Police can track an IP address, but tracing it on their own only gets them as far as your internet service provider and a rough geographic area. Turning that number into your name, your street address, and eventually a criminal case almost always requires a subpoena, a court order, or a search warrant served on the ISP — and even then, an IP address identifies a network connection, not the specific person who used it.
What an IP Address Shows Before Any Legal Process
A raw IP address, run through publicly available databases, typically reveals which ISP assigned it and a general geographic area such as a city, metro region, or zip code. It does not reveal your name, your street address, your phone number, or which person in a household was actually at the keyboard.
Investigators pick up IP addresses from all sorts of sources during a case: server logs from a website tied to criminal activity, email headers, file-sharing networks, social media platforms, or tips from other agencies. Once they have the number, everything that follows depends on convincing an ISP — with the right legal paperwork — to hand over the subscriber behind it.
The Legal Process Police Use to Identify You
Federal law sorts government access to internet records into tiers. What police want dictates how much legal authority they need to get it.
Administrative Subpoena for Basic Subscriber Information
At the bottom rung, police can obtain basic subscriber information with an administrative subpoena. That covers your name, address, session times and durations, length of service, payment method, and any temporarily assigned network address. The threshold is low: no probable cause, no judge’s signature, just a legitimate investigation.1Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
Court Order for More Detailed Records
For records that go past that basic subscriber list, police can seek a court order under Section 2703(d) of the Stored Communications Act. They have to present “specific and articulable facts” showing reasonable grounds to believe the records are relevant and material to an ongoing criminal investigation. Tougher than a subpoena, but still short of full probable cause.1Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
Search Warrant for Communication Contents
To read the actual contents of stored communications — the emails, messages, and cloud-stored files themselves — police need a full search warrant supported by probable cause and signed by a judge. A warrant also removes the requirement to notify you that your records were requested, which matters tactically during an active investigation.1Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
Cable internet subscribers get an extra layer of protection. Under the Cable Privacy Act, the government must show clear and convincing evidence that a subscriber is reasonably suspected of criminal activity before a court will order the cable provider to disclose identifying information. The subscriber also has the right to appear in court and challenge the request.2Office of the Law Revision Counsel. 47 USC 551 – Protection of Subscriber Privacy
Real-Time Routing Data
Police can also monitor internet routing information in real time using a pen register or trap-and-trace order. This captures addressing and routing data, essentially the digital equivalent of recording which phone numbers you dial, without capturing content. The standard is the same low relevance bar: an investigator certifies the information is relevant to an ongoing investigation, and the court grants the order.3Office of the Law Revision Counsel. 18 USC 3123 – Issuance of an Order for a Pen Register or a Trap and Trace Device
When Police Can Skip Legal Process Entirely
One significant exception cuts through the tiered system. When an ISP has a good-faith belief that an emergency involving danger of death or serious physical injury requires immediate disclosure, it can voluntarily hand over subscriber records and even communication contents to law enforcement. No warrant, subpoena, or court order.4Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records
This exists for kidnappings, imminent threats of violence, and missing-person cases where waiting for a judge could cost a life. It does not give police blanket authority to declare an emergency and demand records. The ISP makes its own good-faith determination, and the Attorney General must report annually to Congress on how many times the Department of Justice received voluntary disclosures under this provision.4Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records
Why an IP Address Is Not a Person
This is where a lot of people, and sometimes law enforcement, get tripped up. An IP address identifies a network connection, not a human being. Courts have said so repeatedly. A federal judge in Illinois put it bluntly: an IP address alone cannot identify who carried out activity on a computer network. The person behind the address might be the account holder, a family member, a houseguest, a neighbor piggybacking on unsecured WiFi, or someone parked on the street.
That reality makes IP evidence a starting point rather than an endpoint. After the ISP produces subscriber information, investigators still have to establish which specific person was using the connection at the relevant moment. That usually means additional evidence: surveillance, device forensics, witness statements, or an admission. Charging someone based only on a name attached to an IP address is a mistake prosecutors have been warned against.
What Makes Tracking Harder or Impossible
Even when police follow the process perfectly, technical realities can stop a trace cold.
