The German Federal Ministry of Justice has unveiled a draft law mandating internet service providers (ISPs) to retain customer IP addresses for a period of three months, sparking immediate debate over privacy and investigative powers. The proposal, presented on Monday, aims to bolster the investigation and prosecution of online crimes, including child pornography, online fraud and illegal hate speech – areas where authorities claim perpetrators frequently operate with impunity.
Central to the draft’s framework is the introduction of a new investigative tool: the “Securing Order”. This allowance permits telecommunications providers to retain additional traffic data for up to three months on a case-by-case basis, considerably widening the scope of data collection. Justice Minister Stefanie Hubig defended the measure, arguing that the current system allows criminals to evade justice due to the ephemeral nature of digital evidence. She emphasized that IP address retention “can decisively assist investigators” by ensuring that crucial digital trails remain accessible even long after an incident.
However, the legislation has already drawn criticism from civil liberties groups and opposition politicians. Concerns are being raised regarding the potential for mission creep – the possibility that retained data might be used for purposes beyond those originally intended. The sheer volume of data generated by the proposed retention policy also raises questions about storage capacity, data security and the potential for breaches. Critics point out that even with IP address retention, attributing online activity to specific individuals remains a complex and often unreliable process.
Adding another layer of controversy, the draft law also simplifies the process of cell site triangulation – a technique used to locate mobile phones. This broadened access to geolocation data has intensified concerns about surveillance and potential infringements on citizens’ privacy.
The draft legislation has been circulated to German states and associations for feedback, with responses due by January 30, 2026. This period will be crucial for assessing the balance between crime prevention and the fundamental right to privacy, as the debate moves from initial proposal to potential legal reality. The outcome of these consultations will determine whether the law, as currently conceived, proceeds, is significantly amended, or ultimately fails to pass.