Is an IP Address PII? What US Privacy Law Means for Identifying Website Visitors

Last updated: September 11, 2026

An IP address is personal information under California's privacy statute whenever it can reasonably be linked to a consumer or household, and the statute lists Internet Protocol address by name among its identifiers. Whether a particular IP address counts therefore depends less on the address itself than on what your identification stack does with it next.

That second sentence is the one this guide is about. A vendor's page usually tells you its tool is privacy compliant. Your counsel asks whether the pixel on your pricing page is collecting personal information. The two are very often talking about different moments. The vendor is describing its database. Your counsel is describing the instant a request arrives from a browser in California carrying an IP address, a page path and, increasingly, an opt-out signal set by the visitor. This guide is about that instant and the three steps that follow it.

KEY STATS

• Cal. Civ. Code §1798.140(v)(1)(A) lists "Internet Protocol address" among the identifiers that are personal information when reasonably linkable to a consumer or household (California Legislative Information)
• The CCPA's business-to-business and employee exemptions expired on January 1, 2023, so a work email is personal information in California (IAPP)
• 11 CCR §7025(b) requires a business that sells or shares personal information to treat a valid opt-out preference signal as a request to opt out (California Code of Regulations)
• Colorado required universal opt-out mechanisms to be honoured from July 1, 2024, and Connecticut from January 1, 2025 (Colorado Attorney General; Conn. Gen. Stat. §42-520)
• Only 54 of 464 sites carrying a US Privacy String, 12%, opted users out after receiving a GPC signal in a 2023 study (Zimmeck et al., Proceedings on Privacy Enhancing Technologies 2023)
• California, Colorado and Connecticut announced a joint GPC enforcement sweep on September 9, 2025 (California Privacy Protection Agency)
• Two Los Angeles Superior Court judges reached opposite rulings on identical pen-register allegations three weeks apart, on March 13 and April 3, 2024 (Epstein, 94 Miss. L.J. 321)
• Data compiled from California and Washington statutes and regulations, a federal FTC rule, US court orders and regulator announcements, the W3C GPC specification, the CJEU and the UK ICO, and vendor documentation, September 2026

What's in this guide:

• What the statute says an IP address is
• Why the answer changed for B2B on January 1, 2023
• What an IP address becomes at each step
• Is identifying a visitor a sale or a share
• The opt-out signal you have to honour
• What the vendors say they do
• The wiretap and pen register question in California
• Washington, and the health pages problem
• How Europe answers the same question
• What to build before the tag goes live
• Where Signal sits
• Frequently asked questions

What the statute says an IP address is

Start with the text, because the page-one results for this question paraphrase it rather than quote it. California's definition of personal information, in Civil Code section 1798.140(v)(1), reads that personal information "means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Identifiers open the list of examples that follows, and the statute names them: "real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name" and so on.

Two things in that wording matter, and they have to be read together. Reasonable linkability is the whole test, not certainty, and the object of the link can be a household rather than a person. A residential IP address that resolves to a home broadband connection almost certainly clears the household bar without anyone's name being known. An office IP address is generally harder to call, and I'll come back to that in the next section, because the statute has a separate answer for organisations.

Consumer is the other defined term you must read. Section 1798.140(i) says a consumer "means a natural person who is a California resident" and adds that this is so "however identified, including by any unique identifier." California's legislature anticipated the very case identification vendors describe as anonymous: a person known only by an identifier is still a consumer.

Federal law has no single definition, and people who say an IP address is not PII in the United States are usually pointing at that gap. The narrowest federal definition on the books cuts the other way. The FTC's children's privacy rule, 16 CFR 312.2, lists among personal information "a persistent identifier that can be used to recognize a user over time and across different websites or online services" and gives as its first examples "a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier." That rule protects children under 13, so it doesn't govern a B2B site directly. It does show what the federal regulator thinks an IP address is.

Why the answer changed for B2B on January 1, 2023

For its first three years the CCPA carried an exemption that kept most business-contact data outside the law's reach. Until it expired, a vendor could argue that a work email attached to a job title at a company was not consumer data in the ordinary sense. Post 6 in this series covers what the expiry did to person-level identification; this section only needs the date and its source.

