CanadaIs my IP address considered personal information protected by privacy law?
Yes, in Canada an IP address can be considered personal information under privacy law — especially when it can be linked to an identifiable individual, as confirmed by the Supreme Court in R. v. Bykovets (2024).
What the Law Says
Canada’s main federal privacy law for the private sector is the Personal Information Protection and Electronic Documents Act (PIPEDA). It governs how organizations handle personal information in commercial contexts.
PIPEDA defines 'personal information' broadly as 'information about an identifiable individual'. While the Act itself does not explicitly name IP addresses, its application depends on whether the information can reasonably identify a person — either on its own or when combined with other data.
The scope of PIPEDA is set out in section 4, which confirms that the Act applies to organizations collecting, using, or disclosing personal information in the course of 'commercial activities'. This includes most businesses, websites, apps, and online services operating in Canada.
Statutory TextPIPEDA applies to organizations that collect, use or disclose personal information in the course of commercial activities.
— Personal Information Protection and Electronic Documents Act s. 4: Application — S.C. 2000, c. 5
What Courts Have Said
The Supreme Court of Canada recently clarified the privacy status of IP addresses under the Canadian Charter of Rights and Freedoms — with implications for how privacy laws like PIPEDA are interpreted.
The Court held that an IP address can reveal identifying details about a user and attracts a reasonable expectation of privacy under section 8 of the Charter. Police must obtain judicial authorization before compelling an internet service provider to disclose subscriber information linked to an IP address.
What to Do
Assess whether your organization collects IP addresses in commercial activities — if so, treat them as personal information under PIPEDA.
Implement safeguards (e.g., encryption, access controls) and obtain meaningful consent where required.
Document how IP addresses are used, stored, and shared — especially if linked to individuals.
If you’re an ISP or service provider, ensure judicial authorization is obtained before disclosing IP-linked subscriber data to law enforcement.
Review your privacy policy to clearly explain IP address collection and use.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.