The state's data protection commissioner, Joachim Wahlbrink, has said that web sites should not be able to pass along the IP addresses of visitors without their having given permission beforehand.
In doing so, he is taking on both internet companies in Germany and internet giants such as Amazon, Google and Facebook who depend on those IP addresses to more closely target their online advertising.
But the issue didn't begin with a David and Goliath confrontation between the data authorities in Lower Saxony and the behemoths in Silicon Valley. Rather, the German officials found a smaller initial target.
According to the technology news website heise online, it was in the form of Matthias Reincke, a web marketer who runs two forums on the side – one on weight loss, the other on dogs. Last year, Reincke's sites got noticed by the Lower Saxon authorities, which ordered him to remove from his pages Google's AdSense and an Amazon widget that features books from the online retailer.
Both allow Reincke to make a little money from his sites, and both run afoul of German privacy rules, according to data protection authorities. Reincke was also told to remove a page-view counter from his site from INFOnline, a service used by many large internet sites in Germany.
The problem according to the data guardians is that IP addresses, a unique number that identifies a computer and its location on the internet, can be passed along to third parties.
Since users cannot know how that information might be used, data protection commissioner Wahlbrink wants to require that users give their express permission beforehand before IP addresses can be passed on. An advisory on a website stating that the information will be transmitted is not enough, he said.
In Wahlbrink's view, IP addresses contain information specific to an individual and therefore sharing it with a website such as Amazon is an invasion of privacy. If his position gains widespread acceptance in Germany, large swaths of the country's web landscape could become illegal.
Meanwhile, Reincke has reportedly complied with some of the demands from the authorities. He has taken down the Amazon widget, replacing it with a screenshot, and removed his counter. But he does not want to remove his Google AdSense application, which he said “millions of other operators use” and provides him revenue to run the sites. He is waiting for a final decision from the authorities, whom he accuses of overreaching, and has promised a lawsuit should he be ordered to shut his websites down.
But opinion is not unanimous within Germany about IP addresses. In December, a Hamburg court ruled in a case involving a Swiss company that saved users IP addresses that they did not contain information specific to an individual.
This is also not the first time Germany has struggled to balance its high bar for data protection with the realities of the internet. Last year, a heated debate broke out over Google Street View, the internet search engine's panoramic picture service. Some 250,000 users in Germany opted to have their homes and businesses digitally obscured due to privacy concerns.
And last month, data protection officials broke off talks with the internet giant about its Google Analytics service, which gathers detailed information about website visits via a user's IP address, sending the data back to Google servers in the United States for processing.
According to a report in the daily Frankfurter Allgemeine Zeitung, data protection officials in several German states believe this practice should be illegal.