"CCPA/CPRA will become fully operational on Jan. 1, 2023, for B2B and HR personal information and will be subject to the same rigorous California privacy regulations as 'consumer' personal information." — Brian Hengesbaugh, CIPP/US, Global Chair, Data and Cyber, Baker McKenzie (IAPP)

For an IP address the consequence is indirect but decisive. Before 2023 you could argue that resolving an office IP to a named buyer produced business-contact data the statute left alone. Since January 1, 2023 the output of that resolution, a Californian's name and work email, is personal information on the same footing as a personal email. So the IP address at the front of the pipeline is reasonably linkable to a consumer in the plainest possible way: your own stack links it, on purpose, moments later.

That is why the question "is an IP address PII" has a different answer for a company running identification than for a company running server logs.

What an IP address becomes at each step

Identification changes what the data is four times, and each stage has its own answer under the definition. Technically the sequence is the same one the methods post walks from the technical side, read here from the compliance side.

At stage one you hold the raw address from the request headers. It is an online identifier by name, and it is personal information if reasonably linkable to a consumer or household. On its own, at this stage, an office address shared by a whole company is usually a fairly weak link to any individual. A residential address is a strong link to a household.

At stage two a reverse-IP lookup returns an organisation. An organisation is not a consumer, and this is the one stage whose output sits outside the definition, which is why the company-level tools carry a lighter compliance load. The input was still collected, though, and that never changes. Your pixel fired, the address was sent, and any opt-out signal that arrived with the request certainly arrived before the lookup ran.

At stage three the stack narrows to a device or a household, through a device hash, a first-party cookie, or a residential connection. This is where the household language in the statute bites. A home connection that keeps resolving to the same device is arguably linkable to a household whether or not the person's name is ever learned.

At stage four, and only at stage four, an identity graph returns a name and a work email. That output is very plainly personal information on the words of the definition, and since the 2023 sunset the fact that the email is a work address changes nothing.

Stage	What the data is	Inside the definition?	What attaches
1. IP address	A network address in the request headers	Yes, when reasonably linkable to a consumer or household	Collection itself, and the opt-out signal if you sell or share
2. Company	An organisation returned by reverse-IP lookup	The output is not a consumer; the input address was still collected	Whatever attached at stage 1
3. Device or household	A device hash, first-party cookie or residential connection	Yes, linkable to a household	Opt-out and deletion rights for the household
4. Named person	A name and a work email returned by the graph	Yes, and a work email counts since January 1, 2023	Full consumer rights: know, delete, correct, opt out

The takeaway: Only the company stage produces an output outside California's definition of personal information, and even there the IP address that fed it was collected under the definition. Stages one, three and four sit inside it: the household test catches residential connections before any name is known, and the January 1, 2023 sunset catches the work email at the end. The opt-out signal arrives at stage one, so the compliance decisions must run before stage two.

Is identifying a visitor a sale or a share

California's opt-out rights attach to businesses that sell or share personal information, so this is the definitional question on which a great deal turns, and it is the one this post will not answer for you. It can show you the text.

Section 1798.140 defines a sale as communicating a consumer's personal information "by the business to a third party for monetary or other valuable consideration." It defines sharing as communicating that information "by the business to a third party for cross-context behavioral advertising." And it defines cross-context behavioral advertising as "the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts."

Now hold an identification deployment against that. Your tag sends the visitor's IP address and page events to a resolver you pay. Whether that is a transfer "for monetary or other valuable consideration" depends on the contract and on whether the resolver is acting as your service provider or as a third party with its own uses for the data. Whether it is sharing depends largely on whether anything downstream targets advertising across sites. The vendors' own pages reach different answers, and they publish them. RB2B's compliance page tells its customers that California law requires "Website disclosures to indicate that you're 'sharing' personal information." Leadpipe's privacy page says "we do not 'sell' personal information as commonly defined under the California Consumer Privacy Act." Apollo's says its disclosures "constitute a 'sale' or 'sharing' under certain U.S. state privacy laws." That is three vendors in one category publishing three different postures.

