Can police trace an IP address?

Yes — but it's paperwork, not wizardry: investigators ask the ISP that owns the address who held it at a given timestamp, under subpoena or court order, and the ISP answers from its subscriber records. What comes back is an account, not a person — and that gap is where real cases are made or unmade. No public database maps IPs to names; a website's lookup gets city-and-ISP at best. The subscriber linkage exists in exactly one place, and it's gated by legal process. Here's how that process actually runs.

Maintained by the ipconfig.io team · Reviewed 1 July 2026

How a trace actually works

1. Identify the network owner. The address's ASN names the ISP — public information anyone can check (curl ipconfig.io/asn-org, or what an ASN is).
2. Serve legal process. A subpoena, production order, or warrant (jurisdiction-dependent) goes to that ISP with the IP and the precise timestamp — essential, because most home addresses rotate.
3. The ISP answers from its logs, within whatever retention window local law and policy give it: account holder, service address, assignment records.
4. Corroborate. Because the answer is an account, investigations then tie a person to the keyboard by other means — device forensics, statements, service records.

Emergency-disclosure paths exist at most ISPs for imminent-harm cases and skip ahead of the queue. In the other direction, cross-border traces crawl: mutual legal assistance between countries takes months, which is why jurisdiction — not technology — is the practical speed limit of most traces.

Where traces get murky

• CGNAT. Thousands of subscribers share one public IP; without the source port logged alongside the timestamp (many services don't), the ISP may genuinely be unable to say which subscriber it was.
• Shared connections. Household Wi-Fi, roommates, guests, open networks, a compromised router — the subscriber and the user are different questions, and courts treat them that way.
• VPNs and proxies. The observed address belongs to the provider, so the trace becomes a second request — to a company whose logs, no-logs audits, and jurisdiction now control the outcome. Well-resourced investigations can still attempt timing correlation across both ends.
• Tor. Designed so no single relay can answer the question — traces shift to endpoint mistakes (logins, malware, opsec) rather than the network.

None of this is a cheat code — it's why serious cases rest on corroboration rather than an IP alone, and why "the IP said it was you" is weaker in court than the movies suggest.

What this means for ordinary people

Two honest takeaways. Your IP is not anonymous — anything you do through it is attributable to your account via a process that exists and works daily. And your IP alone doesn't convict anyone — it locates a connection, with all the shared-Wi-Fi ambiguity that implies. If your interest is reducing what the address exposes day to day, that's the ordinary privacy toolbox: what your ISP sees and how to hide your IP.

Frequently asked questions

Can police trace an IP? Yes — by legal request to the ISP that owns it, which returns the subscriber assigned at that timestamp.

To an exact person? No — to an account and address. Shared connections mean the user still has to be established separately.

How long? Days-to-weeks domestically; near-instant for emergencies; months across borders.

Does a VPN stop it? It relocates the question to the VPN provider — logs and jurisdiction decide from there.

Next steps

• What can someone do with your IP address? — what's visible without any legal process.
• What is CGNAT? — the address-sharing that muddies attribution.
• How to hide your IP — the everyday privacy toolbox, compared honestly.