The Supreme Court of Canada has held that internet protocol (“IP”) addresses are protected under section 8 of the Canadian Charter of Rights and Freedoms. In R. v. Bykovets (2024 SCC 6), the majority of the court held that IP addresses attract a reasonable expectation of privacy. A significant consequence of this decision is that law enforcement must obtain a warrant before obtaining an IP address.
This post will review the facts of the case and its implications, but first, it will be helpful to define a couple of key terms.
What is Section 8 of the Canadian Charter of Rights and Freedoms?
Section 8 simply states:
Everyone has the right to be secure against unreasonable search or seizure.
Section 8, like the rest of the Charter, applies to state conduct against the individual. For example, a police officer searching or seizing items from an individual.
What is an IP Address?
The court in Bykovets adopted the following definition of an IP address:
An IP address is a unique identification number. IP addresses identify Internet-connected activity and enable the transfer of information from one source to another. They are necessary to access the Internet. An IP address identifies the source of every online activity and connects that activity (through a modem) to a specific location. And an Internet Service Provider (ISP) keeps track of the subscriber information that attaches to each IP address.
In other words, IP addresses are unique numbers that identify and distinguish devices on the Internet.
Internet Service Providers (e.g., Bell, Telus, Rogers) keep track of personal or subscriber information, such as a name, address and contact information, linked to IP addresses. This subscriber information has already been held to be protected under section 8 of the Charter in an earlier decision of the Supreme Court of Canada: R. v. Spencer, 2014 SCC 43.
The Bykovets case raised the further question of whether the collection of numbers that form an IP address is also protected under section 8 of the Charter.
Facts of the Case
The case began in 2017 with the Calgary Police Service investigating IP addresses related to fraudulent online purchases. The police requested IP addresses directly from a payment processing firm, Moneris, without a warrant beforehand. Moneris provided those IP addresses, which identified Andrei Bykovets and led to his arrest and eventual conviction.
During his trial, Bykovets contended that the warrantless acquisition of his IP address information constituted a violation of his constitutional right to be free from unreasonable government searches and seizures, as specified in Section 8 of the Charter. His argument at trial was unsuccessful. The trial judge held that the police request to the payment company was not a search under section 8 of the Charter because Bykovets did not have a reasonable expectation of privacy in his IP address. The court found that IP addresses do not attract an expectation of privacy because IP addresses do not disclose a “biographical core of personal information” without access to a third-party website.
On appeal, a majority Alberta Court of Appeal upheld the trial court’s decision, determining that section 8 did not apply in this case. The court agreed with the trial judge that an IP address, on its own, does not reveal any personal or biographical information about an individual. Therefore, Mr. Bykovets did not have a reasonable expectation of privacy in the IP address.
The Supreme Court’s Reasoning
In a 5-4 decision, the Supreme Court agreed with Bykovets. The majority opinion rejected the “piecemeal” reasoning of the lower courts and emphasized the potential information an IP address can reveal. They found that IP addresses are not an abstract collection of numbers but a key that can unlock a trove of deeply personal information:
Viewed normatively, an IP address is the key to unlocking a user’s Internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy. If s. 8 is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses.
This information can create a comprehensive picture of online behaviour, potentially uncovering:
- Web browsing habits
- Location history
- Payment history
- Search history
- YouTube history
- Purchasing habits
- Interests and preferences
The court recognized the legitimate need for safety and security requires giving the police the tools they need to investigate crime but, at the same time, requiring the police to obtain a warrant for an IP address was “not an onerous investigative step”. The police are certainly not without investigative tools. Section 487.015(1) of the Criminal Code permits the police to apply for an ex parte production order for information relating to a specific transmission of a communication. A court will make the order when the court has reasonable grounds to suspect that:
- an offence has been or will be committed;
- the identification of a device or person involved in the transmission of a communication will assist in the investigation of the offence; and
- transmission data that is in the possession or control of one or more persons whose identity is unknown when the application is made will enable that identification.
Further Implications and Considerations
Bykovets provides strong language that strengthens the digital privacy of Canadians, which may extend beyond the police and the Charter. While this was a case involving state intrusion into personal privacy, individuals and companies may need to consider the legal implications of providing or sharing IP address information without a court order. The logic in Bykovets suggests that IP addresses attract a reasonable expectation of privacy and therefore an individual sharing another’s IP address may be violating their privacy.
If you are being investigated, or have been charged with a criminal offence call the lawyers at Filkow Law for representation and expert advice.