That is exactly where to stop reading blog posts, this one included, and put the contract and the data flow in front of counsel. What follows assumes the cautious answer, because a business that treats itself as selling or sharing and turns out not to be has over-complied, while a business that sells or shares and treats itself as not is exactly what the September 2025 sweep was checking for.

The opt-out signal you have to honour

If your business sells or shares, a request arriving at stage one may already carry the consumer's answer, and you must act on it before the resolver runs. California's regulations at 11 CCR §7025(b) state that "A business that sells or shares personal information shall process any opt-out preference signal that meets the following requirements as a valid request to opt-out of sale/sharing." Subsection (c)(1) says how: the business "shall treat the opt-out preference signal as a valid request to opt-out of sale/sharing submitted pursuant to Civil Code section 1798.120 for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles." A partly resolved visitor at stage three is, almost by definition, a pseudonymous profile, so the regulation reaches the middle of the pipeline and not only its end.

In practice the signal is usually Global Privacy Control. The California Attorney General describes it as a "stop selling or sharing my data switch" available in Firefox, DuckDuckGo and Brave or as an extension, and states that "Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information." Technically it is very small. The W3C specification, a Working Draft dated 11 June 2026, has the browser send a Sec-GPC header set to 1 with each request and exposes the same preference to page scripts as navigator.globalPrivacyControl. Your tag can always read it before it sends anything. So can your server. It is one header and one script property.

California isn't alone, and the dates matter for anyone with visitors in more than one state.

State	Rule	Duty	In force
California	11 CCR §7025	Businesses that sell or share must treat a valid opt-out preference signal as an opt-out request for that browser or device and any associated profile	In force
Colorado	Colorado Privacy Act Rule 5.06; C.R.S. §6-1-1306(1)(a)(IV)	Controllers must honour a universal opt-out mechanism; the Attorney General recognised GPC as the first such mechanism	July 1, 2024
Connecticut	Conn. Gen. Stat. §42-520(e)(1)(A)(ii)	Allow a consumer to opt out of targeted advertising or sale "through an opt-out preference signal sent, with such consumer's consent, by a platform, technology or mechanism"	January 1, 2025

The takeaway: Three states now require businesses that sell or share, or that run targeted advertising, to honour a browser-level opt-out signal, and their regulators ran a joint sweep in 2025. On September 9, 2025 California, Colorado and Connecticut announced a joint sweep contacting businesses that, in the CPPA's words, "may not be processing consumer requests to opt out" sent via GPC. For a business that sells or shares, reading the signal at the tag answers all three states at once.

How well is the signal honoured in practice? The best measurement I've found is from the researchers who helped write the specification.

"We find that many sites do not respect GPC opt out signals despite being legally obligated to do so. Only 54/464 (12%) sites with a US Privacy String opt out users after having received a GPC signal." — Sebastian Zimmeck, Wesleyan University, with Oliver Wang, Kuba Alicki, Jocelyn Wang and Sophie Eng (Proceedings on Privacy Enhancing Technologies, 2023)

Zimmeck's figure is from 2023 and the sweep came two years later, so the number today may well differ; we found no comparable count published since. Tom Kemp, the CPPA's Executive Director, said in the sweep announcement that the agency "will continue working across jurisdictions to protect Californians' privacy." Kemp's sentence seems a statement of intent about the next sweep rather than a summary of the last one.

What the vendors say they do

A vendor's compliance page is where it tells you what it will and won't resolve, so we read five of them at source in September 2026. The table records the wording on each page as we found it; we did not test any vendor's conduct against its page.

Vendor	Who it will identify	Opt-out signal	Sale or share posture on its own pages
RB2B	"US-only technology with a US-only database"; uses "IP ringfencing to only resolve US traffic"	Not mentioned on the homepage or compliance page	Tells customers California requires disclosures that they are "sharing"
Vector	Visitors already known through prior opt-in or tracked behaviour	"Vector doesn't automatically act on GPC signals"	Not stated
Leadpipe	"Person-level identification of anonymous US B2B website visitors"	Honours GPC "where legally required and technically feasible"	Says it does not "sell" as defined under the CCPA/CPRA
Factors.ai	Account and individual contact level, "US traffic only"	Opt out "via the link in our cookie banner or enable an opt-out preference mechanism in Your browser"	Says it does not sell or share "without providing You a right to opt-out"
Apollo	Contact level "Currently available for US-based visitors"	"Apollo recognizes the Global Privacy Control browser signal as a request to opt out"	Says some disclosures "constitute a 'sale' or 'sharing' under certain U.S. state privacy laws"

The takeaway: Four of the five vendors state a US-only limit on person-level identification; Vector instead limits itself to visitors already known through opt-in or tracked behaviour. On the two US questions they diverge: two say they honour Global Privacy Control, one says it does not act on it automatically, one leaves it to the customer's banner, and one never mentions it. On sale versus share, four of the five publish a posture and no two of them agree.

