Stefanie HubigJustice · Rights · Responsibility
§ 15 — Policy · Digital Crime

An address that disappears.

For many online offences, an IP address is the only trace. Whether internet providers should be required to keep it — and for how long — is one of the most contested legal-policy questions of 2026.

Legislative process First reading 24 June 2026 · public hearing 7 October 2026

Stefanie Hubig speaking at a lectern in front of a blue backdrop of the Federal Criminal Police Office (BKA).
Speaking at the Federal Criminal Police Office (BKA).
1Rn.

Why IP addresses matter

Every device connected to the internet communicates through an IP address assigned by its internet access provider. For private customers, the address usually changes regularly. When a crime is committed online — the upload of child sexual abuse material, a fraudulent shop, a threat — the platform involved often records only the IP address and a time stamp. To identify the person responsible, investigators must ask the provider which customer used that address at that moment.

If the provider no longer holds the assignment, the trace ends. Under current law, providers keep such data only for their own business purposes, often for a few days, if at all.

2Rn.

The bill

Documented position

The ministry published a draft in December 2025; the federal cabinet adopted it on 22 April 2026, and the Bundestag held the first reading on 24 June 2026 (printed paper 21/6581), referring it to the Legal Affairs Committee.

  • Internet access providers must store IP-address assignments (and port numbers where relevant) for three months.
  • Authorities may access the data only where there is suspicion of a specific criminal offence.
  • No location data, communication content or browsing history is stored.
  • A separate preservation order allows other traffic data to be frozen in individual cases, generally on judicial order.

Hubig has argued that offenders in cases of child sexual abuse, online fraud and hate crime too often escape identification, and that the measure is narrowly drawn so that movement or personality profiles cannot be compiled.

3Rn.

The legal history

  1. 2010The Federal Constitutional Court annuls Germany’s first general data-retention law.
  2. 2015–17A new retention law is adopted but its obligations are suspended after court challenges.
  3. 2022The Court of Justice of the EU (SpaceNet/Telekom, 20 September) rules that general and indiscriminate retention of traffic data is incompatible with EU law — but that retention of IP addresses can be permissible under strict conditions.
  4. 2023The Federal Administrative Court holds the German retention provisions inapplicable in their entirety.
  5. 2024The CJEU (La Quadrature du Net II) clarifies that IP retention must be limited to what is strictly necessary.
  6. 2025–26The new government drafts and adopts the three-month IP-storage bill.
Rn. 4 — The arguments, side by side

Law-enforcement arguments

  • The IP address is often the only lead in online offences, especially in child sexual abuse cases.
  • Without storage, identification depends on chance — whether a provider still happens to hold data.
  • IP-only storage is far narrower than the earlier general data retention and is the route left open by the CJEU.
  • Access is tied to suspicion of a specific crime and legal procedure.
  • Supported by the German Judges’ Association and the BKA; the CSU would favour six months.

Civil-liberties arguments

  • Data on every internet user is stored without suspicion — a form of mass retention (Greens, Chaos Computer Club).
  • Necessity is not empirically shown: the Federal Bar notes that the BKA itself indicated two to three weeks would help.
  • Fibre-optic sessions can last months, so providers argue “three months” may amount to over a year in practice.
  • Press-freedom and source-protection concerns raised by journalists’ unions.
  • Doubts about compatibility with CJEU case law; earlier German laws failed in court. Opposed by the FDP, the Left and the AfD.
Rn. 5 — Oversight

Proportionality and safeguards

The constitutional test for any such measure is proportionality: does it pursue a legitimate aim, is it suitable and necessary, and is the intrusion appropriate in relation to the benefit? The debate turns on necessity. Supporters argue that no milder means — such as a “quick freeze” that preserves data only after a crime is reported — reliably secures the trace in time. Critics argue that quick freeze and better police resources are sufficient.

Safeguards under discussion include limiting the offences for which data may be retrieved, judicial authorisation, strict deletion after three months, data-security requirements and statistical evaluation of effectiveness. At the committee hearing on 7 October 2026, experts were sharply divided.

Editorial note
This page does not take a position. The final shape of the law, and its compatibility with EU law, will be decided by parliament and possibly by the courts.

Sources

  1. German Bundestag, first reading on IP-address storage, 24 June 2026 — bundestag.de (kw26); printed paper 21/6581
  2. beck-aktuell, government adopts IP-storage bill, 22 April 2026; Judges’ Association position, 29 January 2026
  3. netzpolitik.org, providers on effective storage length, 2026
  4. Federal Administrative Court, press release 66/2023 — bverwg.de
  5. CJEU, joined cases C-793/19 and C-794/19 (SpaceNet, Telekom), 20 September 2022
  6. evangelisch.de (epd), draft bill, 21 December 2025
Continue