eco on IP Address Retention: Another Attempt, the Same Problems

• Three-month blanket IP address retention goes far beyond what is necessary
• Additional data repositories create new risks for cybersecurity and digital sovereignty
• eco calls for strong rule-of-law safeguards and effective judicial oversight

Berlin, 7 October 2026 - On the occasion of today's public hearing of the Legal Affairs Committee of the German Bundestag on the planned retention of IP addresses, eco - Association of the Internet Industry has once again warned against a disproportionate obligation to retain data indiscriminately. The German federal government's draft legislation provides for IP addresses and other data required to identify users to be retained for a period of three months as a general rule.

"For almost two decades, data retention legislation has been repeatedly revived, and the courts have repeatedly had to deal with it. Policymakers should finally learn from this history: Three months of indiscriminate IP address retention is disproportionately long and would once again create a nationwide infrastructure for storing the data of law-abiding citizens," says Klaus Landefeld, member of the eco Board.

eco is particularly critical of the proposed retention period. Even cases examined by the German Federal Criminal Police Office (BKA) suggest that relevant traffic data is generally only needed for investigations for a period of a few weeks. In eco's view, there is no convincing evidence of additional benefits that would justify a more extensive interference with fundamental rights.

"Anyone seeking to retain the data of all Internet users for three months must be able to explain what additional investigative success this extended period would achieve. More data and longer retention periods are not ends in themselves. Where the additional benefit has not been demonstrated, the additional interference with fundamental rights cannot be justified either," says Landefeld.

eco is also particularly concerned about treating IP addresses as isolated pieces of technical information. The actual extent of the interference with fundamental rights also depends on the possibility of linking IP addresses with other traffic and usage data. Such links can reveal extensive information about individuals' online activities and communication behaviour. This cumulative effect must be taken into account when assessing proportionality.

"An IP address is not an insignificant piece of technical data. What matters is what it can reveal when linked with other data. Anyone who disregards this cumulative effect underestimates the actual extent of the intrusion associated with the proposed retention requirement," says Landefeld.

From eco's perspective, there is also a conflict between the proposed measures and cybersecurity policy objectives. At a time when Germany is seeking to strengthen its digital sovereignty, resilience and cybersecurity, Internet service providers would be required to maintain additional, extensive repositories of sensitive data. Such repositories are particularly attractive targets for attackers and increase the potential damage in the event of a security breach.

"We are rightly discussing how to make digital infrastructures more resilient and independent. At the same time, creating new, large repositories of sensitive data is inconsistent with these objectives. Data that is not stored cannot be stolen or misused," says Landefeld.

eco is also critical of the proposed safeguards and provisions governing access to retained data. Certain measures do not provide for consistent prior judicial authorisation. In the Association's view, this is the wrong approach, particularly given the blanket retention of sensitive data.

"Anyone expanding the state's powers to access data must strengthen the safeguards provided by the rule of law, not weaken them. Particularly where sensitive communications data is concerned, judicial oversight must not begin only after a measure is already underway," says Landefeld.

The debate over data retention has been a longstanding issue for eco. Together with its member company SpaceNet, the Association has previously challenged earlier legislation in court. In 2022, the Court of Justice of the European Union (CJEU) ruled in the SpaceNet and Telekom Deutschland cases that the German provisions then in force, which required the general and indiscriminate retention of traffic and location data, were incompatible with EU law.

"Germany needs effective digital investigative tools. But what we do not need is yet another attempt to introduce legally uncertain data retention legislation. Investigative powers must be targeted, proportionate and subject to effective oversight. Otherwise, we will find ourselves having the same debate again in a few years," says Landefeld.

eco's Position Paper on the Draft Legislation (German-language)