German internet providers will now be required to store the IP addresses of all citizens for at least three months, even in the absence of suspicion of a crime. The measure had already been agreed upon by the CDU/CSU and SPD in their coalition agreement, but its actual implementation has raised eyebrows.
Posting to X, Chancellor Friedrich Merz (CDU) wrote: “Perpetrators on the net get away unpunished far too often – especially in cases of child pornography. To address this, the cabinet decided today: IP addresses will be stored for three months in the future and used for criminal prosecution in cases of reasonable suspicion.”
Täter im Netz kommen zu oft ungestraft davon – vor allem bei Kinderpornographie. Dafür hat das Kabinett heute beschlossen: IP-Adressen werden künftig drei Monate gespeichert und bei begründetem Verdacht zur Strafverfolgung genutzt.
— Bundeskanzler Friedrich Merz (@bundeskanzler) April 22, 2026There are, however, questions regarding whether such a move complies with EU law, with a community note slapped on Merz’s post pointing out: “The European Court of Justice permits data retention only to combat serious criminality. However, the legislative draft uses the broader term ‘crimes of significant importance.’ Whether blanket IP retention is thereby compliant with EU law is disputed.”
At the time of their agreement, the CDU/CSU and SPD cites the need to store IP addresses and port numbers “in order to be able to assign them to a specific internet connection owner,” notes Junge Freiheit.
IP addresses are a kind of identification or address for internet users, with the government essentially making the move part of their campaign to combat “online fraud and hate crime on the internet.” This would, they claim, as cited by JF, “significantly improve the investigative capabilities of law enforcement and security authorities in the fight against cybercrime.”
The draft legislation is sure to pass in the Bundestag, as the CDU/CSU and SPD hold a majority there.
Over the past 20 years, the Federal Constitutional Court has struck down all attempts to establish data retention, declaring them incompatible with Germany’s constitution. Earlier proposals, however, involved not only the storage of IP addresses but also communication and telephone data. The European Court of Justice has also opposed such measures.
