Germany cabinet approves three-month IP address retention for internet providers
Federal cabinet approves three-month IP address retention by ISPs to aid criminal probes, igniting debate over effectiveness, privacy rights and legal risk.
The federal cabinet on April 22, 2026 approved a proposal that would oblige internet access providers to retain all assigned IP addresses for three months, initiating a controversial move to expand IP address retention to assist law enforcement. The IP address retention proposal, presented by Federal Justice Minister Stefanie Hubig (SPD), is intended to make it easier to trace suspects in cybercrime, terrorism investigations and cases of child abuse that currently leave few digital traces. The measure has drawn immediate scrutiny from civil liberties groups and opposition parties, who warned it could conflict with constitutional privacy protections.
Cabinet decision and legislative aim
The cabinet decision mandates that internet service providers keep records of which customer held which IP address at what time for a minimum of three months. The Justice Ministry says the retention would help investigators link online activity to specific accounts when there is an initial suspicion of a particular criminal offence.
According to the proposal, stored data would not include message content or web browsing histories; the requirement targets only addressing and connection metadata needed to identify devices and subscribers. Supporters argue the change closes an investigative gap caused by the dynamic reassignment of IP addresses.
How the retention and access rules would work
Under the draft law, law enforcement agencies would be allowed to obtain retained IP assignment records only when they can show an initial suspicion of a defined offence. In individual cases investigators could require providers to secure additional connection data for up to three more months to reconstruct communication links and geolocation clues.
A judicial order would be required to extend any data retention period beyond the standard terms, and the bill allows a single court-approved extension of up to three months in exceptional cases. The ministry emphasizes that content such as messages, files or website content would not be captured by the retention mandate.
Justice Ministry rationale and political support
Federal Justice Minister Stefanie Hubig defended the bill as a necessary update to policing tools, saying many European countries already enforce similar rules and that Germany must “catch up” to avoid becoming a refuge for offenders. The ministry framed the proposal as a targeted, proportionate step to combat cyberfraud, digital violence and child sexual abuse online.
Coalition partners in the governing alliance backed the cabinet approval, presenting the measure as a technical and limited retention of assignment data rather than a broad surveillance expansion. Supporters maintain the safeguards in the bill — including judicial oversight and restrictions on content collection — will protect fundamental rights while improving investigative effectiveness.
Privacy concerns and constitutional risks
Civil liberties advocates and opposition parties warned that the proposed IP address retention risks breaching constitutional privacy protections and the presumption of informational self-determination. Critics say even limited metadata can allow sensitive inferences about purchasers, associations and political activity if combined with other datasets.
The parliamentary group of the Greens expressed serious doubts over the bill’s resilience to constitutional review, noting gaps that could hinder investigations in parts of the internet such as the Darknet and for activity older than the three-month window. Green parliamentarian Irene Mihalic warned the law may not withstand legal challenges and called for stricter safeguards and narrower access criteria.
Legal background and European Court precedent
Past attempts in Germany to introduce broad, blanket data retention — commonly known as Vorratsdatenspeicherung — were struck down by domestic courts as unconstitutional. The proposal seeks to navigate that legal history by limiting the retained items and introducing judicial checks on access and extensions.
The Justice Ministry points to a 2024 ruling by the Court of Justice of the European Union that allowed member states to require temporary retention of IP address data to fight crime, even without a specific prior suspicion, under certain conditions. Legal analysts say that precedent strengthens the government’s position but does not guarantee the measure will survive scrutiny under Germany’s Basic Law.
Parliamentary path and likely legal challenges
Before becoming law the draft must be approved by both the Bundestag and the Bundesrat, where it will face debate and potential amendments from opposition parties and state governments. Lawmakers are expected to weigh operational burdens on ISPs, data-protection safeguards and precise rules for judicial oversight during committee stages.
Legal organisations and privacy advocates have already signalled plans to challenge the law in court if passed, arguing that any expansion of mandatory retention must meet strict proportionality tests. The government says it has tailored the proposal to meet those standards, but observers expect a contested legal battle that could reach Germany’s constitutional court.
The proposal marks a consequential shift in Germany’s approach to digital investigations by prioritising traceability of online identities while promising judicial safeguards and limits on content collection. As the bill moves to parliament, the debate will centre on whether three months of mandated IP address retention strikes an appropriate balance between public safety and individual privacy.