Notice that the vendor's posture and your obligation are different things. A vendor that honours GPC on its own website has said nothing about the tag on yours, and a vendor that says it does not sell has described its own contracts rather than your disclosures. Treat every row in that table as a question for your counsel, never as an answer.

The wiretap and pen register question in California

Beyond the consumer-privacy statute sits an older one that has produced most of the litigation: the California Invasion of Privacy Act, and in particular section 638.51, which prohibits installing or using a "pen register" or "trap and trace device" without a court order. Those terms date from telephone surveillance. The question the courts have been fighting over since 2024 is whether a piece of website code that records a visitor's IP address is one, and the answer so far depends largely on which courtroom you are in.

Two Los Angeles Superior Court judges answered it in opposite directions within three weeks, on identical allegations. In Licea v. Hickory Farms, on March 13, 2024, the claim was dismissed. In Levings v. Choice Hotels, on April 3, 2024, the demurrer was overruled, and the order put the consent argument this way: "If merely visiting a website constitutes consent to the use of a pen register, then Section 638.51(a) would be a dead letter. It could never be violated. That is not an acceptable consequence."

"In issuing these opposite rulings, the two judges disagreed about a fundamental issue at the intersection of privacy and technology: should a privacy protection codified to address wrongdoing in one medium be extended to a functionally equivalent wrongdoing in a different medium?" — Michael M. Epstein, Professor of Law, Southwestern Law School (Mississippi Law Journal, 2025)

Since then the split has arguably widened. In early 2025 two more California trial courts sustained demurrers over IP-address collection: in Sanchez v. Cars.com the court read the provision as reaching telephone numbers, "not internet communications such as websites," and in Aviles v. LiveRamp the plaintiff had "not alleged anything above and beyond how the internet normally works," as Covington's Rachel Bercovitz and Matthew Verdin summarised the orders. In New York, a federal court in Gabrielli v. Insider dismissed an IP-address pen-register claim for lack of standing in February 2025 as, in Mayer Brown's account of the ruling, "a bare procedural violation, divorced from any concrete harm." In August 2026 a federal court in Los Angeles, in Limas v. Wayfair, threw out the pen-register theory while letting the trap-and-trace theory and the wiretap claim under section 631(a) go forward, and it did so because the trackers there were alleged to match visitors to existing social-media accounts rather than to collect an IP address alone. An identification pixel collects the IP address and then matches it, so it sits on both sides of that distinction.

Two developments were live as this was written, and both must be re-checked before you rely on them. The Court of Appeal in Variety Media v. Superior Court issued a tentative ruling in late August 2026 that an IP address alone is not pen-register activity, on the reasoning, as Seyfarth's Danny Riley and Kathleen McConnell quote it, that "A visitor's IP address does not qualify because it identifies where the communication came from, not where it was going." Their caveat is the right one: "A tentative ruling is not a decision." And the legislature has passed Senate Bill 690, enrolled on August 31, 2026 and presented to the Governor in early September. Its text would add to Penal Code section 637.2 that an action against a private actor for a section 638.51 violation arising on a website "may be brought under this section only by the Attorney General," and would "apply retroactively to any pending claim." If it is signed, the private pen-register suit over a website pixel ends entirely; enforcement moves to the Attorney General. If it is vetoed, the split above stands.

That is the risk map as of September 2026, and none of it is a verdict. The plaintiffs' bar has typically treated the collection of an IP address by a third-party script as a pen register since 2024, some courts have agreed, rather more have not, and the legislature may take the question away from private plaintiffs entirely. None of it changes what the consumer-privacy statute says the address is.

