http://www.slais.ubc.ca/courses/libr...ipanalysis.htm
http://www.cc.gatech.edu/ugrads/v/volstok/docs/ip.shtml
Highlights from the links above
When a user visits a website not only can all of their activities including the time of access, all pages viewed be collected but also information about software installed on the user's computer. When an IP address is collected along with this information, the web surfing habits of companies and individuals can be tracked.
Simply by viewing a webpage with a web browser, the following information about the visiting user and his computer can be collected:
IP Address
Web pages accessed
Time of access
Any form information submitted including search queries or personal information
Web browser software
Operating system
Users with static IP addresses can be tracked over long periods of time, so if website operators traded information with each other, correlations based on static IP address would be even more accurate than correlating by name because IP addresses used on the Internet are globally unique identifiers. No computers on the Internet can have the same IP address at the same time whereas many different people may have the same name as others.
If a user has a dynamic IP address, only information collected within a short time period (minutes to hours depending on user's and ISP's behavior) can be correlated to track a single user. If information over days or weeks is correlated using a dynamic IP address, the information may represent several users rather than one distinct user.
An IP address is a unique identifier that permits anyone who knows it to contact a person's computer, identify the general geographic location of a user, and track their online habits.
A fundamental notion of privacy is the right to be left alone. Since only an IP address is needed to contact and attack a person's computer, knowledge of a person's IP address can infringe of this right.
Many privacy policies do not recognized IP addresses as personally identifiable information. This is misleading, especially for users not familiar with the basics of Internet architecture.
Because IP addresses can be telling of physical location and identity for many Internet users, both users and website privacy policies should recognize IP addresses as personally identifiable information.