IP address
An IP address is the numeric address a device uses on the internet, sent with every request a browser makes, and both EU and California law treat it as personal data when it can be linked to a person.Every page view, image, font or script request carries the visitor's IP address to the server that answers it. That makes the IP address the one identifier no website can avoid receiving, and the one most third-party embeds collect without setting any cookie.
The GDPR names it. Recital 30 lists internet protocol addresses among the online identifiers that, combined with other information, can be used to identify people. The Court of Justice held in Breyer (C-582/14, 19 October 2016) that even a dynamic IP address is personal data for a website operator that has legal means to identify the visitor with the help of the internet access provider. In California, Cal. Civ. Code 1798.140(v)(1)(A) lists the Internet Protocol address among the identifiers that make up personal information.
The practical consequences reach beyond cookies. The Munich Regional Court (LG München I, 3 O 17493/20, 20 January 2022) awarded a visitor 100 euros because a website passed his IP address to Google by loading Google Fonts from Google's servers without consent; see Google Fonts and the GDPR. An IP address also reveals an approximate location, which is how a banner decides which rules to apply through geo-targeting. Logs and consent records should truncate, hash or drop it when the full address is not needed, as pseudonymisation suggests.