Washington, and the health pages problem

Washington's privacy act, chapter 9.73 RCW, is an all-party-consent wiretap statute, and in Baker v. Seattle Children's Hospital a putative class alleged that a hospital's use of third-party pixels on its public website intercepted their communications in violation of it. In August 2025 the Court of Appeals affirmed the dismissal: "The trial court dismissed the plaintiffs' complaint for failure to state a claim under CR 12(b)(6). We affirm." The opinion is unpublished, and its reasoning turned on whether browsing a public website is a private communication at all; a footnote puts the principle as "A communication is not private where anyone may turn out to be the recipient of the information or the recipient may disclose the information." The plaintiffs petitioned the Washington Supreme Court for review in September 2025, arguing that "This Court has never addressed whether the WPA applies" to web-based communications. Because of that petition, a Washington deployment should probably be read as unsettled, not cleared, for now.

Washington's statute contains its own answer to the consent problem, and it is one a website can use. RCW 9.73.030(3) provides that where all-party consent is needed, "consent shall be considered obtained whenever one party has announced to all other parties engaged in the communication or conversation, in any reasonably effective manner, that such communication or conversation is about to be recorded or transmitted." A banner shown before the tag fires, and it must be before, saying that the visit is recorded and transmitted, is an announcement in a reasonably effective manner on the plain words of the subsection. The statute supplies that basis; no court has yet applied it to a website banner, which is exactly why the Baker petition matters.

Washington also has a statute that reaches past consent, and any identification deployment on a site with health-adjacent pages has to know about it. The My Health My Data Act, RCW 19.373.010, defines consumer health data as "personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status," and the list of what that includes has two entries that matter for a pixel: "Data that identifies a consumer seeking health care services," and data that is "derived or extrapolated from nonhealth information" by inference. Identify a named visitor on a page about a treatment, or on a staffing agency's healthcare-roles page, and you have quite possibly produced both, and sometimes without meaning to. For a resolver the practical rule is page-level suppression: never resolve on the pages where a match would say something about health.

How Europe answers the same question

Europe answered a decade ago, and the answer largely explains why four of the five vendors in the table above confine themselves to US visitors. In Breyer v Bundesrepublik Deutschland, in October 2016, the Court of Justice of the European Union held that "a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data" in relation to that provider, where the provider has the legal means to identify the person with additional data held by the internet service provider. Two years later the GDPR wrote the point into Recital 30: "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers." The UK regulator's guidance is blunter still: "'Online identifiers' includes IP addresses and cookie identifiers which may be personal data."

The US position differs, and this post keeps the two apart on purpose. California reaches the same practical result through reasonable linkability and the household test; federal law reaches it only for children; the pen-register cases split. But a company that resolves European visitors is in Breyer territory from the first request, and the vendors' US-only limits are consistent with that.

What to build before the tag goes live

Six things follow from the sections above, and none of them is legal advice; every item is something to take to counsel with the data flow drawn out.

1. Read the opt-out signal before the tag sends anything. Check Sec-GPC on the request or navigator.globalPrivacyControl in the page, and if it is set, never send the IP address to the resolver at all, under any configuration. The check must sit in front of the tag, not behind it. For a business that sells or shares, this answers California, Colorado and Connecticut at once, and it costs a few lines of code, which is why it comes first.
2. Decide the sale-or-share question with counsel, in writing, before launch. The contract with the resolver, the resolver's downstream uses and whether anything targets advertising across sites determine the answer, and all three must be on the table. Record it, because it drives every disclosure that follows and must match them.
3. Show a pre-tracking banner that gates the resolver. In Washington, RCW 9.73.030(3) treats an announcement made in a reasonably effective manner as consent, though no court has yet applied that to a website banner. Everywhere else it is where the visitor learns that collection is happening. A banner that fires after the tag has already sent the address has not gated anything.
4. Suppress resolution on health-adjacent and careers pages. Washington's My Health My Data Act reaches inferred health data by its text; a staffing site's candidate pages raise the audience problem covered in the routing post in this series. Page-path rules are very cheap, and they remove the two page types with arguably the most legal exposure on this page: health-adjacent pages under Washington's act and candidate pages under the audience rule.
5. Restrict resolution to the visitors your counsel has cleared. Four of the five vendors in the table already confine person-level resolution to US traffic. Whether to geofence California while the pen-register question is open is a judgment for your counsel to make on your traffic.
6. Write the disclosure to match the flow. The privacy policy must say what the tag collects, who receives it, whether that is a sale or a share, that the opt-out signal is honoured, and how a consumer exercises the rights that attach at stage four. Then keep the policy and the tag in step whenever either changes.

