Cybersecurity 101: Can My IP ID Me?

A very common question I hear is, “Can my IP address let someone identify who I am or track my actions?” The short answer is a solid “sort of,” so let’s dive into this topic.

What is an IP address?

Your Internet Protocol (IP) address is a string of characters that identifies your device whenever you’re using a network of any kind. This includes - but isn’t limited to - your home WiFi, work network, cellular data networks, the WiFi in the airport and on airplanes, etc. What that IP address will look like can take one of two forms: IP version 4 (IPv4) or IP version 6 (IPv6).  IPv4 was the standard for all network communications for decades, but as it is made up of four numbers from 0 to 255, there is a limit to how many addresses can exist at any given time. IPv6 came along to fix that problem, and is steadily becoming more and more common both with company networks and across the Internet in general.  Each network assigns your device an IP address for that network whenever you connect to it, so a machine can have more than one IP address if it is able to connect to more than one network (such as a phone connected to both WiFi and cellular data).

IPv4 addresses will always be a “dotted quad” - a combination of four numbers from 0 to 255 with a decimal between each number. 101.43.186.10 and 192.168.50.3 are both examples. 

IPv6 is significantly more complicated, but boils down to eight groups of four hexadecimal values each (0-9, A-F), separated by colons.  Some zeroes (specifically leading zeros and groups that are entirely made up of zeroes) are frequently edited out of IPv6 addresses for ease-of-reading, so 2001:0db8:85a3:0000:0000:8a2e:0370:7334 is a valid IPv6 address, but 2001:db8:85a3::8a2e:370:7334 is the same IPv6 address. 

No matter if your device was assigned an IPv4 or IPv6 address (or both), this address identifies your device on any given network. 

There’s one more concept to explore before we move on - dynamically assigned addresses.  For the vast majority of networks, a device is not assigned a permanent IP address.  Mostly, this is because of the limitations of IPv4 (so that your network wouldn’t run out of IP addresses just because old devices aren’t on the network anymore), but has carried over into the IPv6 world as well. When your device joins a network, it is highly likely that a dynamically-assigned IP address (typically through technologies like Dynamic Host Configuration Protocol or DHCP) will be assigned to that device for a period of time ranging from minutes to weeks. When the time is up, a new IP address is assigned to the device.  This even happens on things like firewalls and cable modems and other routers. Your Internet Service Provider (ISP) dynamically assigns an IP address to the networking device for a fixed period of time, then gives the device a new IP when that time is up. 

How does that identify me?

The short answer is that it doesn’t identify you at all. What it does do is identify your device, and that means that whatever that device does can be logged for later review. Most companies and ISP’s alike will keep logs of what any given device did while on the network for some period of time - ranging from less than a week in some cases to over seven years if bound under certain regulations. Since whatever issued the IP address to that device knows what device was using any given IP address at any given time, this means the logs can correlate to identify which device (which was assigned a specific IP) was going to a specific website, or downloading a file, or communicating with other devices. When the IP address assigner (your company, your ISP, etc.) knows that an IP was assigned to a device on your account, that can loosely correlate to identifying you, but it’s far from concrete. 

For example, your company knows it assigned the IP address 192.168.1.14 to your work laptop. Your company also logged that you were signed into the machine during the time that IP address was assigned to it. If that IP address downloaded sensitive data from a file share, it is pretty safe to presume that you were the one who downloaded it.  Yes, it’s possible that you left your laptop unlocked, and someone else downloaded the data using it, but it now becomes up to you to prove that, since the company knows you were logged in on the device that was assigned that IP address when the access happened. This is another reason to never leave an unlocked device unattended. 

In fact, based on the decision of a German court case that eventually went to the European Union Courts, IP addresses are considered Personally Identifiable Information (PII) in the EU whenever identifying who has been assigned that IP at a specific time is logically discoverable. In short, if a court could order your ISP to tell them if your device was assigned that IP at a specific time (which it is very possible to do), then your IP is considered identifiable to you. 

Can I stop this kind of tracking?

Again, here, the answer is “sort of.” On a work network, it is unlikely you can stop IP tracking as you have no control over how IP addresses are assigned or how activity is logged. Your employer will follow the company/organizational policies to determine how things are assigned, logged, and tracked.  On your home network, you have a bit more flexibility. You can use tools like a Virtual Private Network (VPN) software package to “mask” (hide) your true IP from websites and services.  The short version is that the site or service only sees the VPN provider’s IP address, not yours.  Then it becomes a matter of the policies of the VPN provider.  How much do they log? How long do they hold the log data?  If a VPN provider is subject to the jurisdiction of a given law enforcement agency, and the logs are retained, then the provider may be required to tell the law enforcement agency which user was assigned the VPN IP address, and you can have your identity discovered that way. NOTE: Neither this author nor Pondurance are lawyers, and you should seek legal advice from a qualified professional for all matters involving the laws and regulations that apply to you, your company, and your ISP.

Summing it up

The IP address that you are assigned when you connect your device to a network can be tied back to that device. If you are the owner of that device (or it was assigned specifically to you by your company), then it will be presumed that actions taken by a device assigned that IP address are attributable to you.  This might require formal, legal requests; but this is something that is very possible from a technical perspective. 

While this doesn’t necessarily prove that you, specifically, performed those actions; it does mean that your assigned IP address can be used to identify you at a high-level.  That is why the EU considers IP addresses as Personally Identifiable Information when actions are being logged (nearly always) and those logs are retained (depends on policy, but nearly always). A VPN may help obfuscate your real assigned IP address, but only if the VPN provider does not also keep logs on which VPN IP address was assigned to a specific user. Most VPN providers do retain such logs for varying amounts of time. 

So, yes, in theory your IP address can be used to identify and track you online. It may not be able to say for certain that it was you pressing the keys and moving the mouse around, but it can definitely be used to figure out a device that you use/own/were assigned was performing those actions.

About the Author:

Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence.