How websites log and use your IP
Every site records it. Here is what that actually means, and where the line between logging and tracking sits.
Why it is recorded at all
A web server cannot answer a request without knowing where to send the answer. Your address arrives with every request as a matter of protocol, not policy, and writing it to a log is the default behavior of essentially every server ever shipped.
A typical log line holds the address, a timestamp, which page was requested, the response code, and the browser's user agent string. That is it. It does not hold your name, what you typed into a form, or the contents of anything encrypted.
203.0.113.42 - [04/Sep/2026:14:22:07] "GET /what-is-an-ip-address.html" 200 address timestamp page requested status
Those logs are how anyone notices that a page started returning errors at 3am, that one address is making ten thousand requests a minute, or that a link somewhere is broken. Remove them and running a website becomes guesswork.
Who actually receives it when you load a page
This is the part that surprises people, and it is worth being precise about, because the common description is subtly wrong. The site you visited does not pass your address along to advertisers. Your browser hands it to each of them directly.
On a page with a font service, an analytics script, two ad networks and an embedded video, that is five separate companies receiving your address for a single page view. None of them needed the site's permission, and the site could not have prevented it while still loading their code.
What sites legitimately do with it
| Purpose | What it looks like in practice |
|---|---|
| Security and abuse | Rate limiting, blocking a scraper, spotting a credential-stuffing run against a login form |
| Fraud scoring | Flagging a purchase from a country you have never used before, or a login from a data center |
| Operations | Working out which users an outage affected, and debugging an error somebody reported |
| Routing | Sending you to a nearby server so pages load faster |
| Localization | Guessing a currency or language, which should always be overridable |
| Coarse ad targeting | Region-level, and far less precise than the cookie sitting next to it |
| Legal compliance | Retaining records to answer a lawful demand, or to prove what happened during an incident |
Notice that most of these are operational rather than commercial. The commercially interesting tracking is done by cookies and fingerprints, which are more precise and more durable than an address that changes on its own and is shared by a household.
How long it is kept
There is no single answer, and anyone giving you one number is guessing. Common practice runs from a few days for a small site's access logs to years for records a company believes it must retain. Content delivery networks typically keep edge logs for weeks. Payment and fraud systems keep longer, because disputes arrive months later.
What you can rely on is that a site operating under GDPR or similar law is required to state a retention period and to have a reason for it. If a privacy policy is vague about how long it keeps logs, that vagueness is itself informative.
Our privacy policy says it plainly: this site does not store your address. It is read from the request, returned to you, and not written anywhere by us. Our CDN keeps ordinary access logs the way every CDN does, and we say so rather than claiming a purity that would not survive a look at the network tab.
Is an IP address personal data?
Under European law, generally yes. The Court of Justice of the European Union held in Breyer (2016) that a dynamic IP address can be personal data for a website operator, because the operator has lawful means to have the subscriber identified even though it cannot do so alone. That reasoning is why so many privacy policies now list IP addresses explicitly.
Under US law there is no single answer, because there is no single privacy law. Several state statutes treat an address as personal information when it is linkable to a household or device, and California's is the most consequential of them.
The practical upshot for you: if a site falls under one of those regimes, you likely have a right to ask what it holds about you and to ask for deletion. Whether the answer is useful is another matter, since a log line from four months ago rarely tells anyone anything about a specific person.
Logging is not the same as tracking
It is worth separating two things that get treated as one.
Logging is a server writing down that a request happened. It is bounded, usually short lived, and mostly boring. It is also the thing that makes a site debuggable and defensible.
Tracking is building a profile of a person across time and across sites. An address is a poor tool for that: it changes, it is shared by everyone in a home, and on a mobile network it belongs to a pool of thousands. Real cross-site tracking runs on identifiers designed for the job.
Conflating them leads people to spend effort on the address and none on the mechanisms doing the actual work. If tracking is your concern, the useful moves are in your browser rather than in your connection.