Where Signal sits

Signal arrives late in this post because the obligations above belong entirely to the site owner, whoever the vendor is. What the vendor can do is make the cautious defaults the easy ones, and describe its own conduct in terms a buyer can check.

Our privacy policy, dated December 17, 2024, states: "We honor Global Privacy Control (GPC) signals. If your browser transmits a GPC signal, we will treat this as a valid opt-out request for the sale or sharing of personal information under CCPA/CPRA." The same policy lists IP address among the device and usage data we collect, which it is, and states that "Geysera does not sell personal information in the traditional sense of exchanging it for monetary consideration." Signal resolves company and person for US traffic, per the pricing page, and it never resolves European visitors, for the reason the Breyer section gives.

Two limitations. First, our policy describes only our conduct on our sites and in our service; it cannot decide whether your deployment of our tag is a sale or a share under your contracts and disclosures, and we won't claim it does. Second, we haven't published a match rate for Signal and won't until a customer test validates one, so the coverage you give up by honouring the opt-out signal is something you will measure on your own traffic rather than read off our pricing page. The pillar for this series put the GPC question first when it listed what to ask a vendor; this post is the longer answer to why.

We wrote GPC honouring into our privacy policy in December 2024, before the three-state sweep made it a headline. The cost is concrete: every Firefox, Brave or DuckDuckGo visitor with the switch on is a visitor we never resolve, and I'd rather explain that number in a sales call than explain the alternative to a regulator. — Bob Thordarson, Geysera CEO

If your site has European traffic you want identified, no vendor in this category will do it, ours absolutely included. If your site has health-adjacent pages, the suppression rule above is the one to implement first in Washington. If neither applies and your counsel has answered the sale-or-share question, the remaining work is the six items in the previous section, and most of them are configuration.

Frequently asked questions

Is an IP address PII?

Under California's CCPA, yes when it is reasonably capable of being associated with a consumer or household; the statute lists Internet Protocol address by name among its identifiers. Federal law has no single definition, but the FTC's children's privacy rule lists an IP address as a persistent identifier. In the EU, the Court of Justice held in 2016 that a dynamic IP address is personal data where the provider can lawfully identify the person.

Is an IP address personal information under the CCPA?

Section 1798.140(v)(1)(A) names "Internet Protocol address" among the identifiers that are personal information when they identify, relate to, or can reasonably be linked with a particular consumer or household. A residential address that resolves to a home connection almost certainly clears the household test on its own. An office address becomes linkable the moment an identification stack resolves it to a named person.

Is a work email address PII?

In California, yes since January 1, 2023, when the CCPA's business-to-business and employee exemptions expired without extension. Since that date a Californian's work email is personal information on the same footing as a personal one, which means the output of person-level visitor identification is personal information whether or not the person ever filled in a form.

Do I have to honour Global Privacy Control?

If your business sells or shares personal information under California's definitions, 11 CCR §7025 requires you to treat a valid opt-out preference signal as an opt-out request for that browser or device and any associated profile, including pseudonymous ones. Colorado has required honouring universal opt-out mechanisms since July 1, 2024, and Connecticut since January 1, 2025. Whether you sell or share is a question for counsel.

Is website visitor identification a sale or a share of personal information?

It depends on the contract with the resolver, the resolver's role and downstream uses, and whether anything targets advertising across sites. The statute defines a sale as a transfer to a third party for monetary or other valuable consideration, and sharing as a transfer for cross-context behavioral advertising. Vendors publish opposite postures on their own pages, so treat it as a decision for counsel.

Is collecting a website visitor's IP address illegal wiretapping?

