IPv6

With IPv4, one home shares one address, which blurs who is who. IPv6 removes the need to share. That is good for the internet, and it raises a privacy question: if each device has its own address, does the address follow the device?

Two halves: the street and the house

An IPv6 address is usually split in half. The first half, the prefix, is given by your internet provider to your home network, like a street name. The second half, the interface identifier, is chosen by each device, like a house number on that street.

2001:db8:4a1:7c00 : 3f2e:91b4:c07d:5a10
|--- prefix ----|   |-- interface ID --|
  (your home)          (one device)

How the device picks its half has changed over the years, and this is where privacy lives.

Three ways a device picks its half

1. From the hardware address (EUI-64), the old way. Every network chip has a fixed hardware number called a MAC address. Early IPv6 built the interface ID straight from it. The same laptop then carried the same second half on every network it joined: home, office, café. That was a tracking ID baked into the address, so systems moved away from it.

2. Stable opaque addresses (RFC 7217). The device mixes a secret with the network's prefix to make an interface ID. On the same network you keep the same address, which is handy for things like printers; on a different network you get a completely different, unlinkable one. Many systems use this by default for their stable address.

3. Temporary privacy addresses (RFC 8981). The device also makes random interface IDs that change regularly, often daily, and uses them for outgoing connections such as web browsing. Yesterday's address and today's do not match.

The catch: the prefix still groups a household

Random interface IDs hide which device is which. They do not hide which home. All your devices share the same prefix, and that prefix often stays the same for days, weeks or longer, depending on the provider.

2001:db8:4a1:7c00:3f2e:91b4:c07d:5a10   laptop, Monday
2001:db8:4a1:7c00:8a01:22cd:6b9e:0f3c   laptop, Tuesday (new temporary ID)
2001:db8:4a1:7c00:d470:5e12:a9b3:7c21   phone, Tuesday
        same prefix -> same household

So a tracker that keeps only the first half of an IPv6 address gets something close to the IPv4 picture: one household, many devices. The home network itself is normally a block called a /64 (the first 64 bits; a bit is one 0 or 1, and an IPv6 address has 128 of them), and providers often give a home a larger block, such as a /56, to split into several networks. That is why careful sites that limit or count by address treat the first 64 bits as "one network".

A common misconception: "temporary addresses make me untraceable". They stop the address from following your device across the web. The prefix still points to your home, and cookies and fingerprints work exactly as before.

For the sites you build: if you store addresses at all, shorten IPv6 to its prefix (or less) and delete it on a schedule. A full IPv6 address plus a time can identify one device.