What a visitor's IP address really reveals.

What can be worked out

An address is registered to an organisation, and registrations are public.

• • The country, usually reliably, and a region or city with much less confidence.
• • The network operator — a broadband provider, a mobile carrier, a hosting company.
• • Whether the connection looks residential, mobile, business or a data centre, which is how automated traffic is often spotted.
• • Sometimes the organisation itself, when a company runs its own address range.

What cannot

Not a name, an address, an email or a phone number. An address identifies a connection point on a network, and it is usually shared by a household, an office, or thousands of mobile subscribers at once.

Addresses also change. Many home connections are reassigned periodically, so the same address may be a different household next month.

Why it is still treated as personal data

In the EU and UK an address is generally treated as personal data, on the reasoning that it could identify someone when combined with information a network operator holds — even though the website owner cannot make that link.

This trips people up because it feels anonymous from where they are sitting. The test is not whether you can identify someone; it is whether anyone could.

What that means in practice

Keep addresses no longer than you need, and prefer storing what you derived — a city, a network type — over the address itself. Anything you did not keep cannot be requested, breached or misused.

Say in your privacy notice that you process them and why. That is expected, and it is the part most sites omit.