Courts are split. Two Los Angeles judges reached opposite rulings on identical pen-register allegations in 2024; several 2025 courts dismissed IP-address claims; a 2026 appellate ruling that an IP address alone is not pen-register activity was tentative when this was written; and Senate Bill 690, awaiting the Governor, would limit such website suits to the Attorney General. Washington's appellate court, in an opinion now under a petition for review, held that browsing a public site was not private communication.

Continue the Series

This is Post 10 in Geysera's 13-part series on B2B anonymous visitor identification.

• Post 1 — Anonymous website visitor identification: the complete 2026 guide (pillar)
• Post 2 — How to identify anonymous website visitors: 5 methods and what each delivers
• Post 3 — What is an identity graph? How anonymous visitors get matched to real people
• Post 6 — Person-level vs company-level identification
• Post 8 — Third-party cookies didn't die. The deprecation did.
• Post 9 — Lead routing for identified website visitors: from identified to pipeline
• Post E2 — Is it legal to email identified visitors?

Sources

• California Civil Code §1798.140 — California Legislative Information; definitions of personal information (v), consumer (i), sell (ad), share (ah) and cross-context behavioral advertising (k)
• CCPA/CPRA grace period for HR and B2B ends Jan. 1 — Brian Hengesbaugh and Cristina Messerschmidt, Baker McKenzie, IAPP, 7 September 2022
• 11 CCR §7025, Opt-out Preference Signals and §7001, Definitions — California Code of Regulations via Cornell LII
• Global Privacy Control (GPC) — California Department of Justice, Office of the Attorney General
• Global Privacy Control (GPC), W3C Working Draft 11 June 2026 — W3C; the Sec-GPC header and navigator.globalPrivacyControl
• Universal Opt-Out Mechanisms — Colorado Attorney General; 4 CCR 904-3, Rule 5.06 via Cornell LII
• Conn. Gen. Stat. Chapter 743jj, §42-520 — Connecticut General Assembly
• California, Colorado and Connecticut announce GPC enforcement sweep — California Privacy Protection Agency, 9 September 2025
• Usability and Enforceability of Global Privacy Control — Zimmeck, Wang, Alicki, Wang and Eng, Proceedings on Privacy Enhancing Technologies 2023(2)
• 16 CFR 312.2, Definitions — Children's Online Privacy Protection Rule via Cornell LII
• Levings v. Choice Hotels International, order overruling demurrer, 3 April 2024 — Los Angeles Superior Court
• Identical Facts, Opposite Rulings: Choice Hotels, Hickory Farms, and the Advent of Website "Pen Registers" — Michael M. Epstein, 94 Miss. L.J. 321 (2025)
• Courts hold CIPA's pen register provision does not apply to internet communications — Rachel Bercovitz and Matthew Verdin, Covington, 12 March 2025; Sanchez v. Cars.com and Aviles v. LiveRamp
• Collecting IP addresses not an invasion of privacy, says New York federal court — Sophia Mancall-Bitel and Tony Weibell, Mayer Brown, 25 February 2025; Gabrielli v. Insider
• C.D. Cal. lets CIPA claims against Wayfair move forward but tosses pen register claim — Alina Gonzalez, TCPAWorld, 14 August 2026; Limas v. Wayfair
• California Court of Appeal tentatively holds that collecting a website visitor's IP address alone does not constitute pen register activity — Danny Riley and Kathleen McConnell, Seyfarth, August 2026; Variety Media v. Superior Court
• SB-690 Crimes: invasion of privacy, enrolled text and status — California Legislative Information; enrolled 31 August 2026
• Baker v. Seattle Children's Hospital, No. 86461-1-I — Washington Court of Appeals, Division I, unpublished, 2025; Petition for Review, No. 1045905, September 2025
• RCW 9.73.030 and RCW 19.373.010 — Washington State Legislature
• Breyer v Bundesrepublik Deutschland, C-582/14 — Court of Justice of the European Union, 19 October 2016
• GDPR Recital 30; What is personal information: a guide — Information Commissioner's Office
• Vendor pages, read September 2026: RB2B and RB2B compliance; Vector on GPC; Leadpipe privacy; Factors.ai product and privacy policy; Apollo product and privacy policy
• Geysera privacy policy — effective 17 December 2024