Features Case Law
Supreme Court split on IP address privacy

By a narrow margin, Canada’s highest court has held that a person retains a reasonable expectation of privacy in their IP (internet protocol) address such that judicial authorization is required by police to obtain it from a third party.

In R. v. Bykovets, 2024 SCC 6, police were investigating the use of unauthorized credit card data to purchase liquor store gift cards. The defrauded company’s third-party payment processor – Moneris – voluntarily provided the police, on request, two IP addresses used to purchase the gift cards online. The police then obtained a production order compelling Telus to disclose subscriber information for the IP addresses, which turned out to be the accused – Andrei Bykovets – and his father. With this information, the police obtained warrants to search the two residences associated with the IP addresses, seizing instruments of forgery, fraudulent identification documents, credit card data of innocent victims and firearms. As a result, Bykovets was charged with 33 Criminal Code offences associated with the possession and use of the credit card data, personal identification documents and firearms.

At his trial in the Alberta Court of Queen’s Bench (now King’s Bench), the judge concluded that Bykovets did not have a reasonable expectation of privacy in his IP address and, therefore, the police request to Moneris was not a search under s. 8 of the Charter. Bykovets was convicted of 14 offences including using unauthorized credit card data and possessing material related to credit card fraud.

Bykovets appealed the Queen’s Bench ruling to the Alberta Court of Appeal. Two judges would have upheld the trial judge’s ruling, agreeing Bykovets did not have a reasonable expectation of privacy in his IP address because the address, by itself, revealed nothing about a person’s lifestyle or core biological information. One appeal judge, however, disagreed and she would have found a reasonable expectation of privacy did attach to an IP address and police required a warrant to obtain it. This judge would have found a s. 8 Charter breach and ordered a new trial. But, by a 2:1 margin, Bykovets’ appeal was dismissed, and his convictions were upheld. Bykovets then appealed to Canada’s top court.

“IP addresses are not just meaningless numbers,” said Justice Karakatsanis.

What is an IP address?

A majority – five Supreme Court judges – described an IP address as follows:

An IP address is a unique identification number. IP addresses identify Internet-connected activity and enable the transfer of information from one source to another. They are necessary to access the Internet. An IP address identifies the source of every online activity and connects that activity (through a modem) to a specific location. An Internet Service Provider (ISP) keeps track of the subscriber information that attaches to each IP address.

Does an IP address itself attract a reasonable expectation of privacy?

The majority found an IP address does attract a reasonable expectation of privacy.

“IP addresses are not just meaningless numbers,” said Justice Karakatsanis, speaking for herself and four other judges. “Rather, as the link that connects Internet activity to a specific location, IP addresses may betray deeply personal information — including the identity of the device’s user — without ever triggering a warrant requirement. The specific online activity associated with the state’s search can itself tend to reveal highly private information. Correlated with other online information associated with that IP address, such as that volunteered by private companies or otherwise collected by the state, an IP address can reveal a range of highly personal online activity.”

The majority described a person’s IP address as the first “digital breadcrumb” – “the key to unlocking an Internet user’s online activity” – which “may establish an Internet user’s entire daily, weekly or even monthly online activity, leading to an electronic roadmap of the user’s cybernetic peregrinations.” By extending s. 8’s protection to an IP address, the first “digital breadcrumb” is protected from governmental intrusion.

Since there is a reasonable expectation of privacy in an IP address, a request by the police to Moneris – the third-party payment processor – for the IP addresses was a search which required prior authorization, such as a production order to trace specified communication under s. 487.015(1) of the Criminal Code. This provision requires reasonable grounds to suspect an offence has been or will be committed.

“Judicial oversight in respect of an IP address is the way to accomplish s. 8’s goal of preventing infringements on privacy,” said Karakatsanis. “Privacy, once breached, cannot be restored.” The majority ordered a new trial.

A different view

The remaining four Supreme Court judges would have dismissed Bykovets’ appeal. In their view, an IP address only revealed limited information.

“I find that the [accused] did not have a reasonable expectation of privacy in the IP addresses on the credit card processor’s servers and the ISP they revealed,” said Justice Côté, speaking for the minority. “The police did not need judicial authorization before asking the processor for the IP addresses in order to determine the ISP associated with them.”

Recognizing that both technology and the ways in which crimes are committed evolve, Côté noted that criminal investigations could be hampered if IP addresses attracted a reasonable expectation of privacy. “The result reached by my colleague that not only some, but all, IP addresses attract a reasonable expectation of privacy would seriously thwart the police’s ability to investigate such serious offences against children,” she said. “Given this evolution of online crime, requiring that police seek authorization to obtain an IP address in every case would also exacerbate the existing challenges faced by the criminal justice system.”

As a consequence, in a 5:4 split, Bykovets’ appeal was allowed, his convictions were set aside, and a new trial was ordered.

Mike Novakowski is Blue Line’s case law columnist.