VPNs and Tor
A virtual private network routes your traffic through a server elsewhere and replaces your real IP with the provider’s. Websites, services, and any investigator reviewing server logs will see the VPN’s address instead of yours. Police would have to serve legal process on the VPN provider, and many commercial VPNs claim to keep no logs, though the reliability of those claims varies. The Tor network goes further by bouncing traffic through multiple volunteer relays around the world, making the original user extraordinarily difficult to trace.
Carrier-Grade NAT
A growing problem for investigators is carrier-grade NAT, a technology that lets ISPs share one public IP address among hundreds or thousands of subscribers at the same time. According to Europol, roughly 90% of mobile internet providers have adopted it, and about 50% of fixed-line providers use it.5Europol. Are You Sharing the Same IP Address as a Criminal When thousands of users share a single address, an ISP often cannot determine which subscriber generated a particular connection at a given moment, which makes it technically impossible to identify a single person behind that address even under a valid court order.
Public and Shared WiFi
When an IP address traces back to a coffee shop, library, hotel, or any other public network, it identifies the router, not any individual device. The suspect pool is essentially anyone within wireless range. Investigators in that situation often deploy extra techniques, like signal-locating tools that measure radio signal strength to narrow a device’s physical position, or connecting a monitoring device to the same network to capture hardware identifiers from other devices connecting. Those extra steps are usually what builds the probable cause for a search warrant, since ISP records only point to whoever owns the router.
Dynamic IPs and Data Retention
Most home connections use dynamic IP addresses that change periodically. Tracing one months later requires the ISP to have retained logs showing which subscriber held that address at the exact date and time in question. The catch: the United States has no federal law requiring ISPs to keep this data for any specific period. Some providers hold connection logs for months; others may keep them for a year or two. If police wait too long to serve their process, the records may already be gone.
The Fourth Amendment Status of IP Data
The constitutional rules around digital surveillance are shifting, and IP tracking sits in the middle of the fight.
The traditional rule, known as the third-party doctrine, says you have no reasonable expectation of privacy in information you voluntarily share with a third party like a bank or phone company. Under that logic, your IP address information (which your device shares with your ISP, websites, and apps as a basic function of internet communication) would receive little constitutional protection.
The Supreme Court complicated that in Carpenter v. United States (2018), holding that the government needs a warrant to obtain historical cell-site location records from a wireless carrier. The Court found that the third-party doctrine doesn’t automatically apply to detailed digital records that reveal the “privacies of life.” The Court also acknowledged that its ruling was narrow and did not address IP addresses or browsing history directly.6Justia Law. Carpenter v United States, 585 US (2018)
Lower courts have split on what Carpenter means for IP addresses. The First Circuit held in U.S. v. Hood (2019) that a defendant had no reasonable expectation of privacy in IP address data obtained from a smartphone app company without a warrant, reasoning that IP addresses don’t carry the same comprehensive location-tracking concerns the Supreme Court flagged. The Fourth Circuit moved in the other direction in 2026, ruling that police cannot open private files found through digital investigations without first securing a warrant, reinforcing the principle that probable cause alone doesn’t justify rummaging through digital containers.7United States Court of Appeals for the Fourth Circuit. United States of America v Nico Aaron Lowers
What Happens After Police Identify You
Getting subscriber information from an ISP is rarely the end of the road. In most cases, the IP address and subscriber data are one piece of a larger evidentiary puzzle. After identifying the account holder, police may seek a second warrant to search the physical address on the account, seize electronic devices, and conduct forensic analysis. They may run surveillance, interview neighbors, or pull corroborating digital evidence from other platforms.
If you discover that your ISP has disclosed your information to law enforcement, your options depend on the legal process used. Cable subscribers have a statutory right to be notified of court orders and to challenge them.2Office of the Law Revision Counsel. 47 USC 551 – Protection of Subscriber Privacy If police obtained evidence through an unconstitutional search, without proper legal authorization or in violation of your Fourth Amendment rights, a defense attorney can file a motion to suppress that evidence, potentially keeping it out at trial. The strength of any suppression argument depends heavily on which legal process police used and whether it met the constitutional standard that applied at the time.