German IP Address Logging: Police Powers Expanded

Germany’s cabinet approved a draft law on Wednesday, April 22, 2026, mandating internet service providers to store IP addresses for three months, a move intended to bolster investigations into online crimes like child pornography distribution, cyber fraud, and digital harassment. The legislation revives a long-standing debate in Germany concerning the balance between data privacy and security.

Combating Online Crime: A Renewed Push for Data Retention

Federal Chancellor Friedrich Merz (CDU) emphasized the need for the law, stating, Perpetrators on the internet too often go unpunished – especially in cases involving child pornography. He believes the government’s plans will address this issue. The draft legislation requires providers to retain IP addresses and accompanying port numbers for three months after they are assigned to a specific connection, but explicitly excludes the retention of target IP addresses, content data, location data, and other traffic data.

Federal Justice Minister Stefanie Hubig (SPD) explained that the digital space must not be a paradise for criminals. She highlighted the numerous unsolved crimes – including child abuse, online fraud, and digital violence – that could be resolved with access to crucial evidence like IP addresses, which she described as often the only starting point for investigations.

Constitutional Challenges and Previous Attempts

The concept of data retention has been previously attempted in Germany, but has repeatedly faced constitutional challenges. This latest effort aims to overcome previous legal hurdles by narrowly focusing on IP address retention and explicitly prohibiting the creation of online movement profiles. Law enforcement will only be able to request information to determine which account holder was associated with a specific IP address at a given time.

Scope of Data Retention: IP Addresses Only

The draft law specifically limits data retention to IP addresses and port numbers. According to the Federal Ministry of Justice, this approach is designed to minimize privacy intrusions while still providing a valuable tool for law enforcement. The ministry asserts that the creation of online movement profiles will remain prohibited, addressing a key concern raised in previous legal challenges.

Addressing a Twenty-Year Debate

Minister Hubig characterized the implementation of this draft as an opportunity to bring about a reasonable resolution to a twenty-year debate balancing freedom and security online. The debate centers on the tension between protecting individual privacy rights and equipping law enforcement with the tools necessary to combat increasingly sophisticated online criminal activity.

Rising Digital Crime and Investigative Challenges

The German government’s renewed push for IP address retention is driven by the increasing prevalence of digital crime. Law enforcement officials have expressed frustration with their inability to effectively investigate online offenses due to the limited retention periods of IP address data by internet providers. The Ministry of Justice notes that typical cases where this information could be crucial include crimes committed via criminal trading platforms, messenger services, or fraudulent web stores.

The draft bill aims to optimize the utilization of existing investigative instruments within the digital landscape, rather than introducing entirely new powers. By ensuring long-term access to IP addresses, authorities hope to improve their ability to track down and prosecute perpetrators of cybercrime, ultimately making the internet a less attractive environment for criminal activity.