How often do IPs change? A detailed real-life study

A 2020 study Don’t Count Me Out: On the Relevance of IP Address in the Tracking Ecosystem analyzed 34,488 unique public IP addresses collected from 2,230 users over a period of 111 days.

They summarized that:

87% of visitors retain at least one IP address for more than a month and 45% of ISPs allow keeping the same IP address for more than 30 days.

This is quite surprising. Many people think that IPs change much more frequently.

It also proves that IPs are still relevant in online tracking. Let’s take a closer look at some of the findings.

Short lived vs. long lived IPs

When users are traveling or connected to a WiFi hot-spot, the IP addresses assigned are retained for a short period of time, whereas the IP addresses they were assigned at home or work were found to be retained for longer durations.

The study found that the majority of IPs were either “short lived” or “long lived”.

How often do IP addresses change?

Even though there is a big variance in short vs. long lived assignments, the study took the averages in order to come to some firm conclusions.

77.3% of IPs were retained for less than a week (blue in the chart below), but just under a quarter of IPs were retained for over a week, with 7.1% of IPs retained for more than 2 months (purple in the chart).

Which countries have the ‘stickiest’ IP addresses?

The report also found that the stickiest IPs are from Netherlands ISPs (at 36.96 days on average), and the most cycled IPs are those of Germany, China, Russia and Canada.

Which ISPs cycle IPs most frequently?

The researchers also considered retention by individual ISPs, and found a few in particular that cycled IPs very infrequently.

Does a user’s IP change completely?

No they don’t. When IPs did change, the study noted that sometimes the IP only changed very slightly. For example, 89.158.242.220 may change to 89.158.242.120.

Since the network portion of an IP address is the first 3 parts (i.e. 89.158.242), essentially identifying the ISP, it’s more common for the host part (the last part) to change.

Using IP routines for tracking purposes

In this same study, the researchers noted some patterns in the way an individual user’s IP address routine may allow a pattern to be established.

They observed 58 users in the dataset as having IP cycles that looked like mobility traces.

The IP address changes every morning, remains the same until the evening, and then the same cycle happens the following day.

At the weekend, these same users showed a slightly different pattern. The morning IP change did not happen on Saturdays and Sundays. The obvious conclusion here is that the weekday assigned IPs are when the user connects at work.

How can these IP routines be used?

Using machine learning, it’s likely to be possible to use such patterns along with other signals to link browsing sessions together. So a cycled IP address is not necessarily a hindrance to tracking, it can actually be useful.