users	The mobile operator	Location still approximate to the operator's gateway region
IPv6 temporary addresses	No, but stops one stable device identifier	Sites still see your network prefix	On by default on most modern operating systems; check that it is enabled

Apple describes Private Relay's design as ensuring that no single party, including Apple, can see both who you are and which sites you visit. That model is the clearest way to judge any option: ask which single party can see both your address and your destinations.

Browser and device settings that leak or protect addresses

WebRTC

WebRTC lets browsers make direct audio, video and data connections, and to do that it gathers address candidates. RFC 8828 (Standards Track, January 2021) defines four handling modes: enumerate all addresses (which must not be used without user consent), default route plus associated local addresses (the recommended default without consent), default route only, and force proxy. It names the most significant concern as VPN bypass, where a split-tunnel setup exposes the ISP's public address alongside the VPN address, and notes that private addresses add fingerprinting entropy.

Chrome and Chromium-based browsers (managed): the WebRtcIPHandling policy accepts default, default_public_and_private_interfaces, default_public_interface_only and disable_non_proxied_udp. default_public_interface_only stops WebRTC connecting with private addresses; disable_non_proxied_udp forces media through a configured proxy or TCP, at a cost to call quality.
Testing: after connecting a VPN, use a WebRTC leak test page and confirm that only the VPN address appears.

See the WebRTC Security Guide for the wider protocol.

IPv6 privacy

RFC 8981 (Standards Track, February 2021, obsoleting RFC 4941) defines temporary IPv6 addresses with randomised interface identifiers used for outgoing connections. Its defaults are a 2-day valid lifetime (reduced from 7 days in RFC 4941) and a 1-day preferred lifetime. The RFC is candid about limits: the network prefix is itself a constant identifier, and traffic can still be correlated by content and timing. If your VPN does not carry IPv6, IPv6 traffic may leave outside the tunnel; test for this. See the IPv6 Security Guide.

For organisations: handling IP addresses as data

Classify IP addresses in logs as personal data where GDPR or UK GDPR applies, and record the lawful basis (security logging is usually legitimate interests).
Set retention: keep full addresses in security logs for as long as investigations need them; truncate or aggregate them in analytics. The specific periods are an organisational decision; NHI Mgmt Group recommends documenting them per log source.
Do not over-trust geolocation: use IP location as a risk signal for sign-in and fraud, never as proof of where a person is. Impossible-travel alerts must allow for VPNs, mobile networks and carrier-grade NAT.
Protect your own staff: remote workers' home IPs appear in sign-in logs that many admins can read; restrict access to those logs.
Control WebRTC on managed browsers where internal address ranges should not be exposed to web pages.

Detection and measurement

Leak tests: scheduled checks from managed devices that the public address and WebRTC candidates match the expected VPN or proxy egress.
Egress inventory: the list of public addresses your organisation presents, so that unexpected egress (a split tunnel or an unmanaged route) stands out.
Metrics: percentage of managed browsers with a WebRTC IP handling policy applied; percentage of analytics pipelines that truncate or hash IP addresses; log sources with a documented IP retention period; leak test pass rate on VPN-connected devices; number of staff with access to raw sign-in IP data.

Framework mapping

Framework	Reference	Relevance
GDPR	Art. 4(1) and Recital 30	IP addresses as online identifiers and personal data
NIST SP 800-53 Rev. 5	SI-12(1) Limit Personally Identifiable Information Elements	Truncating or dropping IP addresses where they are not needed
NIST SP 800-53 Rev. 5	SC-7 Boundary Protection	Controlled egress points and proxying that determine which address the internet sees
NIST CSF 2.0	ID.AM-07	Inventory of data types, including IP addresses held in logs
MITRE ATT&CK	T1590.005	Adversaries gathering victim IP addresses during reconnaissance

Common failure patterns

Assuming a VPN makes you anonymous: logins, cookies and fingerprints still identify you, and the VPN operator sees everything the ISP used to.
Ignoring WebRTC and IPv6 leaks: the browser or an untunnelled IPv6 route reveals the real address while the VPN appears connected.
Treating geolocation as fact: blocking or accusing users based on a city-level guess, or panicking because an "IP lookup" shows a nearby town.
Clicking unknown links in hostile chats: the easiest way for a harasser to collect an address.
Keeping raw IPs forever in analytics: creating a personal data store with no purpose and no retention rule.

Practitioner checklist

NHI Mgmt Group recommends the following checks.

Know your public address, whether your ISP uses carrier-grade NAT, and whether you have IPv6.
Decide whom you need to hide your address from (sites, peers, ISP) before choosing a VPN, relay or Tor.
Run WebRTC and IPv6 leak tests after setting up any VPN.
Block remote images in email and avoid unknown short links in chats.
Use relayed connections in voice and game apps where offered.
Organisations: treat IP addresses as personal data, set retention per log source and truncate in analytics.
Organisations: apply a WebRTC IP handling policy on managed browsers where internal ranges are sensitive.
Use IP geolocation only as a risk signal, never as proof.

IP Address Privacy Guide: What Your IP Reveals and How to Limit Exposure