The German government calls it a slimmed-down data retention regime: IP addresses only, three months only, aimed only at solving internet crime. Two details from the legislative process call that description into question — and neither comes from campaigners but from the network operators themselves and from the Federal Bar Association. This article sets out what is stored, for how long in reality, and what follows from it.
What the draft provides for
Two instruments that are often merged in common usage although they work differently.
-
Blanket retention of IP addresses
Internet access providers are to store the newly assigned IP address and the associated port number for each dial-up event, for three months. Blanket means: independent of any suspicion, for every connection.
-
The preservation order
In addition, investigating authorities are to be able to order in individual cases that a provider preserve a specific customer’s traffic data for three months from the time of the request. Under the draft this is to be possible without prior judicial authorisation.
-
The stated purpose
IP addresses are to be matched to subscriber identities — the examples given are access to file-sharing networks carrying abuse material and the operation of fraudulent online shops. The need for that attribution is real and is not disputed here.
The government’s own communication describes the IP address as the “number plate of the internet”. That is more apt than intended: a number plate does not identify the route but the keeper — and it does so reliably.
Why three months are not three months
Here lies the finding that most clearly corrects the political description of the project, and it comes from the network operators’ submissions in the consultation.
The three-month period relates to the assignment of an IP address — storage starts with the dial-up event. On classic DSL lines with a daily forced disconnection this did produce a rolling three-month window.
Modern fibre connections have no such forced disconnection. The connection persists and so does the IP address — according to the operators, connection times of several weeks and months are the norm. The three-month period only starts with the next reassignment. Arithmetically this produces an effective retention period of thirteen months and more.
The Federal Bar Association additionally points out that the draft presents no empirical basis for the three-month period itself. The number is asserted, not derived.
The direction, not the individual case
Taken on its own, IP retention is a manageable matter. It becomes relevant in the context of what else was decided or is pending in the same months:
- Extension of chat control to 2028, adopted on 9 July 2026 after two rejections voluntary scanning, not an obligation — but through at the third attempt
- Blanket IP retention, cabinet decision of 22 April 2026 third attempt after two failed predecessor regimes
- EU cash ceiling of EUR 10,000 from 10 July 2027 commercial payments only, identification duty from EUR 3,000
- Digital euro: regulation expected end of 2026, pilot phase from mid-2027 introduction 2029 at the earliest
- DAC8: reporting duty for crypto service providers since 1 January 2026 purchases, sales and exchanges reported to the Federal Central Tax Office
Every single item has a comprehensible justification. That is not a counter-argument but the description of a pattern: regulation of this kind is rarely withdrawn, it is added to. Anyone making a location decision is making it against a trend, not against an event.
What actually changes
Soberly: for most readers, little — and that honesty belongs here. IP retention changes nothing tangible in the daily life of a law-abiding entrepreneur.
Two points are nonetheless concrete:
First, the duty attaches to the internet access provider. It covers connections in Germany. Anyone who genuinely relocates their centre of life and goes online through a Georgian provider is not caught — not through evasion but because the rule simply has a different addressee.
Second — and this is the more important qualification — a Georgian company achieves nothing here at all. The connecting factors are the line and the person, not the legal form of a business. Anyone selling you a foreign incorporation as the answer to surveillance questions is selling past the subject; which regimes actually apply is set out in Georgian Company, German Authorities.
What a Georgian structure does solve are tax, operating and banking questions — and it solves those well. The rest is a question of residence, not of the commercial register. The parallel process at EU level is covered in Chat Control: Rejected Twice, Then Adopted, the overall balance sheet of the location in Government Ratio 50.3%.
Frequently asked questions
What exactly is stored?
Under the cabinet draft of 22 April 2026, internet access providers are to store the newly assigned IP address and the associated port number for each dial-up event, for three months in each case. Communication content is not covered, nor are the sites or services accessed. The purpose is to attribute an IP address to a subscriber.
Why is there talk of thirteen months when the law says three?
Because the period starts with the assignment of the IP address. Classic DSL lines with a daily forced disconnection produced a rolling three-month window. Modern fibre connections have no such disconnection; according to the network operators, connection times of several weeks and months are the norm. The period only starts with the next reassignment, which in practice produces thirteen months and more.
What is the preservation order?
A second instrument alongside the blanket retention duty. Investigating authorities are to be able to order in individual cases that a provider preserve a specific customer’s traffic data for three months from the time of the request. Under the draft no prior judicial authorisation is required, suspicion suffices. This is the part most sharply criticised in the consultation responses.
Is this the same as chat control?
No. IP data retention is a German legislative process concerning traffic data, that is the attribution of connections. Chat control is an EU project concerning the scanning of communication content. The two are frequently conflated; they sit on different levels and have different addressees.
Does a Georgian company help against this?
No. The retention duty attaches to the internet access provider and covers connections in Germany; the connecting factors are the line and the person, not the legal form of a business. Anyone offered a foreign incorporation as the answer to surveillance questions should scrutinise that provider. What a Georgian structure does relocate is taxation, operations and banking.
What changes with a genuine change of residence?
The addressee of the rule. Anyone who actually relocates their centre of life to Georgia and goes online through a Georgian provider is not subject to the German retention duty — not by circumvention but because the norm attaches to the domestic connection. That is, however, a real move with all its tax consequences, not a form.
This article is general information and does not constitute legal or tax advice. The statements relate to the draft act on the precautionary preservation of IP addresses in the version adopted by the German federal cabinet on 22 April 2026 and to the consultation responses submitted by network operators and the Federal Bar Association. At the time of writing the draft had not completed its passage through the Bundestag. As of June 2026, subject to changes in the law.