Protecting the Privacy of your IP Address

If s. 8 of the Charter is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses. An IP address is the crucial link between an Internet user and their online activity. Viewed normatively, it is the key to unlocking a user’s Internet activity and, ultimately, their identity. Thus, an IP address attracts a reasonable expectation of privacy. Accordingly, a request by the state for an IP address is a search under s. 8 of the Charter.

Section 8 of the Charter guarantees the right to be secure against unreasonable search or seizure. Its principal object is the protection of privacy, including informational privacy, that is, the claim of individuals, groups, or institutions to determine for themselves when, how and to what extent information about them is communicated to others. Personal privacy is vital to individual dignity, autonomy, and personal growth. Its protection is a basic prerequisite to the flourishing of a free and healthy democracy.

Defining a reasonable expectation of privacy is an exercise in balance. In this case, the balance weighs in favour of extending a reasonable expectation of privacy to IP addresses. The intensely private nature of the information an IP address may betray strongly suggests that the public’s interest in being left alone should prevail over the government’s interest in advancing its law enforcement goals. The Internet has exponentially increased both the quality and quantity of information stored about Internet users, spanning the most public and the most private human behaviour.

The Internet has not only allowed private corporations to track their users, but also to build profiles of their users filled with information the users never knew they were revealing. By concentrating this mass of information with private third parties and granting them the tools to aggregate and dissect that data, the Internet has essentially altered the topography of privacy under the Charter. It has added a third party to the constitutional ecosystem, making the horizontal relationship between the individual and the state tripartite. Though third parties are not themselves subject to s. 8, they mediate a relationship which is directly governed by the Charter — that between defendant and police. This shift has enhanced the state’s informational capacity.

Weighed against these substantial privacy concerns is society’s sometimes conflicting but legitimate interest in the need for safety and security. Police should have the investigative tools to deal with crime that is committed and facilitated online. However, requiring that police obtain prior judicial authorization before obtaining an IP address is not an onerous investigative step. Where the IP address, or the subscriber information, is sufficiently linked to the commission of a crime, judicial authorization is readily available.

Recognizing that an IP address attracts s. 8 protection aims to make sure police investigations better reflect what each reasonable Canadian expects from a privacy perspective and from a crime control perspective. Judicial oversight narrows the state’s online reach and removes the decision to disclose information — and how much to disclose — from private corporations and returns it to the purview of the Charter.

Source: R. v. Bykovets, 2024 SCC 6 (CanLII)