After Cabinet Decision: eco Association Sees Significant Risks in IP Storage

Berlin, 22 April 2026 - The Federal Cabinet today approved the introduction of mandatory storage of IP addresses and port numbers for a period of three months. According to the German federal government, the aim of the planned regulation is to facilitate law enforcement, particularly in the digital sphere. From the perspective of the Internet industry, however, the decision remains highly problematic.

eco - Association of the Internet Industry warns of significant legal risks as well as negative impacts on companies and Germany as a business location. "Even after the Cabinet decision, it remains the case: the draft fails to meet the requirements of the European Court of Justice and once again creates indiscriminate data retention without demonstrable added value for law enforcement. Three months of IP address retention does not mean more security, but rather more data retention without cause. At least the government's draft tightens the conditions for data retention compared to the ministerial draft, thereby drawing a necessary line. The fact that traffic data is now only to be retained where there is a personal or geographical link to the criminal offence also shows that the draft itself acknowledges the particularly intrusive nature of the measure," explains eco Board Member Klaus Landefeld.

eco is particularly critical of the proposed access regulations. The draft partially shifts the oversight of state data access from a prior judicial review to subsequent notifications. However, these cannot ensure effective legal protection to the same extent. Furthermore, the practical implementation of the notification obligations remains unclear. "This creates the risk that judicial oversight will effectively be weakened," says Landefeld.

eco also sees a need for clarification regarding the specific structure of the retention period. A statutory duration of three months must not result in IP addresses being assignable to individual users for a longer period in practice. Particularly in modern network architectures with long-lasting or persistent connections, there is a risk that the intended time limit will be circumvented in practice. Therefore, both a technical and legal framework are required to ensure that the retention period is effectively enforced while remaining practicable. "A statutory deadline only has an effect if it can also be reliably adhered to in day-to-day operations. Otherwise, there is a risk of both legal uncertainty for companies and renewed conflicts with the European legal framework," Landefeld emphasises.

Furthermore, eco foresees significant burdens for the affected companies. Internet providers are to be obliged to set up complex and highly secure storage infrastructures - despite an uncertain legal situation. Expanded access options, including toward services based in other EU countries, could also lead to data being accessed that should not have been stored in the first place under applicable law.

"Companies are once again being asked to invest in an infrastructure whose legal status is questionable. This creates planning uncertainty, incurs high costs and weakens Germany's position as a digital business location," Landefeld stresses.

eco calls on the German federal government to fundamentally revise the proposal during the further legislative process. What is needed, it argues, is a solution that strictly adheres to European case law, safeguards fundamental rights and relies on targeted, case-specific investigative measures under clear judicial oversight.

Background:

• The Federal Cabinet has approved a three-month retention period for IP addresses and port numbers.
• According to the German federal government, the aim is more effective law enforcement, particularly for serious crimes.
• The European Court of Justice has set strict limits on indiscriminate data retention.
• In eco's view, linking this data with other information can create comprehensive user profiles.
• Studies show that such traffic data is often only relevant for investigations for a short period of time.
• eco actively supported and accompanied the successful lawsuit by its member company SpaceNet AG against data retention; in 2023, the German Federal Administrative Court confirmed that the relevant German regulations were contrary to EU law.
• eco has published a statement on the draft law, setting out the legal, technical and economic implications in detail.